# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 08:32:01 +0000] info [cpaneld] 62.146.238.204 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.183.23
country_id: 2921044
domain: mail.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.smarty.tg.154-70-82-246.cpanel.site/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 152.136.40.205
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/kara-le-collectif-des-acteurs-de-la-filiere-sesame-en-assemblee-generale/<script async src=||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.112.13.213
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/334770417 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 08:36:25 +0000] info [webmaild] 160.242.195.10 - gndong@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.21.132.214
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/internet-mobile-le-togo-leader-de-luemoa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.21.132.214
country_id: 286963
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/internet-mobile-le-togo-leader-de-luemoa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.110
country_id: 1880251
description:
43.173.174.110 - - [30/Jun/2026:08:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077286&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D3095&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808664 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=3095" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.110


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:38:03 ns5 pure-ftpd[1644525]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:38:09 ns5 pure-ftpd[1644525]: (?@134.122.27.233) [WARNING] Authentication failed for user [rolle]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:089e855c0d677f497021b08bb4ff1e3ee8cd33ef||Title:d5knr22k1k2k6363d||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.160
country_id: 3469034
description:
Jun 30 08:38:46 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 68.183.245.101
country_id: 1269750
description:
68.183.245.101 - - [30/Jun/2026:08:39:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662869&pdata=http%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808747 HTTP/1.1" 302 0 wages.tg "http://wages.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:68.183.245.101


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.36.180.204
country_id: 3277605
description:
92.36.180.204 - - [30/Jun/2026:08:39:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052445&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-366019fetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808786 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-366019fetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.36.180.204


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b196ec23c3a76b27d729ee7dcb84c858a082f78c||Title:qyxrll2lrnwg8h8cgk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29885949079e0d136dc04b1b5ea0e6a5f9edfca3||Title:qr0itjwmg58rk8||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:40:44 +0000] info [cpaneld] 167.99.236.81 - einguval "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:41:10 +0000] info [cpaneld] 68.183.234.53 -  myxlsnta  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c0b3eb5079414f44863c15f600c4771c2be9884||Title:i7rf091hhs3wt6oq||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcb7f03110fe32f3fce58279c9d13797e756f19e||Title:5cnp84bous38hcmlw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07146b575766768812ead9a315bac7cf3de94ab8||Title:aacjufzcq9t3dqox3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:43:03 +0000] info [cpaneld] 64.111.92.123 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ae2741d3db825e9056ec85a8f3265e8f00911d93||Title:ne74rohatrfq3a7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.142.204
country_id: 3658394
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/donnee HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@cloud-et-racks.tg [06/30/2026:08:45:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:45:38 +0000] info [cpaneld] 64.111.92.123 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0c2f579412de9643e624032326576f24a2b1d79||Title:mzy2snkc9l3uigb1qj||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4bef22ae527cb8343e3a73aa68d3c7d073805b72||Title:bluco0xhkgcjhda9n0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cloud-racks@cloud-et-racks.tg [06/30/2026:08:47:05 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cloud-racks@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:47:08 +0000] info [cpaneld] 167.99.236.81 - netmast "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d39ca1e1ce20a8601606c5c12a1cbd89aeda9ef6||Title:42t7el14dz0ypi||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9164e8a4095d855fcf4ad942e01d4368c6f669bb||Title:w6ax9wrlgjoewaa9g||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 08:48:02 +0000] info [webmaild] 102.176.253.226 - presidence@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.158.123.195
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cooperation-le-prof-robert-dussey-en-visite-de-travail-a-ndjamena/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.158.123.195
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/cooperation-le-prof-robert-dussey-en-visite-de-travail-a-ndjamena/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 108.59.4.208
country_id: 6252001
description:
2026-06-30 08:49:37 H=([108.59.4.208]) [108.59.4.208]:50001 F=<cxlo@white-ways.com> rejected RCPT <whiteway@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18be5b4698f7361ab531b0b42f0541e7de3c5c2c||Title:dapavmryp4w85del||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93df2d710ccbca6a8a633692ed0563a3956b4167||Title:6263oxzt7j4yxk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9c04a0702bd2225a35a7abc693d1603613c930b||Title:pksrj4u76jt626||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@cloud-et-racks.tg [06/30/2026:08:51:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@cloud-et-racks.tg


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f70ae9e802151b64b861006f64ab21d9c70de34||Title:bgomvysjl0r8yni2iw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.121.103
country_id: 2635167
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.105.121.103||TA:198.105.121.103||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:047585b47e6634d6065ef72a8615ce6ae33cd89d||Title:13a6b1fqq9p3kp||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/30/2026:08:54:35 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:54:33 ns5 pure-ftpd[1652231]: (?@134.122.27.233) [WARNING] Authentication failed for user [yvwaocrr]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b23349556bbc7769a637985079562468c169dfdf||Title:f4oai52dgf111q9u4||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.20.185.144
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.20.185.144||TA:198.20.185.144||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:54:28 ns5 pure-ftpd[1652231]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - support@cloud-et-racks.tg [06/30/2026:08:55:09 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: support@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.214.144
country_id: 1168579
domain: www.corpsdiplomaticnews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.corpsdiplomaticnews.tghttp/www.corpsdiplomaticnews.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:99a8109f2f68bf89ca01be86bc9ca2145fb4eddb||Title:vb9urrmqs1lnr7kt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.228.194
country_id: 2077456
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:46.203.228.194||TA:46.203.228.194||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.214.144
country_id: 1168579
domain: www.corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.corpsdiplomaticnews.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.37.217.228
country_id: 953987
description:
2026-06-30 08:55:41 dovecot_login authenticator failed for H=(ADMIN) [102.37.217.228]:60916: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4100f1dea4a8266699c74c32720c37e419859211||Title:ndeko7udifeuvwhnt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4154471e116940d118b8860006e390577f6b3f43||Title:745g80swfb2kca7n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:58:09 ns5 pure-ftpd[1654003]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcf55b0283bb85450afa27ca43727f241645d007||Title:44gr6bdkbst0oxejtj||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:58:07 +0000] info [cpaneld] 64.111.92.123 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:58:15 ns5 pure-ftpd[1654005]: (?@134.122.27.233) [WARNING] Authentication failed for user [bighostingsnbd]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d7f8f88d868f2ff6dc9afbc423ebbd8cf68f71f||Title:rdkgtflsh1og29sxya||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20ae065ef23030c6ce611d261cd088ad04bbe479||Title:olvhbxb5dyngjk99ag||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-30 09:00:03 +0000] info [webmaild] 196.171.46.177 - mawide@togointerim.net "GET /cpsess1553177919/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4331d7d4ed83171f758765d65f1926a1f3987dc9||Title:m07go1gzdaq0e0x||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 09:01:06 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-30 09:01:43 H=([77.83.39.59]) [77.83.39.59]:59970 F=<info@bluemarine-services.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aeb9e9e2387bccf64639b144bcbe296dd26d33df||Title:7en2y1exihwa3dvn3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.25
country_id: 6252001
description:
Jun 30 09:01:58 ns5 pure-ftpd[1655644]: (?@207.90.244.25) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:03:51 ns5 pure-ftpd[1656345]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-30 09:03:55 H=([77.83.39.59]) [77.83.39.59]:61694 F=<advising.service@advising.hsbc.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9bb8fb0838361cc92c5d90819f7ce5348c5ee31b||Title:j3lfvpk0x5ouryh||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.136.227.46
country_id: 3996063
description:
187.136.227.46 - - [30/Jun/2026:09:03:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212778&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-80011xetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810223 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-80011xetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.136.227.46


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.58.78.56
country_id: 1643084
description:
202.58.78.56 - - [30/Jun/2026:09:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118240&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-162202citems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810257 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-162202citems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.58.78.56


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 09:04:55 +0000] info [cpaneld] 129.212.228.74 - stephane "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c32ca1ec57960773098ceb4e4028cf8eb06e0e36||Title:w2tmpzq5z8crfbxok||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08d1448006474165ce1fd0f708d39efbcc96e902||Title:da46u1femvj44w8x6k||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:07:13 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.92.137
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-09.89.124.92.137||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.106.51.102
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.106.51.102
country_id: 1527747
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:10:04 +0000] info [cpaneld] 64.111.92.123 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [30/Jun/2026:09:11:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055882&pdata=http%253A%252F%252Fsocial-infos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810699 HTTP/1.1" 302 0 social-infos.tg "http://social-infos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.206
country_id: 298795
description:
Jun 30 09:11:36 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.65.193.96
country_id: 1643084
description:
2026-06-30 09:14:46 dovecot_plain authenticator failed for H=(localhost) [179.65.193.96]:1353: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [30/Jun/2026:09:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974619&pdata=http%253A%252F%252Fjlkjum.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810909 HTTP/1.1" 302 0 jlkjum.mediatopnews.tg "http://jlkjum.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [30/Jun/2026:09:15:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132072&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810911 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [30/Jun/2026:09:19:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051370&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782811194 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.12
country_id: 3469034
description:
Jun 30 09:22:50 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.38.37
country_id: 6252001
domain: mail.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.worldinfo.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:24:46 +0000] info [whostmgrd] 80.248.64.198 - root "GET /cpsess6495117563/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [102.64.162.100] != Current IP Address [80.248.64.198]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.204.211
country_id: 3144096
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.250.204.211||TA:104.250.204.211||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:26:55 +0000] info [cpaneld] 64.111.92.123 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 09:28:37 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "POST /cpsess3580956980/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.64.164.131] != Current IP Address [160.242.195.10]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:32:22 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:32:22 +0000] info [whostmgrd] 80.248.64.198 PURGE root:2KVkxuTQ8NFMq9SR badpass [user password incorrect]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:32:13 ns5 pure-ftpd[1672294]: (?@134.122.27.233) [WARNING] Authentication failed for user [esso]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:32:46 +0000] info [whostmgrd] 80.248.64.198 NEW root:GdGEr8hvMTtb9gHC address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.16.227
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:167.253.16.227||TA:167.253.16.227||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:32:08 ns5 pure-ftpd[1672279]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:33:28 +0000] info [cpaneld] 64.111.92.123 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.50
country_id: 798544
description:
Jun 30 09:34:05 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.38.156.78
country_id: 798544
description:
45.38.156.78 - - [30/Jun/2026:09:35:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120643&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Fme-eric-sossa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812128 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/me-eric-sossa/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.8513.1583 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.38.156.78


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 91.247.163.183
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:p||MV:33' UNION SELECT NULL-- -||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 91.247.163.183
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://cafe.tg/?p=33' UNION SELECT NULL-- -||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.135.175.190
country_id: 6252001
description:
43.135.175.190 - - [30/Jun/2026:09:37:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868182&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F07%252F10%252Ftogo-la-cedeao-prend-acte-de-ladoption-de-la-nouvelle-constitution-et-lance-un-appel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812239 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/07/10/togo-la-cedeao-prend-acte-de-ladoption-de-la-nouvelle-constitution-et-lance-un-appel/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.135.175.190


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.203
country_id: 1880251
description:
43.172.198.203 - - [30/Jun/2026:09:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658963&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526cat%253D8&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812331 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&cat=8" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 09:38:14 +0000] info [cpaneld] 167.99.236.81 - tresorerie "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.0.60.217
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-38.200.0.60.217||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.120.45
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-38.138.219.120.45||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:38:55 +0000] info [cpaneld] 64.111.92.123 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [30/Jun/2026:09:38:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923438&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812299 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:40:14 +0000] info [cpaneld] 64.111.92.123 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.61.203
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-bidc-et-afriland-first-bank-ci-concluent-un-partenariat-de-10-milliards-fcfa-pour-soutenir-la-croissance-des-pme-en-cote-divoire/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.61.203
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-bidc-et-afriland-first-bank-ci-concluent-un-partenariat-de-10-milliards-fcfa-pour-soutenir-la-croissance-des-pme-en-cote-divoire/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [30/Jun/2026:09:42:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657643%26pdata=http://www.lasnbtg.snb.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1782812556 HTTP/1.1" 404 561 www.lasnbtg.snb.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:41:57 ns5 pure-ftpd[1680645]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [30/Jun/2026:09:46:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855577&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812783 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [30/Jun/2026:09:46:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171685&pdata=https%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812814 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:47:57 +0000] info [cpaneld] 64.111.92.123 - admin@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 165.99.196.21
country_id: 1210997
domain: anamek.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23017.anamek.tg||ServerName:anamek.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c39a24be7cdc9f6a91b02d7033d6a22b804de314||Title:0xdc778f2a||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.94.66.213
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.94.66.213: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 09:50:04 +0000] info [cpaneld] 20.212.169.175 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [30/Jun/2026:09:50:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128936&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813034 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 09:50:39 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.255.126
country_id: 2562770
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.202.255.126||TA:142.202.255.126||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.188
country_id: 3175395
description:
Jun 30 09:52:04 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.188 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.56
country_id: 1880251
description:
43.173.180.56 - - [30/Jun/2026:09:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132329&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D5776&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813300 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=5776" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.56


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 09:56:39 +0000] info [cpaneld] 167.99.236.81 - wifizoneuser "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:56:31 ns5 pure-ftpd[1687548]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:56:36 ns5 pure-ftpd[1687548]: (?@134.122.27.233) [WARNING] Authentication failed for user [wifizoneuser]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [30/Jun/2026:09:56:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068906&pdata=http%253A%252F%252Fywxmm6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813399 HTTP/1.1" 302 0 ywxmm6.mediatopnews.tg "http://ywxmm6.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.17
country_id: 6252001
description:
205.169.39.17 - - [30/Jun/2026:09:56:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052040&pdata=http%253A%252F%252Fxhhehr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813410 HTTP/1.1" 302 0 xhhehr.mediatopnews.tg "http://xhhehr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 20.223.54.57
country_id: 2963597
description:
20.223.54.57 - - [30/Jun/2026:09:57:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736743&pdata=http%253A%252F%252Farse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813427 HTTP/1.1" 302 0 arse.tg "http://arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:20.223.54.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:58:26 +0000] info [cpaneld] 64.111.92.123 - https "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user https (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.96.221.135
country_id: 2077456
description:
[2026-06-30 09:59:44 +0000] info [cpaneld] 27.96.221.135 - ayhhhyhk "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.219
country_id: 1880251
description:
43.173.175.219 - - [30/Jun/2026:09:59:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937927&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Ful-voici-les-nouveaux-directeurs-et-doyens-des-etablissements%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813541 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/a-la-une/ul-voici-les-nouveaux-directeurs-et-doyens-des-etablissements/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.219


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.255.12
country_id: 2562770
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.202.255.12||TA:142.202.255.12||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.35.178
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.239.35.178||TA:104.239.35.178||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 10:00:05 +0000] info [cpaneld] 64.111.92.123 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.130.217.39
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 195.130.217.39: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.152
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.147.132.152||TA:142.147.132.152||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.121.125
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.37.121.125||TA:198.37.121.125||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [30/Jun/2026:10:03:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881450&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813778 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.181.85
country_id: 1327865
description:
2026-06-30 10:04:00 dovecot_plain authenticator failed for H=(localhost) [103.172.181.85]:22155: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [30/Jun/2026:10:04:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738140&pdata=http%253A%252F%252Flasnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813847 HTTP/1.1" 302 0 lasnb.tg "http://lasnb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 10:04:20 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "POST /cpsess0754317515/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.64.164.131] != Current IP Address [160.242.195.10]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [30/Jun/2026:10:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989527&pdata=http%253A%252F%252Fwww.lasnbtg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813929 HTTP/1.1" 302 0 www.lasnbtg.snb.tg "http://www.lasnbtg.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.63.128.4
country_id: 1861060
description:
72.63.128.4 - - [30/Jun/2026:10:06:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946520&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fliste%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813958 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/liste/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.3038.1188 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.63.128.4


