# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  7 19:22:12 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.40.22
country_id: 3895114
description:
[2026-06-07 19:21:54 +0000] info [cpaneld] 190.5.40.22 - let "GET /login/?login_only=1&user=let&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user let (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 19:25:19 ns5 pure-ftpd[4167286]: (?@196.179.7.81) [WARNING] Authentication failed for user [netmast]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  7 19:28:39 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-07 19:28:41 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:15723: 535 Incorrect authentication data (set_id=rayhan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.162.149.216
country_id: 3895114
description:
[2026-06-07 19:29:25 +0000] info [cpaneld] 181.162.149.216 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.152.42.185
country_id: 2464461
description:
[2026-06-07 19:29:36 +0000] info [cpaneld] 102.152.42.185 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.71.7.2
country_id: 6252001
description:
[2026-06-07 19:28:52 +0000] info [cpaneld] 96.71.7.2 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.137.109.193
country_id: 1210997
description:
[2026-06-07 19:29:30 +0000] info [cpaneld] 103.137.109.193 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.145.199.108
country_id: 2017370
description:
[2026-06-07 19:29:34 +0000] info [cpaneld] 5.145.199.108 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.0.246
country_id: 290557
description:
[2026-06-07 19:29:39 +0000] info [cpaneld] 5.38.0.246 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.36.235.143
country_id: 3469034
description:
[2026-06-07 19:32:43 +0000] info [cpaneld] 191.36.235.143 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.209.214.117
country_id: 2921044
description:
[2026-06-07 19:33:07 +0000] info [cpaneld] 92.209.214.117 - misst "GET /login/?login_only=1&user=misst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user misst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.139.40.121
country_id: 3996063
description:
[2026-06-07 19:33:11 +0000] info [cpaneld] 187.139.40.121 - miss "GET /login/?login_only=1&user=miss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user miss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.169.214.190
country_id: 2017370
description:
[2026-06-07 19:33:16 +0000] info [cpaneld] 136.169.214.190 - mi "GET /login/?login_only=1&user=mi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.229.165
country_id: 3865483
description:
[2026-06-07 19:32:51 +0000] info [cpaneld] 170.81.229.165 - misstogo "GET /login/?login_only=1&user=misstogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user misstogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.98
country_id: 1282988
description:
[2026-06-07 19:33:04 +0000] info [cpaneld] 103.163.182.98 - missto "GET /login/?login_only=1&user=missto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user missto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.123.100.16
country_id: 3017382
description:
[2026-06-07 19:33:13 +0000] info [cpaneld] 78.123.100.16 - mis "GET /login/?login_only=1&user=mis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.35.196.105
country_id: 3703430
description:
[2026-06-07 19:32:55 +0000] info [cpaneld] 190.35.196.105 - misstogotg "GET /login/?login_only=1&user=misstogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user misstogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 19:34:03 +0000] info [cpaneld] 196.179.7.81 - root "POST /login HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.207.249
country_id: 1562822
description:
[2026-06-07 19:34:27 +0000] info [whostmgrd] 171.225.207.249 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:19-35.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  7 19:35:14 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.74.198
country_id: 6252001
description:
[2026-06-07 19:35:02 +0000] info [cpaneld] 217.181.74.198 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Grab Your Bonus in a Trice sepoladi.blogspot.cz rX||Email:nguyenthanson100197@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.129.93.230
country_id: 3508796
description:
2026-06-07 19:35:38 dovecot_plain authenticator failed for H=(rt6w9a5fkzmgom88) [38.129.93.230]:60432: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.124.110.9
country_id: 6252001
description:
[2026-06-07 19:34:59 +0000] info [cpaneld] 170.124.110.9 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-07 19:35:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:25077: 535 Incorrect authentication data (set_id=sahana)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.129.93.230
country_id: 3508796
description:
Jun  7 19:35:36 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.129.93.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.46.126.231
country_id: 6252001
description:
[2026-06-07 19:36:16 +0000] info [cpaneld] 209.46.126.231 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.174.28
country_id: 6252001
description:
[2026-06-07 19:36:38 +0000] info [cpaneld] 209.50.174.28 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.66.119.115
country_id: 3469034
description:
[2026-06-07 19:38:19 +0000] info [cpaneld] 200.66.119.115 - anrtogo "GET /login/?login_only=1&user=anrtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.141.26.55
country_id: 3996063
description:
[2026-06-07 19:38:29 +0000] info [cpaneld] 189.141.26.55 - anrtog "GET /login/?login_only=1&user=anrtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.158.9
country_id: 290557
description:
[2026-06-07 19:38:33 +0000] info [cpaneld] 176.205.158.9 - anrto "GET /login/?login_only=1&user=anrto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.108.126.243
country_id: 3469034
description:
[2026-06-07 19:38:38 +0000] info [cpaneld] 187.108.126.243 - anrt "GET /login/?login_only=1&user=anrt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrt (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.108.118.60
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fnfi-la-finance-inclusive-change-le-quotidien-des-togolais/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.72.3.183
country_id: 1168579
description:
2026-06-07 19:39:40 dovecot_plain authenticator failed for H=(Q3OS5) [103.72.3.183]:36738: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.103.112
country_id: 6252001
description:
[2026-06-07 19:47:14 +0000] info [whostmgrd] 82.40.103.112 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [07/Jun/2026:19:48:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132124&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbboxx-capital-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780861726 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bboxx-capital-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 19:48:19 ns5 pure-ftpd[4184407]: (?@196.179.7.81) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-07 19:49:11 +0000] info [cpaneld] 5.230.153.23 NEW marketplacenetma:CZhc4_E6OUDCPKJb address=5.230.153.23,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.166.9
country_id: 2750405
description:
2026-06-07 19:49:27 dovecot_plain authenticator failed for H=(YTA94269302) [104.28.166.9]:12662: 535 Incorrect authentication data (set_id=587)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.160.70
country_id: 3469034
description:
Jun  7 19:51:03 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.93.147.159
country_id: 298795
description:
[2026-06-07 19:52:30 +0000] info [whostmgrd] 91.93.147.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.227
country_id: 6290252
description:
Jun  7 19:53:26 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [07/Jun/2026:19:56:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200746&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780862186 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [07/Jun/2026:19:57:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131140&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fusage-du-telephone-portable-aux-heures-de-travail%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780862238 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/usage-du-telephone-portable-aux-heures-de-travail/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Immediately Get Your Cash bonotdamvam.blogspot.in nF||Email:stellamcdaniel802@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:19-58.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2026-06-07 20:00:37 +0000] info [cpaneld] 103.59.160.96 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.90.112
country_id: 6252001
description:
[2026-06-07 20:01:50 +0000] info [whostmgrd] 82.40.90.112 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.155
country_id: 1512440
description:
2026-06-07 20:01:54 H=([213.230.93.155]) [213.230.93.155]:55853 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 20:02:15 +0000] info [cpaneld] 196.179.7.81 - concours "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.172.236
country_id: 3017382
domain: arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:^)d*c%t7k7xjc!jm.arse.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  7 20:06:02 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.81.16
country_id: 6252001
description:
[2026-06-07 20:07:43 +0000] info [whostmgrd] 23.104.81.16 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.150.36.127
country_id: 6252001
description:
[2026-06-07 20:07:47 +0000] info [whostmgrd] 23.150.36.127 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [07/Jun/2026:20:08:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815143&pdata=http%253A%252F%252Fwww.24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780862894 HTTP/1.1" 302 0 www.24heureinfo.tg "http://www.24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.111.32
country_id: 3686110
description:
[2026-06-07 20:09:07 +0000] info [whostmgrd] 185.56.111.32 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.150.140.133
country_id: 6252001
description:
[2026-06-07 20:09:11 +0000] info [whostmgrd] 23.150.140.133 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.32.180
country_id: 6252001
description:
[2026-06-07 20:09:29 +0000] info [whostmgrd] 45.3.32.180 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.213.251.103
country_id: 1643084
description:
2026-06-07 20:10:27 H=([140.213.20.53]) [140.213.251.103]:62175 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.214.134
country_id: 3489940
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/donnee/3 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.80.63
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-usa-faure-gnassingbe-et-florizelle-liser-renforcent-le-partenariat-economique/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.68.10.226
country_id: 3017382
description:
[2026-06-07 20:12:57 +0000] info [cpaneld] 86.68.10.226 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.66.157.108
country_id: 3932488
description:
[2026-06-07 20:13:00 +0000] info [cpaneld] 181.66.157.108 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-07 20:13:05 +0000] info [cpaneld] 134.195.82.52 NEW vejjghdd:aokfebhOx8my4KEp address=134.195.82.52,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.86.38.125
country_id: 241170
description:
[2026-06-07 20:13:05 +0000] info [cpaneld] 41.86.38.125 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.250.130.199
country_id: 3996063
description:
[2026-06-07 20:13:07 +0000] info [cpaneld] 187.250.130.199 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.154.107
country_id: 3865483
description:
[2026-06-07 20:13:16 +0000] info [cpaneld] 181.26.154.107 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.56.152.243
country_id: 2510769
description:
[2026-06-07 20:15:39 +0000] info [cpaneld] 83.56.152.243 - conseilnsafto "GET /login/?login_only=1&user=conseilnsafto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsafto (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-07 20:15:11 dovecot_plain authenticator failed for H=(mu5a0s8con46wiyxxk) [27.73.209.71]:53243: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  7 20:15:09 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.78.27
country_id: 1512440
description:
[2026-06-07 20:15:18 +0000] info [cpaneld] 213.230.78.27 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.207.205.25
country_id: 290557
description:
[2026-06-07 20:15:51 +0000] info [cpaneld] 94.207.205.25 - conseilnsaf "GET /login/?login_only=1&user=conseilnsaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.190.100.175
country_id: 3932488
description:
[2026-06-07 20:15:54 +0000] info [cpaneld] 38.190.100.175 - conseilnsa "GET /login/?login_only=1&user=conseilnsa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseilnsa (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.18
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:163.198.108.18||TA:163.198.108.18||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.174.157
country_id: 2017370
description:
[2026-06-07 20:16:21 +0000] info [cpaneld] 95.24.174.157 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.138.214.13
country_id: 1210997
description:
[2026-06-07 20:16:03 +0000] info [cpaneld] 103.138.214.13 - conseiln "GET /login/?login_only=1&user=conseiln&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiln (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.113.210.134
country_id: 3895114
description:
[2026-06-07 20:16:08 +0000] info [cpaneld] 191.113.210.134 - consei "GET /login/?login_only=1&user=consei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user consei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.240.95
country_id: 1733045
description:
[2026-06-07 20:16:14 +0000] info [cpaneld] 27.125.240.95 - conse "GET /login/?login_only=1&user=conse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.159.205.110
country_id: 2017370
description:
[2026-06-07 20:16:26 +0000] info [cpaneld] 46.159.205.110 - conseil1 "GET /login/?login_only=1&user=conseil1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseil1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.32.137
country_id: 6252001
description:
[2026-06-07 20:17:34 +0000] info [cpaneld] 104.207.32.137 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.91.197
country_id: 6252001
description:
[2026-06-07 20:17:35 +0000] info [cpaneld] 23.104.91.197 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.9.209
country_id: 6252001
description:
[2026-06-07 20:17:35 +0000] info [cpaneld] 65.111.9.209 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.93.38.129
country_id: 6252001
description:
[2026-06-07 20:17:35 +0000] info [cpaneld] 3.93.38.129 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.91.212
country_id: 6252001
description:
[2026-06-07 20:17:35 +0000] info [cpaneld] 23.104.91.212 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.109.199