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.77.223.228
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.77.223.228||TA:185.77.223.228||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.87.253
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/journee-du-1er-juin-a-la-snb HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.193
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.old||User:cloudetracks||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 83.142.52.53
country_id: 294640
domain: cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:wpforms[fields][6]||MV:1' UNION SELECT NULL-- -||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [30/Jun/2026:10:11:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266278&pdata=http%253A%252F%252Fjvvtdy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814253 HTTP/1.1" 302 0 jvvtdy.mediatopnews.tg "http://jvvtdy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jun 30 10:14:47 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.120.41
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.120.120.41||TA:172.120.120.41||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.25
country_id: 1880251
description:
43.173.174.25 - - [30/Jun/2026:10:15:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039592&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D1%2526page%253D106&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814535 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=1&page=106" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.205.207.11
country_id: 290557
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-bitter-lemon-by-chap HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.225.187.6
country_id: 1643084
description:
2026-06-30 10:15:10 dovecot_login authenticator failed for H=fast-internet-43-225-187-6.solnet.net.id (Bijiorkas-MacBook-Pro.local) [43.225.187.6]:58920: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.10.85
country_id: 1269750
description:
Jun 30 10:15:44 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.10.85 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.235.102
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.235.102||TA:45.147.235.102||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 10:16:19 +0000] info [cpaneld] 167.99.236.81 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [30/Jun/2026:10:16:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606505&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fministre-des-medias%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814615 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/ministre-des-medias/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.165.163
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.165.163||TA:92.112.165.163||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.70.39.83
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 3.70.39.83: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.64.19.207
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 3.64.19.207: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 63.176.24.131
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 63.176.24.131: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.103.232
country_id: 458258
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.131.103.232||TA:45.131.103.232||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.98.168.124
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.98.168.124||TA:172.98.168.124||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 63.178.154.74
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 63.178.154.74: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.101.238
country_id: 458258
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.131.101.238||TA:45.131.101.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.165.231
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.117.165.231||TA:217.117.165.231||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.16.252
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.16.252||TA:152.232.16.252||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.166
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:202.155.186.166||TA:202.155.186.166||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.103.30
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.103.30||TA:152.232.103.30||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.97
country_id: 1880251
description:
43.173.180.97 - - [30/Jun/2026:10:19:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128212&pdata=http%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814770 HTTP/1.1" 404 561 dagl.tg "http://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.97


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.196.219
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ihpc-flambee-des-produits-frais-recul-des-cereales-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 10:19:44 +0000] info [cpaneld] 167.99.236.81 - k.eklou "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.196.219
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ihpc-flambee-des-produits-frais-recul-des-cereales-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.237.102.139
country_id: 2750405
description:
[2026-06-30 10:22:57 +0000] info [cpaneld] 185.237.102.139 NEW conforwellty:Lgi4gN23kc4KDSyK address=185.237.102.139,app=cpaneld,creator=conforwellty,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [30/Jun/2026:10:25:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923015&pdata=http%253A%252F%252Fsp-eau.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815100 HTTP/1.1" 302 0 sp-eau.tg "http://sp-eau.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.5
country_id: 6251999
description:
[2026-06-30 10:26:00 +0000] info [cpaneld] 195.63.16.5 - cafeitadm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.153.194.188
country_id: 1880251
description:
43.153.194.188 - - [30/Jun/2026:10:26:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055326&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fitalie-giorgia-meloni-devoile-son-plan-pour-lafrique%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815171 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/italie-giorgia-meloni-devoile-son-plan-pour-lafrique/?amp=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.153.194.188


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.116.132
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.37.116.132||TA:198.37.116.132||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [30/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039847&pdata=https%253A%252F%252Fblitta1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815312 HTTP/2.0" 302 0 blitta1.mairie.tg "https://blitta1.mairie.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.222.174.47
country_id: 2661886
description:
104.222.174.47 - - [30/Jun/2026:10:31:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118227&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Ffndc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815471 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/fndc/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.1603.1139 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.222.174.47


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-30 10:31:45 +0000] info [cpaneld] 157.66.56.39 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.251.74.98
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.40.126
country_id: 3469034
domain: www.u.inh.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u.inh.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 208.74.105.183
country_id: 6252001
domain: bawasongroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:48027.bawasongroup.com||ServerName:bawasongroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:39a1ac791c255faa9743a6bb051f60f6959859c5||Title:0x50367400||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.161.48.149
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:290ff98014132b7d3dff10ceb677063469a82637||Title:h3u2u0rlb0ckl3tgls||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.161.48.149
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:574161862b935840d03f95e17c59d43f5a362fbe||Title:eoq36datp1x7j9on||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.161.48.149
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e5e3656b66330af94e757fe6969bc3e7b19bd216||Title:ydwh5l3zl8f2d6whg2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.161.48.149
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4e5613911330ff6d03b4fd655c972c94d0e1507||Title:j7q5dndc1tdzfo70p||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.67.85.51
country_id: 1062947
description:
2026-06-30 10:44:08 dovecot_plain authenticator failed for H=(localhost) [153.67.85.51]:29430: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.113.120
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.133.113.120||TA:45.133.113.120||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.101.205
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.101.205||TA:152.232.101.205||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 178.104.183.0
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 178.104.183.0: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 10:50:19 +0000] info [cpaneld] 64.111.92.123 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.179.108
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/banque-mondiale-lecons-du-sahel-et-strategie-togolaise/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.179.108
country_id: 286963
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/banque-mondiale-lecons-du-sahel-et-strategie-togolaise/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.225
country_id: 1880251
description:
43.173.175.225 - - [30/Jun/2026:10:52:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7102663&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D11138&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782816727 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=11138" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.225


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.219.95
country_id: 2363686
description:
[2026-06-30 10:52:45 +0000] info [webmaild] 196.168.219.95 - ci@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [185.45.15.45] != Current IP Address [196.168.219.95]


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/rU7S_TaoIdI[/embed]||WPU:direct7tv||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.163.81.197
country_id: 690791
domain: 24heureinfo.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/24heureinfo.tghttp/24heureinfo.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-06-30 10:56:56 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:d_pvWkLERm0D12vx address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cfpj@cfpj.tg [06/30/2026:10:57:17 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cfpj@cfpj.tg


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 82.80.249.220
country_id: 294640
domain: www.togosem.com
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/2025/03/30/casibom-casino-resmi-giris/www.casibom.bamboulasnola.com||User:aogodmm||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 10:58:12 +0000] info [cpaneld] 167.99.236.81 - @civile*_@mag "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.191
country_id: 1880251
description:
43.173.180.191 - - [30/Jun/2026:10:59:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183559&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9130&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782817157 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=9130" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.191


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.8.245
country_id: 2363686
domain: sp-eau.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/6?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/tXlKZUlbedY[/embed]||WPU:direct7tv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cfpj@cfpj.tg [06/30/2026:11:02:49 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cfpj@cfpj.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 11:02:48 +0000] info [cpaneld] 64.111.92.123 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 131.0.205.36
country_id: 3469034
description:
131.0.205.36 - - [30/Jun/2026:11:03:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792921&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-289240eitems%252Fetidm86qe.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782817393 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-289240eitems/etidm86qe.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:131.0.205.36


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/pRLPZieemH0[/embed]||WPU:direct7tv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.28.18
country_id: 2363686
description:
[2026-06-30 11:08:30 +0000] info [cpaneld] 196.171.28.18 NEW togoinrdceh:6xQnRX4CZaMn5IfR address=196.171.28.18,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.171.62.19
country_id: 2363686
description:
Jun 30 11:09:02 ns5 pure-ftpd[1724221]: (?@196.171.62.19) [WARNING] Authentication failed for user [agence@caissederetraites.tg]


plugin: ossec
rule: 11309
name: FTP Authentication success.
abuser: 196.171.62.19
country_id: 2363686
description:
Jun 30 11:09:06 ns5 pure-ftpd[1724437]: (?@196.171.62.19) [INFO] agence@caissederetraites.tg is now logged in


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.118.197.156
country_id: 6252001
description:
[2026-06-30 11:10:32 +0000] info [whostmgrd] 208.118.197.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.202.130
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:191.96.202.130||TA:191.96.202.130||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.102.54.5
country_id: 3996063
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/7 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.204.108.142
country_id: 1819730
description:
[2026-06-30 11:13:23 +0000] info [webmaild] 103.204.108.142 - sahondo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>les fortes pluies qui s\xe2\x80\x99abattent actuellement sur la capitale togolaise ont provoqu\xc3\xa9 de graves inondations dans plusieurs secteurs du district autonome du grand lom\xc3\xa9 (dagl). la circulation est fortement perturb\xc3\xa9e et plusieurs plans de d\xc3\xa9viation ont \xc3\xa9t\xc3\xa9 mis en place en urgence pour garantir la s\xc3\xa9curit\xc3\xa9 des usagers.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>si vous devez absolument vous d\xc3\xa9placer, d\xc3\xa9couvrez la liste compl\xc3\xa8te des axes routiers touch\xc3\xa9s et les itin\xc3\xa9raires alternatifs \xc3\xa0 emprunter.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>liste des axes routiers perturb\xc3\xa9s et d\xc3\xa9viations en cours</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la mont\xc3\xa9e des eaux rend certains tron\xc3\xa7ons totalement ou partiellement impraticables. voici les points critiques recens\xc3\xa9s par les autorit\xc3\xa9s :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31646,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/749925e9-e65a-4a62-b560-07738c6cb9e3.jpg\" alt=\"\" class=\"wp-image-31646\"/><figcaption class=\"wp-element-caption\"><strong><em>le ministre calixte madjoulba sur le terrain pour constater les d\xc3\xa9g\xc3\xa2ts</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li><strong>avenue de la lib\xc3\xa9ration :</strong> circulation perturb\xc3\xa9e sur le tron\xc3\xa7on <strong>ramco \xe2\x80\x93 commissariat central</strong>. une d\xc3\xa9viation est actuellement en cours.</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li><strong>zone b\xc3\xa8 :</strong> l'axe reliant le <strong>commissariat de police de b\xc3\xa8-kp\xc3\xa9nou au march\xc3\xa9 de b\xc3\xa8</strong> est fortement impact\xc3\xa9.</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li><strong>route de segb\xc3\xa9 :</strong> zone critique signal\xc3\xa9e entre <strong>marada et la douane</strong>.</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li><strong>axe djagbl\xc3\xa9 \xe2\x80\x93 k\xc3\xa9gu\xc3\xa9 :</strong> la circulation est <strong>compl\xc3\xa8tement bloqu\xc3\xa9e</strong> dans le sens djagbl\xc3\xa9 vers k\xc3\xa9gu\xc3\xa9. pour pallier ce blocage, le sens <strong>k\xc3\xa9gu\xc3\xa9 \xe2\x86\x92 djagbl\xc3\xa9 a \xc3\xa9t\xc3\xa9 am\xc3\xa9nag\xc3\xa9 en double sens</strong>.</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li><strong>axe place bonke (ancienne lonato) \xe2\x80\x93 chu sylvanus olympio :</strong> zone inond\xc3\xa9e, une d\xc3\xa9viation est active.</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li><strong>secteur 3k :</strong> on enregistre un d\xc3\xa9bordement des deux bassins du bas-fond.<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li><em>sens nord \xe2\x86\x92 sud :</em> la circulation reste possible.</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li><em>sens sud \xe2\x86\x92 nord :</em> circulation bloqu\xc3\xa9e, une d\xc3\xa9viation est organis\xc3\xa9e \xc3\xa0 partir du <strong>carrefour 3k</strong>.</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>consignes de s\xc3\xa9curit\xc3\xa9 et recommandations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les autorit\xc3\xa9s appellent \xc3\xa0 la plus grande prudence. face aux chauss\xc3\xa9es submerg\xc3\xa9es et au manque de visibilit\xc3\xa9 nocturne, il est fermement recommand\xc3\xa9 de :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- suivre scrupuleusement les instructions des forces de s\xc3\xa9curit\xc3\xa9 et des agents de police d\xc3\xa9ploy\xc3\xa9s sur le terrain pour guider les automobilistes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31648,\"width\":\"500px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/e2af77ee-6d6f-47bc-99b0-cf5bdc700bf7.jpg\" alt=\"\" class=\"wp-image-31648\" style=\"width:500px;height:auto\"/><figcaption class=\"wp-element-caption\"><em><strong>des mesures urgentes prises pour lib\xc3\xa9rer les routes bloqu\xc3\xa9es </strong></em></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>- r\xc3\xa9duire la vitesse et garder de larges distances de s\xc3\xa9curit\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- \xc3\x89viter de force le passage dans les zones o\xc3\xb9 le niveau de l'eau est incertain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>num\xc3\xa9ros d'urgence gratuits \xc3\xa0 composer (num\xc3\xa9ros verts)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en cas de d\xc3\xa9tresse, d'inondation \xc3\xa0 domicile ou d'accident, contactez imm\xc3\xa9diatement les services de secours du togo via ces num\xc3\xa9ros gratuits :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>170: anpc</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>118: sapeurs pompiers</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1014: centre national de commandement unifi\xc3\x89</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>117 et 1244: police nationale</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>172: gendarmerie nationale</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em> </em></strong><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.237.102.141
country_id: 2750405
description:
[2026-06-30 11:14:54 +0000] info [cpaneld] 185.237.102.141 - conforwellty "GET /cpsess8497561347/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [185.237.102.139] != Current IP Address [185.237.102.141]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.37.120
country_id: 2264397
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:181.214.37.120||TA:181.214.37.120||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.122
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.147.132.122||TA:142.147.132.122||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.226
country_id: 1512440
description:
2026-06-30 11:19:54 H=([0.0.0.0]) [84.54.70.226]:6041 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 11:21:23 +0000] info [cpaneld] 64.111.92.123 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-30 11:24:14 +0000] info [cpaneld] 196.170.66.202 NEW ingertgsarl:CM2uIvKcedSwQFge address=196.170.66.202,app=cpaneld,creator=ingertgsarl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 77.83.39.151
country_id: 690791
description:
Jun 30 11:24:33 ns5 pure-ftpd[1731914]: (?@77.83.39.151) [WARNING] Authentication failed for user [stephane.o]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-30 11:25:31 +0000] info [cpaneld] 157.66.56.39 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:26:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65262: 535 Incorrect authentication data (set_id=engineering@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.42
country_id: 2510769
description:
Jun 30 11:26:52 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:26:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7120: 535 Incorrect authentication data (set_id=mariola@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:27:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19558: 535 Incorrect authentication data (set_id=bdd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:27:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55542: 535 Incorrect authentication data (set_id=virtual@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:28:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18392: 535 Incorrect authentication data (set_id=europe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:28:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17056: 535 Incorrect authentication data (set_id=usuario2@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 11:28:19 +0000] info [cpaneld] 20.212.169.175 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:29:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9502: 535 Incorrect authentication data (set_id=istaellet@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.154
country_id: 1269750
description:
Jun 30 11:29:08 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:29:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:65314: 535 Incorrect authentication data (set_id=sohail@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 130.49.114.32
country_id: 3017382
description:
130.49.114.32 - - [30/Jun/2026:11:29:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262682&pdata=https%253A%252F%252Fmesyscom.com%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782818986 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:130.49.114.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:30:56 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:30:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54720: 535 Incorrect authentication data (set_id=23@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:29:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41588: 535 Incorrect authentication data (set_id=dongle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:30:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50546: 535 Incorrect authentication data (set_id=23@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:30:57 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:30:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31294: 535 Incorrect authentication data (set_id=cad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:31:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1814: 535 Incorrect authentication data (set_id=poor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:31:58 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:32:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30086: 535 Incorrect authentication data (set_id=francesca@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:32:33 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:32:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27996: 535 Incorrect authentication data (set_id=larry@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.164
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.164||TA:188.119.190.164||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.21
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.21||TA:188.119.190.21||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.107
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.107||TA:188.119.190.107||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.146
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.146||TA:188.119.190.146||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.216
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.216||TA:188.119.190.216||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45340: 535 Incorrect authentication data (set_id=kostya@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:33:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21148: 535 Incorrect authentication data (set_id=dreamer@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.106
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.106||TA:188.119.190.106||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.156
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.156||TA:188.119.190.156||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-06-30 11:33:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:50971: 535 Incorrect authentication data (set_id=premier)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:33:09 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.86
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.86||TA:188.119.190.86||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.48
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.48||TA:188.119.190.48||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.155
country_id: 1269750
description:
Jun 30 11:33:00 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.108
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.108||TA:188.119.190.108||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:33:34 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:34:12 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.130
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.130||TA:188.119.190.130||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:34:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1842: 535 Incorrect authentication data (set_id=sftpuser@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.165
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.165||TA:188.119.190.165||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:33:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62174: 535 Incorrect authentication data (set_id=sftpuser@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 188.119.190.228
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:188.119.190.228||TA:188.119.190.228||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:34:06 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:34:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36456: 535 Incorrect authentication data (set_id=babette@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:35:05 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.247.163.193
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:91.247.163.193||TA:91.247.163.193||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:35:01 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:35:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65068: 535 Incorrect authentication data (set_id=data@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:35:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12890: 535 Incorrect authentication data (set_id=raf@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:36:12 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:36:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46410: 535 Incorrect authentication data (set_id=nguyennguyen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-06-30 11:36:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:41519: 535 Incorrect authentication data (set_id=box)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:36:38 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:36:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18088: 535 Incorrect authentication data (set_id=gregory@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-06-30 11:37:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:41915: 535 Incorrect authentication data (set_id=box)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:37:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32722: 535 Incorrect authentication data (set_id=mikrotik@ns5.netmaster.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.49.38.48
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-37.64.49.38.48||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:37:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6748: 535 Incorrect authentication data (set_id=bien-vieillir@ns5.netmaster.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.8.48
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-37.45.147.8.48||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:37:25 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:37:09 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:37:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:63818: 535 Incorrect authentication data (set_id=bien-vieillir@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:38:03 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.120
country_id: 3469034
description:
Jun 30 11:38:13 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:38:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13438: 535 Incorrect authentication data (set_id=marketa@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.212.115.62
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.212.115.62||TA:185.212.115.62||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:38:08 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:38:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47736: 535 Incorrect authentication data (set_id=nitin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:38:59 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.198.12
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/images/index.php||SC:/home/cipvzfnv/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:39:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12226: 535 Incorrect authentication data (set_id=yokohama@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.137.233.235
country_id: 3625428
description:
38.137.233.235 - - [30/Jun/2026:11:39:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735253&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-219043hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782819546 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-219043hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.137.233.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:38:59 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:39:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24158: 535 Incorrect authentication data (set_id=ivanna@ns5.netmaster.tg)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 182.184.166.73
country_id: 1168579
domain: www.togosem.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.21||T:APACHE||MVN:ARGS:lt;img class||MV:\"wp-post-image\" style=\"display: block;margin-left:auto;margin-right:auto;\" width=\"{600-601-602-603-604-605-606-607-608-609}px\" alt=\"\xd0\xbf\xd0\xb8\xd0\xbd \xd0\xb0\xd0\xbf \xd0\xba\xd0\xb7\" src=\"https://sweepstake-casinos.com/wp-content/uploads/2023/05/ding-ding-ding-casino-deposit-bonus-768x452.jpg\"||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:40:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57688: 535 Incorrect authentication data (set_id=mike01@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3382: 535 Incorrect authentication data (set_id=landray@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:40:15 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.139.198.12
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cipvzfnv/public_html/wp-includes/SimplePie/about.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.198.12
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/cipvzfnv/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:40:00 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.139.198.12
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cipvzfnv/public_html/wp-includes/SimplePie/index.php||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:41:11 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.198.12
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/cipvzfnv/public_html/wp-admin/images/about.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.149.90
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/inscription/ucaoinscription/vendor/symfony/translation/Resources/schemas/xliff-core-2.0.xsd||User:ucaouut||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:41:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48670: 535 Incorrect authentication data (set_id=wildman1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:41:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18060: 535 Incorrect authentication data (set_id=melbourne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:41:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44498: 535 Incorrect authentication data (set_id=wildman1@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.121.43.61
country_id: 1168579
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/40eme-anniversaire-de-la-cica-re HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 54.243.17.58
country_id: 6252001
domain: selithgroup.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:EmailWolf 1.00||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:42:36 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:42:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58840: 535 Incorrect authentication data (set_id=joanne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:42:06 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:42:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47510: 535 Incorrect authentication data (set_id=atomic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:43:42 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:43:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65092: 535 Incorrect authentication data (set_id=collector@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:43:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20352: 535 Incorrect authentication data (set_id=site1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:43:00 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/30/2026:11:44:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-06-30 11:44:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:34283: 535 Incorrect authentication data (set_id=tct)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:44:03 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:44:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15150: 535 Incorrect authentication data (set_id=shared@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:44:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44892: 535 Incorrect authentication data (set_id=wbem@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:44:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52354: 535 Incorrect authentication data (set_id=wbem@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:44:19 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:45:00 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:45:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28714: 535 Incorrect authentication data (set_id=doconnor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:45:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56124: 535 Incorrect authentication data (set_id=lijy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:45:02 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.146.3
country_id: 1861060
domain: snbrasseriecom.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-content/uploads/wp-login.php||SC:/home/bighostingsnbd/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 30 11:46:05 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-30 11:46:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61978: 535 Incorrect authentication data (set_id=pr@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 11:46:17 +0000] info [cpaneld] 20.212.169.175 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 30 11:46:31 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-30 11:45:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59084: 535 Incorrect authentication data (set_id=log@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-06-30 11:48:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:20670: 535 Incorrect authentication data (set_id=beauty-salon)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 11:49:52 +0000] info [cpaneld] 167.99.236.81 - antasadmin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.118
country_id: 1880251
description:
43.173.176.118 - - [30/Jun/2026:11:49:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038311&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fauthor%253D2%2526paged%253D335&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782820146 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?author=2&paged=335" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-06-30 11:49:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:18166: 535 Incorrect authentication data (set_id=beauty-salon)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.253.6.36
country_id: 6252001
description:
[2026-06-30 11:50:50 +0000] info [cpaneld] 69.253.6.36 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.218.30.248
country_id: 6252001
description:
[2026-06-30 11:50:58 +0000] info [cpaneld] 97.218.30.248 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.2.89.148
country_id: 6252001
description:
[2026-06-30 11:50:30 +0000] info [cpaneld] 100.2.89.148 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.30.142.221
country_id: 6252001
description:
[2026-06-30 11:50:54 +0000] info [cpaneld] 108.30.142.221 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 11:50:29 +0000] info [cpaneld] 64.111.92.123 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.38.65.252
country_id: 6252001
description:
[2026-06-30 11:50:38 +0000] info [cpaneld] 68.38.65.252 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.4.171
country_id: 6252001
description:
[2026-06-30 11:50:42 +0000] info [cpaneld] 73.120.4.171 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.194.87.112
country_id: 6252001
description:
[2026-06-30 11:50:26 +0000] info [cpaneld] 68.194.87.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.237.229.234
country_id: 6252001
description:
[2026-06-30 11:50:33 +0000] info [cpaneld] 97.237.229.234 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-06-30 11:51:24 +0000] info [whostmgrd] 94.100.52.46 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.244.229
country_id: 3508796
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/yas-togo-avec-laccompagnement-de-la-fondation-axian-inaugure-un-nouveau-batiment-scolaire-au-lycee-pouda/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.235.64.166
country_id: 6252001
description:
[2026-06-30 11:51:01 +0000] info [cpaneld] 71.235.64.166 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.244.229
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/yas-togo-avec-laccompagnement-de-la-fondation-axian-inaugure-un-nouveau-batiment-scolaire-au-lycee-pouda/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - tchedye.d@inger.tg [06/30/2026:11:52:09 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: tchedye.d@inger.tg


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.240
country_id: 1880251
description:
43.173.180.240 - - [30/Jun/2026:11:52:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329445&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dedeposes&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782820333 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?tag=edeposes" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.240


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.106.232
country_id: 2363686
description:
[2026-06-30 11:54:48 +0000] info [cpaneld] 196.168.106.232 NEW prbthzuj:_eOW7_hyA6KLgAuC address=196.168.106.232,app=cpaneld,creator=prbthzuj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.106.232
country_id: 2363686
description:
[2026-06-30 11:54:45 +0000] info [cpaneld] 196.168.106.232 - prbthzuj "GET /cpsess0128485023/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.168.96.253] != Current IP Address [196.168.106.232]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 11:53:59 ns5 pure-ftpd[1747955]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 11:54:04 ns5 pure-ftpd[1747955]: (?@134.122.27.233) [WARNING] Authentication failed for user [waywcbyw]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/30/2026:11:57:48 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 11:57:36 +0000] info [cpaneld] 64.111.92.123 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-06-30 11:57:55 +0000] info [whostmgrd] 94.100.52.46 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 1.92.206.171
country_id: 1814991
description:
1.92.206.171 - - [30/Jun/2026:11:57:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789997&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fcategory%252Fecommerce%252Fshopify%252Fshopping&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782820653 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/category/ecommerce/shopify/shopping" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:1.92.206.171


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/30/2026:11:58:27 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.145.82
country_id: 3996063
description:
2026-06-30 11:58:32 dovecot_plain authenticator failed for H=fixed-187-189-145-82.totalplay.net (localhost) [187.189.145.82]:33130: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.9.39
country_id: 241170
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-58.31.134.9.39||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.243.90.63
country_id: 241170
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-59.77.243.90.63||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.40.195.62
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-59.31.40.195.62||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.245.241.120
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-59.104.245.241.120||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 11:59:49 +0000] info [cpaneld] 64.111.92.123 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-06-30 12:00:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:62933: 535 Incorrect authentication data (set_id=xpressions)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/30/2026:12:01:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.89.106
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.163.89.106||TA:193.163.89.106||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.233.252
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:66.146.233.252||TA:66.146.233.252||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-06-30 12:05:48 +0000] info [whostmgrd] 94.100.52.46 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 12:05:49 +0000] info [cpaneld] 167.99.236.81 - contactmairieaneho "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-30 12:11:55 +0000] info [cpaneld] 51.83.4.64 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 182.8.161.227
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.182.8.161.227||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.244.146
country_id: 248816
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/premiere-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.132.195.147
country_id: 2960313
description:
45.132.195.147 - - [30/Jun/2026:12:14:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341334&pdata=https%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782821666 HTTP/2.0" 302 0 matosshop.tg "https://matosshop.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.132.195.147


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.167
country_id: 1880251
description:
43.173.174.167 - - [30/Jun/2026:12:14:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881190&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Ddzogbegan&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782821671 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?tag=dzogbegan" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.167


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.161.121
country_id: 1562822
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2024/09/14/preliminaires-ldc-caf-asko-battu-par-djoliba-ac/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.5.69.76
country_id: 298795
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.126.12.109
country_id: 3437598
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.4.71
country_id: 1168579
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/plugins/text-to-audio/admin/js/build/text-to-audio-button.min.js?ver=1.5.15 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.232.199
country_id: 1168579
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/plugins/wp-statistics/assets/js/tracker.js?ver=6.4.8 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.174
country_id: 1512440
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.116.33
country_id: 3608932
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-includes/js/dist/hooks.min.js?ver=c6aec9a8d4e5a5d543a1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.254.62
country_id: 3469034
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/themes/jannah/assets/js/br-news.js?ver=5.4.9 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.231.133.137
country_id: 298795
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/themes/jannah/assets/js/scripts.min.js?ver=5.4.9 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.137.69.186
country_id: 1168579
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/plugins/audioigniter/player/build/app.js?ver=2.0.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.24.252.71
country_id: 99237
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.100.235.236
country_id: 1210997
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/themes/jannah/assets/js/single.min.js?ver=5.4.9 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.171.60.113
country_id: 831053
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-includes/js/wp-emoji-release.min.js?ver=6.4.8 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.141.19.10
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/billets-davion-en-afrique-le-togo-plaide-pour-une-fiscalite-allegee/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.141.19.10
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/billets-davion-en-afrique-le-togo-plaide-pour-une-fiscalite-allegee/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@case-afrique.tg [06/30/2026:12:21:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@case-afrique.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.93.111
country_id: 2635167
domain: www.wellcity.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/www.wellcity.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:22:30 +0000] info [cpaneld] 64.111.92.123 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.155.163
country_id: 2921044
description:
2026-06-30 12:23:36 dovecot_login authenticator failed for H=(104.28.163.92) [104.28.155.163]:40158: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.77
country_id: 3175395
description:
Jun 30 12:24:48 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.77 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.50
country_id: 1880251
description:
43.173.181.50 - - [30/Jun/2026:12:24:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053731&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14446&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782822287 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14446" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.189.151
country_id: 3017382
domain: snbrasserie.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbrasserie.snb.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.209.22
country_id: 130758
description:
2026-06-30 12:28:51 dovecot_plain authenticator failed for H=(b068w4dv2p9rz0sc2wfcc6g8n) [91.92.209.22]:43247: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.108.130.163
country_id: 1643084
description:
[2026-06-30 12:28:18 +0000] info [whostmgrd] 103.108.130.163 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID v827bn) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.108.130.163
country_id: 1643084
description:
[2026-06-30 12:28:23 +0000] info [whostmgrd] 103.108.130.163 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - support@cloud-et-racks.tg [06/30/2026:12:30:40 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: support@cloud-et-racks.tg


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.127.170
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:212.18.127.170||TA:212.18.127.170||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.120.167.1
country_id: 2921044
description:
172.120.167.1 - - [30/Jun/2026:12:30:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262381&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fslam%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782822633 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/slam/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.1952.1034 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.120.167.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:30:52 +0000] info [cpaneld] 64.111.92.123 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.108
country_id: 732800
description:
Jun 30 12:30:24 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.108 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.232.1.85
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.232.1.85: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.74.66
country_id: 2635167
description:
Jun 30 12:33:11 ns5 pure-ftpd[1769986]: (?@81.171.74.66) [WARNING] Authentication failed for user [contact@dany2.mairie.tg]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.252
country_id: 1880251
description:
43.172.196.252 - - [30/Jun/2026:12:40:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710427&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D10033&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782823210 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=10033" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.252


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 13.56.213.186
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 13.56.213.186: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:42:09 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.213.42
country_id: 2363686
description:
[2026-06-30 12:43:30 +0000] info [webmaild] 196.168.213.42 - info@case-afrique.tg "POST /cpsess3577694498/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.106.232] != Current IP Address [196.168.213.42]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:45:20 +0000] info [cpaneld] 64.111.92.123 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 12:46:51 +0000] info [cpaneld] 129.212.228.74 - netmast "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.13
country_id: 1880251
description:
43.173.182.13 - - [30/Jun/2026:12:46:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313819&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D4%2526page%253D5%2526paged%253D24&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782823574 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=4&page=5&paged=24" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-30 12:47:17 +0000] info [cpaneld] 157.66.56.214 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:47:30 +0000] info [cpaneld] 64.111.92.123 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.201.122.63
country_id: 1814991
description:
2026-06-30 12:50:55 dovecot_plain authenticator failed for H=(taqjmk0spc7basar) [111.201.122.63]:57836: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:51:15 +0000] info [cpaneld] 64.111.92.123 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 12:54:14 +0000] info [cpaneld] 64.111.92.123 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 200.71.126.136
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:200.71.126.136||TA:200.71.126.136||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.74.72.223
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-revolution-digitale-au-service-de-la-proximite/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.194.192.105
country_id: 6252001
description:
104.194.192.105 - - [30/Jun/2026:12:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529704&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252Fcategory%252Feconomie%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782824323 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/category/economie/page/2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.7118.1489 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.194.192.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 13:02:26 +0000] info [cpaneld] 167.99.236.81 - tqttxcvn "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 13:02:30 +0000] info [cpaneld] 20.212.169.175 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:03:13 +0000] info [cpaneld] 64.111.92.123 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [30/Jun/2026:13:03:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13213128&pdata=https%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782824585 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 105.21.66.86
country_id: 226074
description:
[2026-06-30 13:04:53 +0000] info [cpaneld] 105.21.66.86 NEW pnls:XpxwvjgQXwWXIKRV address=105.21.66.86,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:05:50 +0000] info [cpaneld] 64.111.92.123 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephanetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 13:09:24 +0000] info [cpaneld] 129.212.228.74 - lxsenjdd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/fMMx0quIlrc[/embed]||WPU:direct7tv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:10:55 +0000] info [cpaneld] 64.111.92.123 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.182
country_id: 6252001
description:
2026-06-30 13:10:22 dovecot_plain authenticator failed for H=(rtnwpyh4xcw4henati0) [23.129.64.182]:4887: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.146.194
country_id: 2363686
description:
[2026-06-30 13:11:46 +0000] info [webmaild] 196.168.146.194 - contact@ciieeinternational.org "POST /cpsess3502543039/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.110.173] != Current IP Address [196.168.146.194]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:13:42 +0000] info [cpaneld] 64.111.92.123 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.44.165
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.44.165: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.44.164
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.44.164: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.44.166
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.44.166: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:14:50 +0000] info [cpaneld] 64.111.92.123 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.208.129
country_id: 6252001
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.253.208.129||TA:104.253.208.129||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 179.61.166.107
country_id: 6252001
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:179.61.166.107||TA:179.61.166.107||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.114.59.200
country_id: 1269750
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.114.59.200||TA:103.114.59.200||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.121.107
country_id: 6252001
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.121.107||TA:152.232.121.107||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.230.240
country_id: 2802361
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.75.230.240||TA:103.75.230.240||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.157.29
country_id: 6252001
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.245.157.29||TA:172.245.157.29||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.37
country_id: 2635167
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.105.119.37||TA:198.105.119.37||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.144.92.213
country_id: 1831722
domain: emt.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51135.emt.tg||ServerName:emt.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07bd68d2682df83f93a0e98d4f40853d9e5a70a4||Title:0x4453abd7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.72.241.154
country_id: 3469034
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.72.241.154||TA:185.72.241.154||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 13:17:44 ns5 pure-ftpd[1792081]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 13:17:48 ns5 pure-ftpd[1792081]: (?@134.122.27.233) [WARNING] Authentication failed for user [ingertgsarl]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.139.59
country_id: 2363686
description:
[2026-06-30 13:18:06 +0000] info [webmaild] 41.78.139.59 - equipesmq@inger.tg "GET /cpsess9506430693/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.248.164
country_id: 2921044
description:
Jun 30 13:21:37 ns5 pure-ftpd[1794210]: (?@209.38.248.164) [INFO] New connection from 209.38.248.164


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.29
country_id: 1880251
description:
43.173.174.29 - - [30/Jun/2026:13:23:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10276041&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14769&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782825836 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14769" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.29


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.193.115
country_id: 2921044
description:
Jun 30 13:23:41 ns5 pure-ftpd[1795095]: (?@209.38.193.115) [INFO] New connection from 209.38.193.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [30/Jun/2026:13:24:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658449&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782825895 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.193.115
country_id: 2921044
description:
Jun 30 13:23:59 ns5 pure-ftpd[1795192]: (?@209.38.193.115) [INFO] New connection from 209.38.193.115


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 209.38.193.115
country_id: 2921044
description:
Jun 30 13:23:59 ns5 pure-ftpd[1795188]: (?@209.38.193.115) [INFO] New connection from 209.38.193.115


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.229.65.30
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.229.65.30) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.132.235
country_id: 587116
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-en-fete-amadahome-stout-porter HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 13:29:01 +0000] info [cpaneld] 167.99.236.81 - lxsenjdd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [30/Jun/2026:13:29:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015400&pdata=http%253A%252F%252Fwww.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782826181 HTTP/1.1" 302 0 www.kpmg.tg "http://www.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.48.188
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.253.48.188||TA:104.253.48.188||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.119.192
country_id: 798544
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.113.119.192||TA:92.113.119.192||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.236
country_id: 732800
description:
Jun 30 13:30:51 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.236
country_id: 732800
description:
2026-06-30 13:30:41 dovecot_login authenticator failed for H=(xfZPB7n) [195.178.110.236]:62905: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.224.227
country_id: 6252001
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:38.154.224.227||TA:38.154.224.227||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.185.120
country_id: 6252001
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:192.186.185.120||TA:192.186.185.120||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.50.200
country_id: 6252001
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.238.50.200||TA:104.238.50.200||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 13:32:54 +0000] info [cpaneld] 167.99.236.81 - lxsenjdd_farms "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.217.238
country_id: 2661886
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.217.238||TA:92.112.217.238||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [30/Jun/2026:13:33:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051107&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ftogo-pierre-koffi-alanda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782826406 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/togo-pierre-koffi-alanda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.17
country_id: 3175395
description:
Jun 30 13:34:06 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-30 13:34:18 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.90.63
country_id: 6252001
description:
2026-06-30 13:35:13 dovecot_login authenticator failed for H=(iZ0xi1dhkwkvg928tnolmgZ) [47.253.90.63]:56134: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.253.90.63
country_id: 6252001
description:
Jun 30 13:35:24 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.253.90.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.157.212
country_id: 690791
description:
Jun 30 13:36:47 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.157.212 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.222
country_id: 1880251
description:
43.173.174.222 - - [30/Jun/2026:13:36:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450282&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D3400&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782826562 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=3400" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.223
country_id: 3469034
description:
Jun 30 13:36:17 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.223 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.114
country_id: 1880251
description:
43.173.180.114 - - [30/Jun/2026:13:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541019&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D7749&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782826626 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=7749" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.188
country_id: 298795
description:
Jun 30 13:37:28 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.188 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.66
country_id: 1880251
description:
43.173.180.66 - - [30/Jun/2026:13:38:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001815&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dun-centre-de-lecture&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782826691 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?tag=un-centre-de-lecture" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.66


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.241.228
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.245.241.228||TA:104.245.241.228||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:42:24 +0000] info [cpaneld] 64.111.92.123 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.203
country_id: 1880251
description:
43.173.180.203 - - [30/Jun/2026:13:47:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391128&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12231&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782827240 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=12231" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.120.107.88
country_id: 660013
description:
[2026-06-30 13:47:30 +0000] info [cpaneld] 87.120.107.88 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 13:48:39 +0000] info [cpaneld] 64.111.92.123 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.120.107.88
country_id: 660013
description:
[2026-06-30 13:50:01 +0000] info [cpaneld] 87.120.107.88 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: lvdt.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [30/Jun/2026:13:51:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725793&pdata=https%253A%252F%252Flvdt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782827493 HTTP/2.0" 302 0 lvdt.tg "https://lvdt.tg/" "Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans le cadre du renforcement de la relation de confiance entre l\xe2\x80\x99administration fiscale et les partenaires \xc3\xa9conomiques, l\xe2\x80\x99office togolais des recettes (otr) poursuit sa dynamique de sensibilisation de proximit\xc3\xa9. apr\xc3\xa8s avoir parcouru le septentrion, les \xc3\xa9quipes de l\xe2\x80\x99otr ont officiellement entam\xc3\xa9, le lundi 29 juin 2026, l'\xc3\xa9tape tant attendue de la r\xc3\xa9gion des plateaux.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour les \xc3\xa9quipes de l\xe2\x80\x99otr, il s\xe2\x80\x99agit d\xe2\x80\x99instaurer un dialogue direct, transparent et sans tabous avec les contribuables togolais pour b\xc3\xa2tir une collaboration plus dynamique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31703,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/fisc-agou.jpg\" alt=\"\" class=\"wp-image-31703\"/><figcaption class=\"wp-element-caption\"><strong><em>une vue de l'assistane \xc3\xa0 l'\xc3\xa9tape d'agou</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour ce faire, c\xe2\x80\x99est la localit\xc3\xa9 d\xe2\x80\x99agou qui a servi de point de d\xc3\xa9part pour cette nouvelle \xc3\xa9tape de la tourn\xc3\xa9e de sensibilisation. cette rencontre de proximit\xc3\xa9 a mobilis\xc3\xa9 de nombreux citoyens, op\xc3\xa9rateurs \xc3\xa9conomiques et leaders locaux, venus \xc3\xa9changer directement avec les \xc3\xa9missaires de l\xe2\x80\x99administration fiscale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>loin des formalit\xc3\xa9s administratives, les discussions se sont d\xc3\xa9roul\xc3\xa9es dans un climat d'ouverture. les populations et les \xc3\xa9quipes de l'otr ont pu aborder de front les diff\xc3\xa9rentes pr\xc3\xa9occupations communes, qui impactent le quotidien des contribuables et le d\xc3\xa9veloppement \xc3\xa9conomique de la r\xc3\xa9gion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31704,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/fisc-kpalime.jpg\" alt=\"\" class=\"wp-image-31704\"/><figcaption class=\"wp-element-caption\"><strong><em>photo de famille, \xc3\xa9tape de kpalim\xc3\xa9</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour l'administration fiscale, cette tourn\xc3\xa9e est l'occasion de vulgariser les bonnes pratiques et de lever les zones d'ombre qui entourent parfois la collecte des taxes. plusieurs th\xc3\xa9matiques cl\xc3\xa9s ont \xc3\xa9t\xc3\xa9 au centre des d\xc3\xa9bats \xc3\xa0 agou, notamment le paiement du juste imp\xc3\xb4t (expliquer les m\xc3\xa9canismes de calcul pour que chaque contribuable paie ce qu'il doit, de mani\xc3\xa8re \xc3\xa9quitable, en fonction de ses facult\xc3\xa9s contributives), le civisme fiscal (le rappel de l'importance de la contribution de chacun dans le financement pour la r\xc3\xa9alisation des infrastructures publiques (routes, h\xc3\xb4pitaux, \xc3\xa9coles) et le d\xc3\xa9veloppement du togo), et la lutte contre la corruption (aborder sans d\xc3\xa9tour les actes de corruption et r\xc3\xa9it\xc3\xa9rer l'engagement de l'otr \xc3\xa0 promouvoir l'int\xc3\xa9grit\xc3\xa9, la transparence et des voies de recours claires pour les usagers).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab tout ce qu'il faut pour instaurer une relation de confiance mutuelle a \xc3\xa9t\xc3\xa9 mis sur la table \xc2\xbb</em>, ont r\xc3\xa9sum\xc3\xa9 les participants, saluant une d\xc3\xa9marche qui humanise les rapports entre le fisc et les citoyens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que cette campagne de sensibilisation se poursuit \xc3\xa0 travers d'autres pr\xc3\xa9fectures et localit\xc3\xa9s de la r\xc3\xa9gion des plateaux, notamment kpalim\xc3\xa9, kp\xc3\xa9l\xc3\xa9, danyi, .... \xc3\x80 travers ces rencontres, l'otr r\xc3\xa9affirme sa volont\xc3\xa9 de passer d'une administration de contr\xc3\xb4le \xc3\xa0 une administration de service et d'accompagnement pour tous les contribuables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31705,\"width\":\"500px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/fisc-kpele.jpg\" alt=\"\" class=\"wp-image-31705\" style=\"width:500px;height:auto\"/><figcaption class=\"wp-element-caption\"><em><strong>l'assistance, \xc3\xa9tape de kp\xc3\xa9l\xc3\xa9</strong></em></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour accompagner les contribuables, les deux num\xc3\xa9ros verts de l'otr ont \xc3\xa9t\xc3\xa9 rappel\xc3\xa9s. le 8280 pour d\xc3\xa9noncer les actes de corruption et le 8201 pour les renseignements.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-30 13:55:49 +0000] info [webmaild] 196.168.0.186 - kawunyo@wages.tg "POST /cpsess7859496274/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans le cadre du renforcement de la relation de confiance entre l\xe2\x80\x99administration fiscale et les partenaires \xc3\xa9conomiques, l\xe2\x80\x99office togolais des recettes (otr) poursuit sa dynamique de sensibilisation de proximit\xc3\xa9. apr\xc3\xa8s avoir parcouru le septentrion, les \xc3\xa9quipes de l\xe2\x80\x99otr ont officiellement entam\xc3\xa9, le lundi 29 juin 2026, l'\xc3\xa9tape tant attendue de la r\xc3\xa9gion des plateaux.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour les \xc3\xa9quipes de l\xe2\x80\x99otr, il s\xe2\x80\x99agit d\xe2\x80\x99instaurer un dialogue direct, transparent et sans tabous avec les contribuables togolais pour b\xc3\xa2tir une collaboration plus dynamique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31703,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/fisc-agou.jpg\" alt=\"\" class=\"wp-image-31703\"/><figcaption class=\"wp-element-caption\"><strong><em>une vue de l'assistane \xc3\xa0 l'\xc3\xa9tape d'agou</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour ce faire, c\xe2\x80\x99est la localit\xc3\xa9 d\xe2\x80\x99agou qui a servi de point de d\xc3\xa9part pour cette nouvelle \xc3\xa9tape de la tourn\xc3\xa9e de sensibilisation. cette rencontre de proximit\xc3\xa9 a mobilis\xc3\xa9 de nombreux citoyens, op\xc3\xa9rateurs \xc3\xa9conomiques et leaders locaux, venus \xc3\xa9changer directement avec les \xc3\xa9missaires de l\xe2\x80\x99administration fiscale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>loin des formalit\xc3\xa9s administratives, les discussions se sont d\xc3\xa9roul\xc3\xa9es dans un climat d'ouverture. les populations et les \xc3\xa9quipes de l'otr ont pu aborder de front les diff\xc3\xa9rentes pr\xc3\xa9occupations communes, qui impactent le quotidien des contribuables et le d\xc3\xa9veloppement \xc3\xa9conomique de la r\xc3\xa9gion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour l'administration fiscale, cette tourn\xc3\xa9e est l'occasion de vulgariser les bonnes pratiques et de lever les zones d'ombre qui entourent parfois la collecte des taxes. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31704,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/fisc-kpalime.jpg\" alt=\"\" class=\"wp-image-31704\"/><figcaption class=\"wp-element-caption\"><strong><em>photo de famille, \xc3\xa9tape de kpalim\xc3\xa9</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>plusieurs th\xc3\xa9matiques cl\xc3\xa9s ont \xc3\xa9t\xc3\xa9 au centre des d\xc3\xa9bats \xc3\xa0 agou, notamment le paiement du juste imp\xc3\xb4t (expliquer les m\xc3\xa9canismes de calcul pour que chaque contribuable paie ce qu'il doit, de mani\xc3\xa8re \xc3\xa9quitable, en fonction de ses facult\xc3\xa9s contributives), le civisme fiscal (le rappel de l'importance de la contribution de chacun dans le financement pour la r\xc3\xa9alisation des infrastructures publiques (routes, h\xc3\xb4pitaux, \xc3\xa9coles) et le d\xc3\xa9veloppement du togo), et la lutte contre la corruption (aborder sans d\xc3\xa9tour les actes de corruption et r\xc3\xa9it\xc3\xa9rer l'engagement de l'otr \xc3\xa0 promouvoir l'int\xc3\xa9grit\xc3\xa9, la transparence et des voies de recours claires pour les usagers).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab tout ce qu'il faut pour instaurer une relation de confiance mutuelle a \xc3\xa9t\xc3\xa9 mis sur la table \xc2\xbb</em>, ont r\xc3\xa9sum\xc3\xa9 les participants, saluant une d\xc3\xa9marche qui humanise les rapports entre le fisc et les citoyens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que cette campagne de sensibilisation se poursuit \xc3\xa0 travers d'autres pr\xc3\xa9fectures et localit\xc3\xa9s de la r\xc3\xa9gion des plateaux, notamment kpalim\xc3\xa9, kp\xc3\xa9l\xc3\xa9, danyi, .... \xc3\x80 travers ces rencontres, l'otr r\xc3\xa9affirme sa volont\xc3\xa9 de passer d'une administration de contr\xc3\xb4le \xc3\xa0 une administration de service et d'accompagnement pour tous les contribuables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31705,\"width\":\"500px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/fisc-kpele.jpg\" alt=\"\" class=\"wp-image-31705\" style=\"width:500px;height:auto\"/><figcaption class=\"wp-element-caption\"><em><strong>l'assistance, \xc3\xa9tape de kp\xc3\xa9l\xc3\xa9</strong></em></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour accompagner les contribuables, les deux num\xc3\xa9ros verts de l'otr ont \xc3\xa9t\xc3\xa9 rappel\xc3\xa9s. le 8280 pour d\xc3\xa9noncer les actes de corruption et le 8201 pour les renseignements.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 13:57:09 +0000] info [cpaneld] 167.99.236.81 - yvwaocrr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.101.64.6
country_id: 2017370
description:
5.101.64.6 - - [30/Jun/2026:14:00:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246790&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782828036 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.101.64.6


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.131.133.15
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-300x160.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.166.131
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/rencontre-trimestrielle-societe-nouvelle-de-boissons-et-partenaires HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-30 14:03:39 +0000] info [cpaneld] 157.66.56.39 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 14:04:49 +0000] info [webmaild] 102.176.253.226 - essozimna.kpizim@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 14:04:17 +0000] info [cpaneld] 167.99.236.81 - myxlsnta "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.64
country_id: 1880251
description:
43.173.179.64 - - [30/Jun/2026:14:05:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039601&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D8422&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782828334 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=8422" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.196
country_id: 3469034
description:
Jun 30 14:05:40 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 14:05:14 +0000] info [webmaild] 102.176.253.226 - essozimna.kpizim@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.113.119.100
country_id: 2921044
domain: www.ca-togo.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.113.119.100||TA:194.113.119.100||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.146.4.39
country_id: 6252001
description:
16.146.4.39 - - [30/Jun/2026:14:06:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183062&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782828414 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.146.4.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 14:07:21 +0000] info [webmaild] 102.176.253.226 - essozimna.kpizim@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 14:08:06 +0000] info [webmaild] 102.176.253.226 - essozimna.kpizim@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.120.107.88
country_id: 660013
description:
87.120.107.88 - - [30/Jun/2026:14:08:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802584&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782828488 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.120.107.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.120.107.88
country_id: 660013
description:
[2026-06-30 14:08:12 +0000] info [cpaneld] 87.120.107.88 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f849710a7f9816297d394a6fc0ab9e689ca44bb||Title:h10lhv68gq89s9fdf||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.216
country_id: 2395170
description:
41.79.219.216 - - [30/Jun/2026:14:09:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396779&pdata=https%253A%252F%252Fvitrinenews.tg%252F2022%252F05%252F31%252Ftogo-journee-mondiale-de-levangelisation-acge-repand-levangile-autrement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782828544 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2022/05/31/togo-journee-mondiale-de-levangelisation-acge-repand-levangile-autrement/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.2 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.216


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:480795fc0b0d4eb1d7e4cd312a350a42f48d1ddd||Title:pjohrnmth9edk28a28||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.224.20
country_id: 660013
description:
Jun 30 14:10:54 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.224.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8ffd6716afc43e8c0791e37f8bc641e380bf909||Title:wa3fmaz9f1wig6b20||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.224.20
country_id: 660013
description:
Jun 30 14:11:00 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.224.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2be935bac9a5013f7f3d62b3f1a0171e18284345||Title:n9uni8kod0s7hzq8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:470349ea2ab704af8f499d555b2eca4153a9e764||Title:4uuwkcgvdrucr5sk05||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 184.75.208.106
country_id: 6251999
domain: ciieeinternational.org
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-13.184.75.208.106||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e7c4771be83ad280f844b572971c8036aa6f7dc||Title:y99jm5ti2uvtj5jo3a||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.114.59.250
country_id: 1269750
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.114.59.250||TA:103.114.59.250||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 14:14:06 +0000] info [cpaneld] 20.212.169.175 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acb643459d97792964f079555810428f4b2b9cb2||Title:5ifpz9nuxxbojx||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.69
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.252.196.69||TA:104.252.196.69||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 14:15:35 +0000] info [cpaneld] 64.111.92.123 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:15:57 ns5 pure-ftpd[1820674]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.29
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:161.123.130.29||TA:161.123.130.29||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:16:02 ns5 pure-ftpd[1820676]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:953e2ac8bfaf3de123dbbae70c431e5a7a1706e7||Title:s5vfbp53fat23me295||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:16:17 ns5 pure-ftpd[1820853]: (?@134.122.27.233) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 14:17:41 +0000] info [cpaneld] 64.111.92.123 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ba98f7c8a384ba56032d28a1bba09d9a14e5d6d||Title:3uoklppiq93bqv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.183
country_id: 1880251
description:
43.173.179.183 - - [30/Jun/2026:14:17:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118345&pdata=https%253A%252F%252F24heureinfo.tg%252Fsante%252Fa-lome-loms-arme-les-etats-a-operationnaliser-les-comptes-nationaux-des-personnels-de-sante%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782829017 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/sante/a-lome-loms-arme-les-etats-a-operationnaliser-les-comptes-nationaux-des-personnels-de-sante/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.183


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:446d1b9ad2606fbf2358b0c14894e13208187cd8||Title:jxga6rt0vqnfky7f||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.157
country_id: 798544
description:
Jun 30 14:18:57 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.87
country_id: 3469034
description:
Jun 30 14:19:22 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.157
country_id: 798544
description:
Jun 30 14:19:03 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:60561bc046b788603367a723f98c3bdebfca96c2||Title:i5io2cznew9l1ovx||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f83835d3258e2c68b364ca706a90acce0db1055||Title:kzflzzhmp3otuvyd3||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce5c44007d6dbff32c69fc6421dbffc68562e76d||Title:v7m8aonxahpuz0v54||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a439d22fbf2f19b75213b9da81b1ff23a03b579||Title:oiw2oo8i8s7gub||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea1c1f55157d1d34b33f39bf945f6f9a566d979b||Title:lz4zz9p5vaz2136di1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:67b2066d7beff126670bde9a3d47aeb33580dbf7||Title:3wyj1fa2m8cl55ih||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 14:24:39 +0000] info [cpaneld] 64.111.92.123 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:91b74f7a216b5181db632f6ec59bb943f829d3fc||Title:9o3a7gbh1rnch75k||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.224.90.145
country_id: 6252001
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.224.90.145||TA:104.224.90.145||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:313d8554067f340fb039edf11fcd734c4d82c412||Title:7ymypmqyp8qqph44h||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:04013820165da5c456335d5757e41d95ca3b53b8||Title:bvfsre25ior3pk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.248.138.233
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/zlecaf-le-cnp-togo-presente-les-opportunites-aux-femmes/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee334d329b1aeea83516fd924632ff7a363cecf9||Title:htsu8v0xmg8gjmg7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.248.138.233
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/zlecaf-le-cnp-togo-presente-les-opportunites-aux-femmes/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08d95f8f1ec13cd396f2d5a5fc4fa80d0f6efc00||Title:z0ozknu2wsllo2r2v||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 14:28:59 +0000] info [cpaneld] 168.144.35.224 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 14:30:34 +0000] info [webmaild] 102.176.253.226 - essozimna.kpizim@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.134.218.186
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:085f52cb61c088178e84f49dde1727ab61ca3acc||Title:mdtkbobbnwh92f9||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.195
country_id: 6252001
description:
[2026-06-30 14:32:55 +0000] info [cpaneld] 217.181.76.195 - yydrdvav "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.232.89.149
country_id: 3469034
description:
45.232.89.149 - - [30/Jun/2026:14:34:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858709&pdata=https%253A%252F%252Fcfpj.tg%252Fyedk-214315letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830048 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/yedk-214315letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.232.89.149


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:34:44 ns5 pure-ftpd[1831229]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:34:48 ns5 pure-ftpd[1831229]: (?@134.122.27.233) [WARNING] Authentication failed for user [e.carine]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.66.178
country_id: 6252001
description:
[2026-06-30 14:35:24 +0000] info [cpaneld] 217.181.66.178 - fgbegmfv "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 14:35:41 +0000] info [cpaneld] 129.212.228.74 - admin@togocarrierebetons.com "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.118
country_id: 1880251
description:
43.173.179.118 - - [30/Jun/2026:14:36:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263145&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D5046&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830169 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=5046" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.118


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 87.120.107.88
country_id: 660013
description:
87.120.107.88 - - [30/Jun/2026:14:37:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134485&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830232 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.120.107.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-30 14:38:27 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38540: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [30/Jun/2026:14:41:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7521433&pdata=https%253A%252F%252F154.70.82.244&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830489 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 87.120.107.88
country_id: 660013
description:
87.120.107.88 - - [30/Jun/2026:14:43:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657890&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830620 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.120.107.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.45
country_id: 3996063
description:
Jun 30 14:43:52 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.45
country_id: 3996063
description:
Jun 30 14:43:58 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.227.255
country_id: 6252001
domain: bieredjama.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bieredjama.snb.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.207.72
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.163.207.72||TA:193.163.207.72||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.203
country_id: 1880251
description:
43.173.180.203 - - [30/Jun/2026:14:46:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473668&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D3%2526page%253D105%2526paged%253D111&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830779 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=3&page=105&paged=111" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [30/Jun/2026:14:49:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870186&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fheidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782830949 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.252.209.158
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-51.192.252.209.158||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.123.84
country_id: 2802361
description:
[2026-06-30 14:54:17 +0000] info [webmaild] 146.70.123.84 - supports@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [30/Jun/2026:14:55:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867053&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782831335 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 14:55:41 +0000] info [cpaneld] 52.200.114.158 - nwvfmxat "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 14:55:45 +0000] info [webmaild] 102.176.253.226 - essozimna.kpizim@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.5
country_id: 1880251
description:
43.172.197.5 - - [30/Jun/2026:14:57:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7431008&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D4%2526page%253D15%2526paged%253D22&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782831459 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=4&page=15&paged=22" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.5


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:58:56 ns5 pure-ftpd[1842484]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:59:00 ns5 pure-ftpd[1842484]: (?@134.122.27.233) [WARNING] Authentication failed for user [netmast]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 14:59:05 ns5 pure-ftpd[1842483]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.46
country_id: 1880251
description:
43.172.198.46 - - [30/Jun/2026:15:00:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803462&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D9758&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782831636 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=9758" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.46


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.48.247
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.48.247: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.60
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.60: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.169
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.169: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.55
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.55: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.247
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.247: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.125
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.125: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.3
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.3: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.42
country_id: 298795
description:
Jun 30 15:05:58 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.42
country_id: 298795
description:
Jun 30 15:06:05 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-06-30 15:08:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:56588: 535 Incorrect authentication data (set_id=srs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:08:36 +0000] info [cpaneld] 64.111.92.123 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 15:10:20 ns5 pure-ftpd[1848413]: (?@134.122.27.233) [WARNING] Authentication failed for user [ingertgsarl]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 15:10:14 ns5 pure-ftpd[1848413]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.62.78
country_id: 2363686
description:
[2026-06-30 15:13:03 +0000] info [cpaneld] 196.170.62.78 NEW qnlprotv:rorjIolaPsGPUvQS address=196.170.62.78,app=cpaneld,creator=qnlprotv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.78.52.11
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/02da41c0223ab76d2a8745bc81de29d6_L.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.20.138.29
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/e7d681ddc0174087ad0e36dc718519dd_L.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.47.102
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/083c72246e597ff0d8ee28e5789b018e_L-300x176.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 89.104.170.201
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 89.104.170.201: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.76.198.159
country_id: 798549
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/images-16.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-06-30 15:14:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:23477: 535 Incorrect authentication data (set_id=sapporo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:15:41 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 15:16:52 +0000] info [cpaneld] 167.99.236.81 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.81
country_id: 2395170
description:
41.79.219.81 - - [30/Jun/2026:15:17:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998425&pdata=https%253A%252F%252Fleadelles.tg%252Findex.php%252F2026%252F06%252F29%252Flutte-contre-les-dechets-plastiques-sonzi-passe-a-laction-avec-le-projet-marche-vert%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782832649 HTTP/2.0" 302 0 leadelles.tg "https://leadelles.tg/index.php/2026/06/29/lutte-contre-les-dechets-plastiques-sonzi-passe-a-laction-avec-le-projet-marche-vert/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.81


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - qnlprotv [06/30/2026:15:19:20 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: qnlprotv


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.86.1.240
country_id: 3895114
description:
200.86.1.240 - - [30/Jun/2026:15:19:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989482&pdata=https%253A%252F%252Fwebmail.inh.free.netmaster.tg%252Fresetpass%253Fstart%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782832739 HTTP/2.0" 302 0 webmail.inh.free.netmaster.tg "https://webmail.inh.free.netmaster.tg/resetpass?start=1" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.86.1.240


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 172.103.80.13
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 172.103.80.13: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.223
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:161.123.130.223||TA:161.123.130.223||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:21:44 +0000] info [cpaneld] 64.111.92.123 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.197
country_id: 6252001
description:
Jun 30 15:22:55 ns5 pure-ftpd[1855296]: (?@205.210.31.197) [INFO] New connection from 205.210.31.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-06-30 15:24:43 +0000] info [cpaneld] 103.65.237.55 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-06-30 15:25:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:53784: 535 Incorrect authentication data (set_id=win16)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.56.48.24
country_id: 2750405
description:
212.56.48.24 - - [30/Jun/2026:15:26:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289321&pdata=https%253A%252F%252Flesnidsurbains.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782833169 HTTP/2.0" 302 0 lesnidsurbains.tg "https://lesnidsurbains.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.56.48.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 15:26:21 +0000] info [cpaneld] 168.144.35.224 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:27:11 +0000] info [cpaneld] 64.111.92.123 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 15:27:48 +0000] info [cpaneld] 62.146.238.204 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-06-30 15:28:12 +0000] info [cpaneld] 103.65.237.55 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.232
country_id: 1880251
description:
43.172.198.232 - - [30/Jun/2026:15:28:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735255&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D4192&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782833290 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=4192" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.232


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 15:28:39 +0000] info [whostmgrd] 62.146.238.204 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 15:31:09 +0000] info [whostmgrd] 62.146.238.204 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:32:41 +0000] info [cpaneld] 64.111.92.123 - admin@admin.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 15:33:12 +0000] info [whostmgrd] 62.146.238.204 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.231
country_id: 690791
description:
Jun 30 15:33:10 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.149
country_id: 3865483
description:
Jun 30 15:35:58 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.60.43
country_id: 798544
description:
Jun 30 15:35:55 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.60.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.64.250.49
country_id: 690791
description:
Jun 30 15:36:30 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.64.250.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.60.43
country_id: 798544
description:
Jun 30 15:36:01 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.60.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.149
country_id: 3865483
description:
Jun 30 15:36:05 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-30 15:37:05 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:57802: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 15:37:39 +0000] info [cpaneld] 167.99.236.81 - pduusmyf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 15:37:53 +0000] info [cpaneld] 62.146.238.204 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:37:52 +0000] info [cpaneld] 64.111.92.123 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:39:54 +0000] info [cpaneld] 64.111.92.123 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:41:42 +0000] info [cpaneld] 64.111.92.123 - waotherapy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user waotherapy.com (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.82.200.62
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2333||QS:add-to-cart=2333||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.170
country_id: 6252001
domain: sinalco.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sinalco.snb.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2026-06-30 15:43:30 dovecot_plain authenticator failed for H=(wrerrule) [185.120.142.233]:50911: 535 Incorrect authentication data (set_id=admin@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 15:44:53 +0000] info [cpaneld] 62.146.238.204 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.34.103.97
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1293700327 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.224.131.141
country_id: 2802361
description:
Denial of Service (DoS) attack was discovered from 212.224.131.141: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.224.131.129
country_id: 2802361
description:
Denial of Service (DoS) attack was discovered from 212.224.131.129: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.203.99
country_id: 783754
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/galerie HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.223
country_id: 3469034
description:
Jun 30 15:47:02 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.223 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.194.206
country_id: 1880251
description:
43.172.194.206 - - [30/Jun/2026:15:49:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592708&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D14269&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782834568 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=14269" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.194.206


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 15:49:34 ns5 pure-ftpd[1870264]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 15:49:39 ns5 pure-ftpd[1870264]: (?@134.122.27.233) [WARNING] Authentication failed for user [e.carine]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 15:54:04 ns5 pure-ftpd[1872330]: (?@134.122.27.233) [WARNING] Authentication failed for user [e.sanvee]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 15:53:59 ns5 pure-ftpd[1872330]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.141.128.212
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.141.128.212||TA:45.141.128.212||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [30/Jun/2026:15:56:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987368&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782834981 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [30/Jun/2026:15:56:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919793&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782834981 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [30/Jun/2026:15:56:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946266&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782834981 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [30/Jun/2026:15:56:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856966&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782834981 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.144.191.183
country_id: 6252001
description:
[2026-06-30 15:56:02 +0000] info [whostmgrd] 24.144.191.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 15:57:07 +0000] info [cpaneld] 167.99.236.81 - index.html "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user index.html (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.103.179
country_id: 953987
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/www.sunu-group.com HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77142104
name: IM360 WAF: Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation
abuser: 80.248.64.198
country_id: 2363686
domain: misstogo.tg
description:
IM360 WAF: Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation||RSV:8.21||T:APACHE||MVN:ARGS:actions||MV:{\"enable_safe_mode\":{\"action\":\"enable_safe_mode\",\"data\":{\"editor_post_id\":\"16\"}}}||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 15:58:40 +0000] info [cpaneld] 64.111.92.123 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.47.78.116
country_id: 163843
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/actualite/detail/seminaire-du-8-mai-2025-le-cat-accompagne-la-mise-en-oeuvre-de-la-nouvelle-convention-collective HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 15:59:21 +0000] info [cpaneld] 80.248.64.198 NEW tgmisefred:ntyRyaWBmk_sMaSx address=80.248.64.198,app=cpaneld,creator=tgmisefred,method=handle_form_login,path=loadsession:tgmisefred:snecsF4ycEUXUr9k,possessed=1,possessor=root


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.226.175
country_id: 3437598
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 15:59:20 +0000] info [whostmgrd] 80.248.64.198 NEW tgmisefred:snecsF4ycEUXUr9k address=80.248.64.198,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.10
country_id: 1643084
description:
[2026-06-30 16:01:28 +0000] info [whostmgrd] 172.111.157.10 - stephanetg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.8.229
country_id: 6252001
description:
[2026-06-30 16:01:32 +0000] info [cpaneld] 45.147.8.229 - christian88ballo@gmail.com "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.93.159
country_id: 2245662
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/les-prix-des-produits-snb-restent-inchanges HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.56.66.228
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 45.56.66.228: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.10
country_id: 1643084
description:
[2026-06-30 16:03:10 +0000] info [whostmgrd] 172.111.157.10 - test1 "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.47.71
country_id: 3017382
domain: hofbrau.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/hofbrau.snb.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:11:33 +0000] info [cpaneld] 64.111.92.123 - su_docteur "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user su_docteur (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.252.171
country_id: 2750405
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.101.252.171||TA:185.101.252.171||


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/FdhegjcmYMY[/embed]||WPU:direct7tv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.102
country_id: 1880251
description:
43.173.181.102 - - [30/Jun/2026:16:22:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988759&pdata=https%253A%252F%252Fruralinfos.tg%252Fle-reseau-de-pastoralisme-rbm-recrute-un-responsable-charge-de-leducation-et-de-la-formation%252F%253Fshare%253Dtwitter&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782836531 HTTP/1.1" 404 561 ruralinfos.tg "https://ruralinfos.tg/le-reseau-de-pastoralisme-rbm-recrute-un-responsable-charge-de-leducation-et-de-la-formation/?share=twitter" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:23:58 +0000] info [cpaneld] 64.111.92.123 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.170.51
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:140.235.170.51||TA:140.235.170.51||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:28:40 +0000] info [cpaneld] 64.111.92.123 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.30
country_id: 1880251
description:
43.172.197.30 - - [30/Jun/2026:16:29:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185109&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D11496&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782836960 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=11496" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.30


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.225
country_id: 1880251
description:
43.173.181.225 - - [30/Jun/2026:16:30:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001000&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D1171&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782837025 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=1171" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.225


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 16:30:00 +0000] info [cpaneld] 167.99.236.81 - nanafmtg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nanafmtg (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.129.149
country_id: 2363686
description:
[2026-06-30 16:31:05 +0000] info [webmaild] 196.168.129.149 - guillaume.saguintaah@togointerim.net "GET /cpsess7140676292/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Drafts HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.204.4] != Current IP Address [196.168.129.149]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-30 16:33:38 +0000] info [webmaild] 196.171.46.177 - richard.attiogbe@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 16:34:02 +0000] info [cpaneld] 167.99.236.81 - primuscourtiertg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:34:12 +0000] info [cpaneld] 64.111.92.123 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.207.159
country_id: 1880251
domain: hofbraeu.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:34.143.207.159||TA:34.143.207.159||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 64.177.117.102
country_id: 6252001
description:
64.177.117.102 - - [30/Jun/2026:16:39:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260273&pdata=https%253A%252F%252Fpnls.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782837548 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:64.177.117.102


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.226.242
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.143.226.242||TA:104.143.226.242||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.54.32.165
country_id: 6252001
description:
[2026-06-30 16:43:18 +0000] info [whostmgrd] 173.54.32.165 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.148.25
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:148.135.148.25||TA:148.135.148.25||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.160.152
country_id: 2510769
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:109.196.160.152||TA:109.196.160.152||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:44:51 +0000] info [cpaneld] 64.111.92.123 - Masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Masfloy (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.226
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:202.155.186.226||TA:202.155.186.226||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.126.181
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.111.126.181||TA:142.111.126.181||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.191.73
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:209.127.191.73||TA:209.127.191.73||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.204.197
country_id: 3190538
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:209.242.204.197||TA:209.242.204.197||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.239.219.43
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:173.239.219.43||TA:173.239.219.43||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.105.39
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.239.105.39||TA:104.239.105.39||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 179.61.166.226
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:179.61.166.226||TA:179.61.166.226||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.206.124.234
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:206.206.124.234||TA:206.206.124.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.115.118
country_id: 597427
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.187.115.118||TA:193.187.115.118||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:46:56 +0000] info [cpaneld] 64.111.92.123 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.40.121.134
country_id: 1861060
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:195.40.121.134||TA:195.40.121.134||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.116.22.20
country_id: 2921044
description:
176.116.22.20 - - [30/Jun/2026:16:47:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842009&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1164&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782838051 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1164" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.7372.1294 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.116.22.20


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.182
country_id: 1880251
description:
43.173.177.182 - - [30/Jun/2026:16:47:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737062&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D8867&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782838061 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=8867" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.43.133.101
country_id: 719819
description:
89.43.133.101 - - [30/Jun/2026:16:48:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13131880&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782838086 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.43.133.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:49:30 +0000] info [cpaneld] 64.111.92.123 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.254.195
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:191.96.254.195||TA:191.96.254.195||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-30 16:50:52 +0000] info [webmaild] 196.171.46.177 - olga.foly@togointerim.net "GET /cpsess9696520669/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.154.50
country_id: 2635167
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:107.181.154.50||TA:107.181.154.50||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 16:51:41 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.181
country_id: 2510769
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.143.245.181||TA:104.143.245.181||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:52:08 +0000] info [cpaneld] 64.111.92.123 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:53:51 +0000] info [cpaneld] 64.111.92.123 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.56
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.147.132.56||TA:142.147.132.56||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 16:56:04 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:16:57:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882261&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782838665 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.31.3.126
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-57.64.31.3.126||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.4.76.225
country_id: 1643084
description:
[2026-06-30 16:57:25 +0000] info [cpaneld] 103.4.76.225 - - "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.204.155.206
country_id: 290557
domain: togomedia24.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tghttp/togomedia24.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.169.225
country_id: 6252001
description:
[2026-06-30 16:58:53 +0000] info [cpaneld] 140.235.169.225 - 2083 "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.145.248.1
country_id: 6252001
description:
16.145.248.1 - - [30/Jun/2026:16:58:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197706&pdata=https%253A%252F%252Fmisstogo.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782838733 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.145.248.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.4.76.225
country_id: 1643084
description:
[2026-06-30 16:58:01 +0000] info [cpaneld] 103.4.76.225 - - "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 103.4.76.225
country_id: 1643084
description:
[2026-06-30 16:58:06 +0000] info [cpaneld] 103.4.76.225 - - "GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.204.155.206
country_id: 290557
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 16:59:16 +0000] info [cpaneld] 167.99.236.81 - pduusmyf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.152.21
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Kft59.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:01:50 ns5 kernel: php-fpm[1907515]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:01:26 +0000] info [cpaneld] 64.111.92.123 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:02:36 ns5 kernel: php-fpm[1907679]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.254.245
country_id: 2562770
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.202.254.245||TA:142.202.254.245||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.218.134
country_id: 2077456
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:46.203.218.134||TA:46.203.218.134||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.142.37.205
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.142.37.205||TA:193.142.37.205||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:03:34 ns5 kernel: php-fpm[1907894]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.104.160
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.239.104.160||TA:104.239.104.160||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 17:03:53 +0000] info [cpaneld] 168.144.35.224 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.107.199
country_id: 2363686
description:
[2026-06-30 17:04:04 +0000] info [webmaild] 196.168.107.199 - tchedye.d@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.194.184
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:89.249.194.184||TA:89.249.194.184||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - tchedye.d@inger.tg [06/30/2026:17:05:32 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: tchedye.d@inger.tg


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.205.58
country_id: 3469034
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:108.165.205.58||TA:108.165.205.58||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.235.125
country_id: 3077311
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.235.125||TA:92.112.235.125||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:07:35 ns5 kernel: php-fpm[1909581]: segfault at 7ffebee9ebf8 ip 000000000072ad55 sp 00007ffebee9ebf8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:07:31 +0000] info [cpaneld] 64.111.92.123 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:08:12 ns5 kernel: php-fpm[1909979]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-30 17:08:42 +0000] info [cpaneld] 51.83.4.64 - iyfttuec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Jun 30 17:08:17 ns5 pure-ftpd[1914268]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.122.205
country_id: 2635167
domain: www.test.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.105.122.205||TA:198.105.122.205||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d78fd99d31d1a8429a735cd351574d2d5d86e9c3||Title:qwulywo9t8boq8||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:10:12 ns5 kernel: php-fpm[1910425]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8cd31e1c90fb1d2437dea50b94ea5a7b6e1ce912||Title:rp3az4fyjmasuz0k||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.234.187.60
country_id: 2510769
description:
Jun 30 17:10:21 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.234.187.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:070b0d4b4f3eb7a36f8d91ed9b2311a3db453175||Title:r6bl27xja8pydfvw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.73.249.199
country_id: 357994
domain: test.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.73.249.199||TA:154.73.249.199||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b7a4b3a8861705eaaea604e0dbb22162935296af||Title:6chdj1ktxb41gms3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 17:12:19 +0000] info [cpaneld] 167.99.236.81 - zeeaxbnt "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeeaxbnt (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.163.189
country_id: 2510769
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:109.196.163.189||TA:109.196.163.189||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [30/Jun/2026:17:13:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923682&pdata=https%253A%252F%252Fhealthcarenavigatorsllc.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782839583 HTTP/2.0" 302 0 healthcarenavigatorsllc.net "https://healthcarenavigatorsllc.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e9c2482c6cf6bd5b68ab5c969c1cb1b4c064209f||Title:j4yc4eadmhog0km||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 17:13:11 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [30/Jun/2026:17:13:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579304&pdata=http%253A%252F%252Fhealthcarenavigatorsllc.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782839581 HTTP/1.1" 302 0 healthcarenavigatorsllc.net "http://healthcarenavigatorsllc.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.193.170
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:38.154.193.170||TA:38.154.193.170||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:14:14 ns5 kernel: php-fpm[1914236]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 17:14:30 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bcab8d20b70aba399445a28d2dd2e6c65e558046||Title:i8j4ccckmhtybkn4b||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 17:15:10 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba72403a0718b4773fae73b78824a9cb9cf3e612||Title:scf0mnmysyub4s1cpe||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:16:15 ns5 kernel: php-fpm[1915242]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a8b8cb78e609c78e085a35346aea13a9c653e989||Title:se8r1cijkuad4jkxkp||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 17:16:26 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3d344612883027e9eb1327214e0a39d6ba0a4f07||Title:ioznjfgsu9gblqw||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.239.197.68
country_id: 2403846
description:
2026-06-30 17:17:23 dovecot_login authenticator failed for H=(ADMIN) [169.239.197.68]:57599: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2913372e34f75e86d11d65e9fff0e5345fd9ea44||Title:rl0p5vggjc9r429w4||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.106.185.169
country_id: 3175395
description:
190.106.185.169 - - [30/Jun/2026:17:18:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276055&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F04%252F25%252Fconcours-miabe-djena-la-3%2525E1%2525B5%252589-edition-officiellement-lancee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782839900 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/04/25/concours-miabe-djena-la-3%E1%B5%89-edition-officiellement-lancee/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.8571.1479 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.106.185.169


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9bb3cf6412cc54f1dd3a076fd17f9819bed650b8||Title:be0j3isftsggfmlmv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.184.30.74
country_id: 6252001
description:
[2026-06-30 17:20:52 +0000] info [cpaneld] 98.184.30.74 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.7.7.145
country_id: 6252001
description:
[2026-06-30 17:20:58 +0000] info [cpaneld] 75.7.7.145 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.0.127
country_id: 6252001
description:
[2026-06-30 17:20:48 +0000] info [cpaneld] 71.208.0.127 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.94.9.84
country_id: 6252001
description:
[2026-06-30 17:20:38 +0000] info [cpaneld] 76.94.9.84 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d626145073d7377c342396db255c1f1aaf6a264||Title:cxb969guqh7oi857k2||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.94.84
country_id: 6252001
description:
[2026-06-30 17:20:54 +0000] info [cpaneld] 172.56.94.84 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.154.240
country_id: 6252001
description:
[2026-06-30 17:20:45 +0000] info [cpaneld] 68.40.154.240 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.111.152.137
country_id: 6252001
description:
[2026-06-30 17:20:34 +0000] info [cpaneld] 24.111.152.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:21:32 ns5 kernel: php-fpm[1917562]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6053b97f44f2a2385035cc10f6218d14f038d7e||Title:6yijnx80h2x4hz01hh||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.186.198.191
country_id: 6252001
description:
[2026-06-30 17:21:03 +0000] info [cpaneld] 98.186.198.191 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:22:22 ns5 kernel: php-fpm[1917939]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [30/Jun/2026:17:22:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065257&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fconcours-djena-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782840174 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/concours-djena-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec2cc72cfeb27134107aeebbe8ea528a474c304||Title:qjvqaqmhp5esmdvvz||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.112
country_id: 1880251
description:
43.173.176.112 - - [30/Jun/2026:17:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039946&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D9453&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782840137 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=9453" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.112


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.133.15.122
country_id: 6252001
description:
[2026-06-30 17:23:00 +0000] info [cpaneld] 68.133.15.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.240.232
country_id: 6252001
description:
[2026-06-30 17:23:04 +0000] info [cpaneld] 172.56.240.232 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.232.159
country_id: 6252001
description:
[2026-06-30 17:23:15 +0000] info [cpaneld] 73.207.232.159 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.106.43.122
country_id: 6252001
description:
[2026-06-30 17:23:18 +0000] info [cpaneld] 73.106.43.122 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.198.45.184
country_id: 6252001
description:
[2026-06-30 17:23:24 +0000] info [cpaneld] 73.198.45.184 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.169.111.224
country_id: 6252001
description:
[2026-06-30 17:23:27 +0000] info [cpaneld] 98.169.111.224 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1947bc2c7bb55485de0232f02ff2cd65d158fd44||Title:ge1ekbnzivdhols2s2||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.33.22.180
country_id: 6252001
description:
[2026-06-30 17:23:07 +0000] info [cpaneld] 136.33.22.180 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.230.188.249
country_id: 6252001
description:
[2026-06-30 17:23:21 +0000] info [cpaneld] 97.230.188.249 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.193.209.44
country_id: 6252001
description:
2026-06-30 17:24:42 dovecot_plain authenticator failed for H=c-71-193-209-44.hsd1.or.comcast.net (4b7rf2con1k4ok4qb) [71.193.209.44]:42840: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.109.131.124
country_id: 3469034
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-json/wp/v2/users HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:812704ba6b478c17df31a89dcd6cf9f96b228386||Title:lc9y62py1r27397zg2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee1bf46211d70bf148e148d3088338ef5fe7b875||Title:9gptffe55f4cj9w||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.109.131.124
country_id: 3469034
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-login.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.63.16.202
country_id: 1861060
description:
72.63.16.202 - - [30/Jun/2026:17:26:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132586&pdata=https%253A%252F%252Ftogomedia24.tg%252F2019%252F03%252F06%252Fle-togolais-akoro-bilal-en-essai-aux-emirats-arabes-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782840374 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2019/03/06/le-togolais-akoro-bilal-en-essai-aux-emirats-arabes-unis/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.1828.1186 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.63.16.202


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9adbc7d23c88714f917c557e212ee3a0cc685c60||Title:9mocdmx5xamj4t00kr||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e1bc7577e681c36b694edd4fed1b3195d8a4510a||Title:sc510u1h7henyeg||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:28:36 ns5 kernel: php-fpm[1920836]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83f7fcd2a103588753c27bd18163d20d5024cb9c||Title:ok4na0ntwis34r7xit||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.18.173
country_id: 1880251
domain: autodiscover.tps.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-content/uploads/admin.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:29:12 ns5 kernel: php-fpm[1921957]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:803bab34f8100605a5165b96e3af72f179910de2||Title:1yedwgq7gzc0knmw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1619bf4abf85bc9abc4e08146b0fa7c2f9b22ce2||Title:lrnm9rtjeo16l2h||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:30:23 +0000] info [cpaneld] 64.111.92.123 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.209
country_id: 1880251
description:
43.173.179.209 - - [30/Jun/2026:17:30:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921838&pdata=https%253A%252F%252Ftogointerim.net%252F%253Frsjp_job_postings%253Ddirecteur-administration-gestion-finances&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782840617 HTTP/1.1" 404 561 togointerim.net "https://togointerim.net/?rsjp_job_postings=directeur-administration-gestion-finances" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:31:18 +0000] info [cpaneld] 64.111.92.123 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.175.49.16
country_id: 1819730
domain: lasnb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-content/uploads/min.php||SC:/home/bighostingsnbd/public_html/siteweb/public/wp-content||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.228.52
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b679093c896b141dfc361982a6b7f8393f8a362e||Title:xpw4f8ek9rgn7xcef||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.15
country_id: 1880251
description:
43.173.177.15 - - [30/Jun/2026:17:33:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234664&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D14596&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782840806 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=14596" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.15


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:34:18 ns5 kernel: php-fpm[1923503]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:36:40 ns5 kernel: php-fpm[1929436]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:37:10 ns5 kernel: php-fpm[1930044]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:38:26 ns5 kernel: php-fpm[1930652]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:38:59 ns5 kernel: php-fpm[1930951]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 135.136.39.70
country_id: 2658434
description:
135.136.39.70 - - [30/Jun/2026:17:39:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738394&pdata=https%253A%252F%252Fdagl.tg%252Fcategorie%252F8-assainissement&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782841155 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/categorie/8-assainissement" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:135.136.39.70


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.113.39.195
country_id: 2017370
description:
2026-06-30 17:40:07 H=([45.14.165.37]) [85.113.39.195]:60683 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:40:39 ns5 kernel: php-fpm[1931385]: segfault at 7ffebee9ebf8 ip 000000000072ad55 sp 00007ffebee9ebf8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:43:20 ns5 kernel: php-fpm[1931459]: segfault at 7ffebee9ebf8 ip 000000000072ad55 sp 00007ffebee9ebf8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:44:15 ns5 kernel: php-fpm[1931747]: segfault at 7ffebee9ebf8 ip 000000000072ad55 sp 00007ffebee9ebf8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:44:59 ns5 kernel: php-fpm[1932458]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.13.254
country_id: 2960313
description:
107.189.13.254 - ohuuvcqw [30/Jun/2026:17:45:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210520&pdata=https%253A%252F%252Fdigilix.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782841548 HTTP/2.0" 302 0 digilix.tg "https://digilix.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.13.254


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.122.81
country_id: 6252001
domain: www.cfmi.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.122.81||TA:152.232.122.81||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:46:09 ns5 kernel: php-fpm[1934321]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 17:46:26 +0000] info [webmaild] 102.176.253.226 - chef.dgi@ucao-uut.tg "POST /cpsess2980363719/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.142.162] != Current IP Address [102.176.253.226]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.206
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.206: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.13.254
country_id: 2960313
description:
107.189.13.254 - formationfreenet [30/Jun/2026:17:47:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790869&pdata=https%253A%252F%252Fformation.free.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782841658 HTTP/2.0" 302 0 formation.free.netmaster.tg "https://formation.free.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.13.254


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.46.35
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.46.35: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.91: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.234
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.234: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:48:00 ns5 kernel: php-fpm[1935092]: segfault at 7ffebee9ee98 ip 000000000072ad55 sp 00007ffebee9ee98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:49:34 ns5 kernel: php-fpm[1935749]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.132
country_id: 2661886
description:
171.25.193.132 - nmvhuvgp [30/Jun/2026:17:49:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919875&pdata=https%253A%252F%252Flerendez-vous.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782841763 HTTP/2.0" 302 0 lerendez-vous.tg "https://lerendez-vous.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.132


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:50:01 ns5 kernel: php-fpm[1936006]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:51:03 +0000] info [cpaneld] 64.111.92.123 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 17:51:11 +0000] info [cpaneld] 168.144.35.224 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.210
country_id: 1880251
description:
43.173.182.210 - - [30/Jun/2026:17:52:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10406038&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14823&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782841917 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14823" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.210


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 17:53:22 +0000] info [cpaneld] 20.212.169.175 - .SAPHYRTOUR "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.107.197.152
country_id: 2077456
description:
103.107.197.152 - - [30/Jun/2026:17:53:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186899&pdata=http%253A%252F%252Fgroup-gci.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782842013 HTTP/1.1" 302 0 group-gci.com "http://group-gci.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.107.197.152


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:54:17 ns5 kernel: php-fpm[1936529]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.100.243
country_id: 2921044
description:
185.220.100.243 - zxtqbmmj [30/Jun/2026:17:54:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801766&pdata=https%253A%252F%252Fperfect-labo.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782842044 HTTP/2.0" 302 0 perfect-labo.com "https://perfect-labo.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.100.243


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.11.185
country_id: 1269750
description:
146.190.11.185 - - [30/Jun/2026:17:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999771&pdata=http%253A%252F%252Flcr-adem.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782842067 HTTP/1.1" 302 0 lcr-adem.org "http://lcr-adem.org/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.11.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.193.179.233
country_id: 1643084
description:
103.193.179.233 - naduwpdk [30/Jun/2026:17:55:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818376&pdata=https%253A%252F%252Ftilitulab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782842109 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.193.179.233


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.195.253.180
country_id: 6252001
description:
199.195.253.180 - naduwpdk [30/Jun/2026:17:55:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646679&pdata=https%253A%252F%252Ftilitulab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782842126 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.195.253.180


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:56:29 ns5 kernel: php-fpm[1936662]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.89
country_id: 6252001
description:
[2026-06-30 17:56:35 +0000] info [cpaneld] 195.63.9.89 - ifxmoxbf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 17:57:34 ns5 kernel: php-fpm[1937202]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.195.253.180
country_id: 6252001
description:
199.195.253.180 - efberwhk [30/Jun/2026:17:57:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867603&pdata=https%253A%252F%252Fsncom.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782842242 HTTP/2.0" 302 0 sncom.tg "https://sncom.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.195.253.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:57:44 +0000] info [cpaneld] 64.111.92.123 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.161
country_id: 6252001
description:
[2026-06-30 17:58:44 +0000] info [cpaneld] 195.63.9.161 - dvhzmira "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 17:59:34 +0000] info [cpaneld] 64.111.92.123 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:00:32 ns5 kernel: php-fpm[1938353]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 34.77.161.216
country_id: 2802361
description:
[2026-06-30 18:00:32 +0000] info [whostmgrd] 34.77.161.216 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.22.116.225
country_id: 6252001
description:
[2026-06-30 18:00:34 +0000] info [cpaneld] 134.22.116.225 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.90.154.174
country_id: 6252001
description:
[2026-06-30 18:00:46 +0000] info [cpaneld] 73.90.154.174 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.167.174.17
country_id: 6252001
description:
[2026-06-30 18:00:28 +0000] info [cpaneld] 76.167.174.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.77.161.216
country_id: 2802361
description:
[2026-06-30 18:00:32 +0000] info [whostmgrd] 34.77.161.216 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.169.77.103
country_id: 6252001
description:
[2026-06-30 18:00:37 +0000] info [cpaneld] 209.169.77.103 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.251.4
country_id: 6252001
description:
[2026-06-30 18:00:59 +0000] info [cpaneld] 153.66.251.4 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:01:04 ns5 kernel: php-fpm[1938513]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.136.33.92
country_id: 6252001
description:
[2026-06-30 18:01:06 +0000] info [cpaneld] 69.136.33.92 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 158.173.157.163
country_id: 3017382
description:
[2026-06-30 18:01:12 +0000] info [whostmgrd] 158.173.157.163 PURGE root:GdGEr8hvMTtb9gHC badpass [cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.163]]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 158.173.157.163
country_id: 3017382
description:
[2026-06-30 18:01:22 +0000] info [whostmgrd] 158.173.157.163 NEW root:aRj56tvmDVVpMeRb address=158.173.157.163,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 158.173.157.163
country_id: 3017382
description:
[2026-06-30 18:01:11 +0000] info [whostmgrd] 158.173.157.163 - root "GET /cpsess5579469439/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.163]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:02:38 ns5 kernel: php-fpm[1939270]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.22.193.35
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-03.81.22.193.35||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 18:04:50 +0000] info [cpaneld] 64.111.92.123 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:06:14 ns5 kernel: php-fpm[1940982]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:10:11 ns5 kernel: php-fpm[1942299]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:11:21 ns5 kernel: php-fpm[1941289]: segfault at 7ffebee9eba8 ip 000000000072ad55 sp 00007ffebee9eba8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [30/Jun/2026:18:13:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12829637&pdata=https%253A%252F%252Fhealthcarenavigatorsllc.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782843217 HTTP/2.0" 302 0 healthcarenavigatorsllc.net "https://healthcarenavigatorsllc.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.224
country_id: 1880251
description:
43.173.180.224 - - [30/Jun/2026:18:15:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803886&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D13916&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782843312 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=13916" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 18:17:43 +0000] info [cpaneld] 64.111.92.123 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 18:18:23 +0000] info [webmaild] 160.242.195.10 - cadicles "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user cadicles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 18:18:46 +0000] info [cpaneld] 167.99.236.81 - cvajhehu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 18:19:01 +0000] info [webmaild] 160.242.195.10 - cadicles "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user cadicles (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:21:02 ns5 kernel: php-fpm[1945987]: segfault at 7ffc410dbf78 ip 000000000072ad55 sp 00007ffc410dbf78 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.17.146
country_id: 3175395
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.239.17.146||TA:104.239.17.146||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.113.119.220
country_id: 2921044
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.113.119.220||TA:194.113.119.220||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.161.88.47
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1001339485-905x613-1-300x203.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-30 18:24:06 +0000] info [webmaild] 196.171.46.177 - direction@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.140.167.32
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/ce-qu-il-faut-savoir-sur-le-programme-de-transferts-monetaires_i1920-300x169.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.175.154.204
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Les-grandes-decisions-du-Conseil-des-ministres-du-26-juin-2026-240x300.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 18:24:03 +0000] info [cpaneld] 167.99.236.81 - crepsad "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.247.90.126
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1001339485-905x613-1-768x520.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.171.97.159
country_id: 2963597
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Les-grandes-decisions-du-Conseil-des-ministres-du-26-juin-2026-768x960.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.160.164.150
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/ce-qu-il-faut-savoir-sur-le-programme-de-transferts-monetaires_i1920-768x432.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you loved this write-up and you would like to obtain much more facts with regards to ||MV:gt;If you loved this write-up and you would like to obtain much more facts with regards to ||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.170
country_id: 1880251
description:
43.173.180.170 - - [30/Jun/2026:18:29:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382024&pdata=https%253A%252F%252Fruralinfos.tg%252Fcategory%252Fau-champ&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782844160 HTTP/1.1" 404 561 ruralinfos.tg "https://ruralinfos.tg/category/au-champ" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.170


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:29:46 ns5 kernel: php-fpm[1950433]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:30:28 ns5 kernel: php-fpm[1950504]: segfault at 7ffce3094fc0 ip 0000000000729c3b sp 00007ffce3094fb0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 18:30:17 +0000] info [webmaild] 160.242.195.10 - sdogbe@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:34:19 ns5 kernel: php-fpm[1950777]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 18:34:07 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [30/Jun/2026:18:35:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12805732&pdata=https%253A%252F%252Fwww.direct7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782844519 HTTP/2.0" 302 0 www.direct7.tg "https://www.direct7.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 BytedanceWebview/d8a21c6 trill_31.7.0 JsSdk/2.0 NetType/WIFI Channel/App Store ByteLocale/id Region/ID FalconTag/B01A80E7-4BCD-4660-A50A-8FC7551A9C2F TTP_H5_URLPROTOCOL" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.direct7.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 BytedanceWebview/d8a21c6 trill_31.7.0 JsSdk/2.0 NetType/WIFI Channel/App Store ByteLocale/id Region/ID FalconTag/B01A80E7-4BCD-4660-A50A-8FC7551A9C2F TTP_H5_URLPROTOCOL||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.34
country_id: 1880251
description:
43.173.181.34 - - [30/Jun/2026:18:37:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870233&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D695&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782844653 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=695" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.34


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:39:00 ns5 kernel: php-fpm[1954799]: segfault at 7ffce3094e58 ip 000000000072ad55 sp 00007ffce3094e58 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.227.232
country_id: 3469034
description:
Jun 30 18:39:46 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.227.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.227.232
country_id: 3469034
description:
Jun 30 18:40:01 ns5 auth[1774657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.227.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-06-30 18:42:40 +0000] info [cpaneld] 103.65.237.55 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 146.19.191.54
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 146.19.191.54: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:45:14 ns5 kernel: php-fpm[1958466]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 146.19.191.54
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 146.19.191.54: 284 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 18:47:43 +0000] info [cpaneld] 64.111.92.123 - Masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Masfloy (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 204.76.203.84
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 204.76.203.84: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:47:16 ns5 kernel: php-fpm[1956549]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:48:13 ns5 kernel: php-fpm[1960235]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 18:48:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.12.172
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.233.12.172||TA:104.233.12.172||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [30/Jun/2026:18:51:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712941&pdata=http%253A%252F%252F154.70.82.249%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782845508 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:53:38 ns5 kernel: php-fpm[1962967]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77140882
name: IM360 WAF: Infectors: OS File Access Attempt
abuser: 138.199.43.94
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Infectors: OS File Access Attempt||MVN:ARGS:download||MV:/etc/passwd||RSV:8.21||T:APACHE||SC:/home/pnls/public_html/PNLS01/index.php||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:54:09 ns5 kernel: php-fpm[1962998]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 206.168.191.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 206.168.191.91: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 18:55:51 ns5 kernel: php-fpm[1964389]: segfault at 7ffce3094ea8 ip 000000000072ad55 sp 00007ffce3094ea8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.177
country_id: 3175395
description:
Jun 30 18:55:52 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.177
country_id: 3175395
description:
Jun 30 18:56:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 18:59:18 +0000] info [cpaneld] 167.99.236.81 - ucaouut "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.190
country_id: 3175395
description:
Jun 30 19:00:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 19:00:52 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-06-30 19:01:35 +0000] info [cpaneld] 103.65.237.55 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.26.192.251
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/woezon-wezou/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.5.69
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/woezon-wezou/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.235.72.64
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 103.235.72.64: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.66
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.144.190.66||TA:198.144.190.66||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.136
country_id: 6252001
description:
Jun 30 19:05:49 ns5 pure-ftpd[1972101]: (?@198.235.24.136) [INFO] New connection from 198.235.24.136


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.167.172
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.117.167.172||TA:217.117.167.172||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.240.245
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.147.240.245||TA:142.147.240.245||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.187
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:23.229.126.187||TA:23.229.126.187||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-30 19:06:39 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56594: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.157.219
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.245.157.219||TA:172.245.157.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.81.157
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.81.157||TA:152.232.81.157||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.94.136
country_id: 2658434
domain: caissederetraites.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:191.101.94.136||TA:191.101.94.136||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:09:07 ns5 kernel: php-fpm[1970443]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:11:15 ns5 kernel: php-fpm[1970474]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 49.36.188.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.0027262995224209274||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.188.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67328.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dd99ed68c95418e9561231f61c919a500529b612||Title:mnsc6rpcp0glisg4v||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 49.36.188.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.5133508449420094||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:14:49 ns5 kernel: php-fpm[1973752]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.0.12.174
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-ladaptation-climatique-une-priorite-nationale/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 19:14:09 +0000] info [webmaild] 160.242.195.10 - sdogbe@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.0.12.174
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-ladaptation-climatique-une-priorite-nationale/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.21.217
country_id: 2363686
description:
[2026-06-30 19:14:48 +0000] info [webmaild] 196.169.21.217 - kahare@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:15:01 ns5 kernel: php-fpm[1973036]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 19:15:07 +0000] info [cpaneld] 64.111.92.123 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.215.13
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:213.169.215.13||TA:213.169.215.13||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:16:19 ns5 kernel: php-fpm[1974785]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.209.27
country_id: 1861060
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:161.123.209.27||TA:161.123.209.27||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.20.137
country_id: 3469034
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.252.20.137||TA:104.252.20.137||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:17:03 ns5 kernel: php-fpm[1976391]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.225.248
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.42.225.248||TA:193.42.225.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.168.102
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:140.235.168.102||TA:140.235.168.102||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:20:20 ns5 kernel: php-fpm[1978280]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.237.38.198
country_id: 617790
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-cnp-togo-et-otr-anticipent-le-controle-fiscal/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.237.38.198
country_id: 617790
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-cnp-togo-et-otr-anticipent-le-controle-fiscal/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.154.26
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/la-haac-adopte-les-rapports-de-ses-activites-a-kara/<script async src||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.231.45.47
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 5.231.45.47: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:22:54 ns5 kernel: php-fpm[1978616]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.73.111.103
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/agriculture/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.73.111.103
country_id: 290557
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/agriculture/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.128.63
country_id: 690791
description:
Jun 30 19:22:27 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.128.63 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.231.45.47
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 5.231.45.47: 100 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.152.196
country_id: 2363686
description:
[2026-06-30 19:24:07 +0000] info [webmaild] 102.64.152.196 - tchedye.d@inger.tg "GET /cpsess7744258807/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=297&_mbox=INBOX&_action=show HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.107.199] != Current IP Address [102.64.152.196]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.152.196
country_id: 2363686
description:
[2026-06-30 19:24:10 +0000] info [webmaild] 102.64.152.196 - tchedye.d@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 19:24:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:25:51 ns5 kernel: php-fpm[1978682]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.93.224.246
country_id: 6252001
description:
35.93.224.246 - - [30/Jun/2026:19:25:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880988&pdata=https%253A%252F%252Farse.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782847547 HTTP/2.0" 302 0 arse.tg "https://arse.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.93.224.246


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:26:42 ns5 kernel: php-fpm[1978903]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.41.242
country_id: 146669
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.236.185
country_id: 3923057
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_moved.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.236.202
country_id: 3923057
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/IP_changed.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:27:38 ns5 kernel: php-fpm[1979046]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 19:27:27 +0000] info [cpaneld] 64.111.92.123 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:29:27 ns5 kernel: php-fpm[1979512]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.55.111
country_id: 2921044
domain: chatmerce.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chatmerce.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:31:32 ns5 kernel: php-fpm[1980700]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:32:26 ns5 kernel: php-fpm[1981184]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.52
country_id: 3469034
description:
Jun 30 19:32:22 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.52 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:33:05 ns5 kernel: php-fpm[1981572]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.238.79.169
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 194.238.79.169: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.43
country_id: 1880251
description:
43.173.178.43 - - [30/Jun/2026:19:33:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974868&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D6180&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782848013 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=6180" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.43


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:34:37 ns5 kernel: php-fpm[1982178]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 30 19:34:47 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [30/Jun/2026:19:35:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9945956&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782848127 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [30/Jun/2026:19:35:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842728&pdata=http%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782848109 HTTP/1.1" 302 0 www.selithgroup.com "http://www.selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.170.83.212
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.170.83.212: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.171.100.243
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.171.100.243: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.111.11
country_id: 2635167
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:216.173.111.11||TA:216.173.111.11||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:37:14 ns5 kernel: php-fpm[1984313]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.120.147.62
country_id: 2921044
description:
172.120.147.62 - - [30/Jun/2026:19:37:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382229&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D581&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782848232 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=581" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3327.1914 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.120.147.62


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:38:03 ns5 kernel: php-fpm[1984802]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:39:12 ns5 kernel: php-fpm[1984883]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 19:39:39 +0000] info [cpaneld] 64.111.92.123 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:40:02 ns5 kernel: php-fpm[1985613]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:19:40:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712169&pdata=http%253A%252F%252Fmail.togoartconnection.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782848416 HTTP/1.1" 302 0 mail.togoartconnection.tg "http://mail.togoartconnection.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:42:58 ns5 kernel: php-fpm[1987429]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:45:58 ns5 kernel: php-fpm[1988351]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.115.51.129
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/03/t\xc3\xa9l\xc3\xa9chargement-1.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:46:44 ns5 kernel: php-fpm[1988503]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.141
country_id: 1880251
description:
43.173.173.141 - - [30/Jun/2026:19:46:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908058&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D1237&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782848815 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=1237" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.141


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.143.175
country_id: 2363686
description:
[2026-06-30 19:46:52 +0000] info [webmaild] 196.168.143.175 - wiyao.g@inger.tg "POST /cpsess2404408549/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.168.143.175]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:47:52 ns5 kernel: php-fpm[1989171]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 19:47:34 +0000] info [cpaneld] 64.111.92.123 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:48:41 ns5 kernel: php-fpm[1989452]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.18.158
country_id: 2363686
description:
[2026-06-30 19:48:09 +0000] info [webmaild] 196.170.18.158 - egnassingbe@golfe3.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:49:56 ns5 kernel: php-fpm[1989714]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:51:59 ns5 kernel: php-fpm[1990744]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:53:06 ns5 kernel: php-fpm[1991009]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 19:53:28 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.81.230.77
country_id: 1269750
description:
[2026-06-30 19:54:21 +0000] info [whostmgrd] 40.81.230.77 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:54:33 ns5 kernel: php-fpm[1991946]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.54.94.14
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.54.94.14: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 40.81.230.77
country_id: 1269750
description:
[2026-06-30 19:54:24 +0000] info [whostmgrd] 40.81.230.77 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.89.231
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.163.89.231||TA:193.163.89.231||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.54.94.102
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.54.94.102: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.19.254
country_id: 3175395
domain: mail.nerohost.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.239.19.254||TA:104.239.19.254||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.119.141
country_id: 6252001
domain: test.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.120.119.141||TA:172.120.119.141||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:55:41 ns5 kernel: php-fpm[1992272]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 30 19:56:53 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:57:41 ns5 kernel: php-fpm[1993246]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 19:59:00 ns5 kernel: php-fpm[1993692]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:01:03 ns5 kernel: php-fpm[1994192]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.60.88
country_id: 99237
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/wp-json/wp/v2/users HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 20:01:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.102.136.30
country_id: 1210997
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/wp-login.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.243
country_id: 3469034
description:
Jun 30 20:02:25 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.243 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:03:28 ns5 kernel: php-fpm[1995437]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 20:04:25 +0000] info [cpaneld] 64.111.92.123 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:05:02 ns5 kernel: php-fpm[1995954]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:07:06 ns5 kernel: php-fpm[1996599]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.109
country_id: 1880251
description:
43.173.179.109 - - [30/Jun/2026:20:07:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119316&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D4%2526page%253D24&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782850031 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=4&page=24" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.109


plugin: modsec
rule: 77277977
name: IM360 WAF: XMLRPC multicall track
abuser: 89.46.223.80
country_id: 2750405
domain: v2.arse.tg
description:
IM360 WAF: XMLRPC multicall track||Method:blogger.getUsersBlogs||Param1:urn:zoundry.com:raven:pub:xmlrpc:metaweblog:wordpress22||Param2:Turbolte||Param3:Ajatovivi1994||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.245
country_id: 1880251
description:
43.173.173.245 - - [30/Jun/2026:20:07:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460313&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D30721&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782850028 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=30721" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.245


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:09:01 ns5 kernel: php-fpm[1997745]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-06-30 20:09:42 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess4158820801/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:10:44 ns5 kernel: php-fpm[1998425]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.36.146.80
country_id: 690791
domain: atms.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-10.176.36.146.80||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 193.36.225.35
country_id: 6252001
domain: brmn.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:zgqykfsi||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:12:20 ns5 kernel: php-fpm[1999267]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:13:30 ns5 kernel: php-fpm[1999359]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-06-30 20:13:12 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br ([59.145.86.177]) [179.48.229.117]:59640: 535 Incorrect authentication data (set_id=office@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.240
country_id: 3469034
description:
Jun 30 20:14:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 193.36.225.35
country_id: 6252001
domain: brmn.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:zgqykfsi||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.85
country_id: 798544
description:
Jun 30 20:15:55 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.85 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:15:07 ns5 kernel: php-fpm[1999943]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.85
country_id: 798544
description:
Jun 30 20:16:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.85 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:17:05 ns5 kernel: php-fpm[2000613]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:18:15 ns5 kernel: php-fpm[2001358]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.143.101.153
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0049.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:19:56 ns5 kernel: php-fpm[2001685]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 20:19:57 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.24
country_id: 1880251
description:
43.173.177.24 - - [30/Jun/2026:20:19:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856924&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D13042&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782850753 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=13042" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.24


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 80.192.53.185
country_id: 2635167
description:
80.192.53.185 - - [30/Jun/2026:20:19:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432037&pdata=https%253A%252F%252Fcfpj.tg%252Fgizz-268345netidm60zin.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782850771 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/gizz-268345netidm60zin.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:80.192.53.185


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 20:19:41 +0000] info [cpaneld] 52.200.114.158 - esso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 30 20:19:54 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:21:16 ns5 kernel: php-fpm[2002214]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.164.220
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:199.96.164.220||TA:199.96.164.220||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 20:22:38 +0000] info [cpaneld] 64.111.92.123 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 20:22:22 +0000] info [cpaneld] 52.200.114.158 - aogodmm "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.86
country_id: 1880251
description:
43.173.179.86 - - [30/Jun/2026:20:22:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7193494&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D11858&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782850943 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=11858" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.86


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:23:17 ns5 kernel: php-fpm[2003066]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 30 20:23:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:24:02 ns5 kernel: php-fpm[2002992]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.64.17
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.64.17: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.64.18
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.64.18: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.108.157
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.108.157: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.64.20
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.64.20: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.64.19
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.64.19: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.108.158
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.108.158: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.108.155
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.108.155: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.6.108.159
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 212.6.108.159: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:26:04 ns5 kernel: php-fpm[2003865]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 20:26:11 +0000] info [cpaneld] 167.99.236.81 - e.carine "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 20:27:41 +0000] info [cpaneld] 64.111.92.123 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:28:25 ns5 kernel: php-fpm[2004461]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:29:36 ns5 kernel: php-fpm[2005269]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:30:03 ns5 kernel: php-fpm[2005515]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:31:13 ns5 kernel: php-fpm[2005484]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:32:03 ns5 kernel: php-fpm[2006219]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:33:53 ns5 kernel: php-fpm[2007132]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 20:34:52 +0000] info [cpaneld] 52.200.114.158 - kwbcfbmo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.58.235
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:145.223.58.235||TA:145.223.58.235||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:35:16 ns5 kernel: php-fpm[2007479]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:20:35:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130792&pdata=https%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851754 HTTP/2.0" 302 0 selithgroup.com "https://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:36:05 ns5 kernel: php-fpm[2007726]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [30/Jun/2026:20:36:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456367&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851765 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 20:36:42 +0000] info [cpaneld] 52.200.114.158 - togoinrdceh "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [30/Jun/2026:20:36:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327446&pdata=https%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851803 HTTP/2.0" 302 0 www.selithgroup.com "https://www.selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:20:36:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12819049&pdata=https%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851813 HTTP/2.0" 302 0 selithgroup.com "https://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:37:04 ns5 kernel: php-fpm[2009492]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 20:37:46 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:20:37:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181970&pdata=https%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851870 HTTP/2.0" 302 0 www.selithgroup.com "https://www.selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.28
country_id: 6252001
description:
205.169.39.28 - - [30/Jun/2026:20:37:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051418&pdata=http%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851829 HTTP/1.1" 302 0 www.selithgroup.com "http://www.selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [30/Jun/2026:20:37:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393755&pdata=https%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851833 HTTP/2.0" 302 0 www.selithgroup.com "https://www.selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.135.23
country_id: 6252001
description:
2026-06-30 20:37:34 dovecot_plain authenticator failed for H=(mfu74acv3l11irlf8vb16) [107.173.135.23]:42054: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 160.20.165.242
country_id: 3658394
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-37.160.20.165.242||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.228
country_id: 1880251
description:
43.172.198.228 - - [30/Jun/2026:20:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251208&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D3%2526paged%253D2&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782851926 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=3&paged=2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.228


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:39:24 ns5 kernel: php-fpm[2010435]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:41:43 ns5 kernel: php-fpm[2010992]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 20:41:38 +0000] info [cpaneld] 64.111.92.123 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 30 20:41:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:42:19 ns5 kernel: php-fpm[2011738]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:43:54 ns5 kernel: php-fpm[2012019]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.182
country_id: 6252001
description:
Jun 30 20:43:19 ns5 pure-ftpd[2014515]: (?@198.235.24.182) [INFO] New connection from 198.235.24.182


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:44:04 ns5 kernel: php-fpm[2011272]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.102
country_id: 3469034
description:
Jun 30 20:44:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 20:45:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.134.43.151
country_id: 3017382
description:
91.134.43.151 - - [30/Jun/2026:20:46:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514074&pdata=https%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782852400 HTTP/2.0" 302 0 www.selithgroup.com "https://www.selithgroup.com/" "Mozilla/5.0 (Linux; arm_64; Android 14; Infinix X6833B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.49 YaBrowser/26.4.7.49.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.134.43.151


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:47:40 ns5 kernel: php-fpm[2013791]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.164.131
country_id: 2363686
description:
[2026-06-30 20:47:11 +0000] info [webmaild] 102.64.164.131 - hboroze@caissederetraites.tg "POST /cpsess3580956980/3rdparty/roundcube/?_task=mail&_action=check-recent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.138.168
country_id: 1512440
description:
2026-06-30 20:48:41 H=([92.63.204.179]) [185.139.138.168]:19627 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.164.131
country_id: 2363686
description:
[2026-06-30 20:49:01 +0000] info [webmaild] 102.64.164.131 - hboroze@caissederetraites.tg "POST /cpsess3580956980/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:49:55 ns5 kernel: php-fpm[2014610]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:50:03 ns5 kernel: php-fpm[2014737]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.91.159.157
country_id: 3017382
description:
51.91.159.157 - - [30/Jun/2026:20:50:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855640&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782852649 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.91.159.157


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.182
country_id: 1880251
description:
43.172.197.182 - - [30/Jun/2026:20:50:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723229&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D11915&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782852650 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=11915" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 20:50:02 +0000] info [cpaneld] 64.111.92.123 - concours "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.164.131
country_id: 2363686
description:
[2026-06-30 20:52:01 +0000] info [webmaild] 102.64.164.131 - hboroze@caissederetraites.tg "POST /cpsess3580956980/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 20:53:32 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:54:58 ns5 kernel: php-fpm[2016040]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:56:55 ns5 kernel: php-fpm[2016904]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 49.51.50.147
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1729||QS:add-to-cart=1729||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:57:31 ns5 kernel: php-fpm[2016744]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 20:58:03 ns5 kernel: php-fpm[2017974]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 20:59:31 +0000] info [cpaneld] 52.200.114.158 - mpqypjjp "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 21:00:11 +0000] info [cpaneld] 167.99.236.81 - mouss "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:01:25 ns5 kernel: php-fpm[2019194]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.94
country_id: 1880251
description:
43.172.195.94 - - [30/Jun/2026:21:02:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984850&pdata=https%253A%252F%252F24heureinfo.tg%252Fflash-info%252Flocales-akakpovi-gamatho-rassure-les-candidats-sur-le-retard-pris-dans-laffichage-des-listes-definitives%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782853319 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/flash-info/locales-akakpovi-gamatho-rassure-les-candidats-sur-le-retard-pris-dans-laffichage-des-listes-definitives/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-06-30 21:02:01 +0000] info [cpaneld] 103.65.237.55 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-30 21:03:51 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:47920: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.134.43.151
country_id: 3017382
description:
91.134.43.151 - - [30/Jun/2026:21:04:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276062&pdata=https%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782853471 HTTP/2.0" 302 0 selithgroup.com "https://selithgroup.com/" "Mozilla/5.0 (Linux; arm_64; Android 14; Infinix X6833B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.49 YaBrowser/26.4.7.49.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.134.43.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 21:05:21 +0000] info [cpaneld] 167.99.236.81 - ingertgsarl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.117.131
country_id: 2363686
description:
[2026-06-30 21:06:12 +0000] info [webmaild] 196.168.117.131 - rahim.nadaabi@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.117.131
country_id: 2363686
description:
[2026-06-30 21:06:34 +0000] info [cpaneld] 196.168.117.131 NEW waywcbyw:HiMIl4HBanRCaPrM address=196.168.117.131,app=cpaneld,creator=waywcbyw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:07:18 ns5 kernel: php-fpm[2021066]: segfault at 7ffc5ee19ee8 ip 000000000072ad55 sp 00007ffc5ee19ee8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rahim.nadaabi@tchambainvest.tg [06/30/2026:21:07:07 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rahim.nadaabi@tchambainvest.tg


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.227.135
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.111.227.135||TA:142.111.227.135||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.230.127
country_id: 2077456
domain: www.djama.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:46.203.230.127||TA:46.203.230.127||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 21:10:57 +0000] info [cpaneld] 64.111.92.123 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:11:31 ns5 kernel: php-fpm[2021844]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 21:11:37 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 21:11:17 +0000] info [cpaneld] 20.212.169.175 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:11:59 ns5 kernel: php-fpm[2023380]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:13:14 ns5 kernel: php-fpm[2024182]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:14:17 ns5 kernel: php-fpm[2024277]: segfault at 7ffc5ee19e98 ip 000000000072ad55 sp 00007ffc5ee19e98 error 6 in php-fpm[400000+4ad000]