country_id: 6252001
description:
[2026-06-07 20:17:35 +0000] info [cpaneld] 82.40.109.199 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.101.193
country_id: 6252001
description:
[2026-06-07 20:17:35 +0000] info [cpaneld] 192.204.101.193 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.87.50
country_id: 6252001
description:
[2026-06-07 20:17:34 +0000] info [cpaneld] 82.40.87.50 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [07/Jun/2026:20:22:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644163&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780863752 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"47.251.188.82" CAPTCHA:"0" PEER:104.22.20.190


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Your Exceptional Reward bonotdamvam.blogspot.ae UD||Email:maheshbishwakarma9@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:20-23.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.37.187.104
country_id: 3469034
description:
[2026-06-07 20:23:34 +0000] info [whostmgrd] 177.37.187.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  7 20:23:46 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-07 20:23:48 dovecot_plain authenticator failed for H=(uf8ap6ucgkyv273q7ma9ormpa2dpqdl) [27.73.209.71]:49495: 535 Incorrect authentication data (set_id=belmonde.zossou@mesyscom.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 20:24:50 ns5 pure-ftpd[17344]: (?@196.179.7.81) [WARNING] Authentication failed for user [concours]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.211.24.182
country_id: 2921044
description:
[2026-06-07 20:26:16 +0000] info [whostmgrd] 92.211.24.182 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2026-06-07 20:29:10 +0000] info [cpaneld] 103.59.160.96 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.83.236
country_id: 6252001
description:
[2026-06-07 20:35:40 +0000] info [cpaneld] 82.40.83.236 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2026-06-07 20:37:34 +0000] info [cpaneld] 103.59.160.96 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.159.244.70
country_id: 192950
description:
2026-06-07 20:40:11 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [154.159.244.70]:56933: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2026-06-07 20:40:19 +0000] info [cpaneld] 103.59.160.96 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.116
country_id: 3175395
description:
Jun  7 20:41:33 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.217
country_id: 953987
description:
Jun  7 20:41:46 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.217
country_id: 953987
description:
Jun  7 20:41:53 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.202
country_id: 1512440
description:
2026-06-07 20:42:40 H=([84.54.70.202]) [84.54.70.202]:5922 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.175.248.21
country_id: 6252001
description:
Jun  7 20:42:45 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.175.248.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.241.196
country_id: 1733045
description:
[2026-06-07 20:42:13 +0000] info [whostmgrd] 27.125.241.196 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.175.248.21
country_id: 6252001
description:
2026-06-07 20:42:47 dovecot_plain authenticator failed for H=(68n8rtrivqmnnsu4511e0vrf) [23.175.248.21]:58817: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.0.242.204
country_id: 1819730
description:
49.0.242.204 - - [07/Jun/2026:20:43:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684333&pdata=https%253A%252F%252Flaunetogo.tg%252F17247-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780865000 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/17247-2/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.0.242.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.9
country_id: 2750405
description:
[2026-06-07 20:44:07 +0000] info [cpaneld] 104.28.166.9 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 20:45:12 +0000] info [cpaneld] 196.179.7.81 - enadamso "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2026-06-07 20:44:59 +0000] info [cpaneld] 103.59.160.96 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.150.44.129
country_id: 6252001
description:
[2026-06-07 20:47:10 +0000] info [whostmgrd] 23.150.44.129 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.53.144.60
country_id: 690791
description:
[2026-06-07 20:47:10 +0000] info [whostmgrd] 37.53.144.60 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.211.74.116
country_id: 2186224
description:
[2026-06-07 20:47:11 +0000] info [whostmgrd] 203.211.74.116 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.160.254
country_id: 6252001
description:
[2026-06-07 20:47:11 +0000] info [whostmgrd] 209.50.160.254 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.107.27.90
country_id: 2921044
description:
[2026-06-07 20:47:11 +0000] info [whostmgrd] 212.107.27.90 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.53.79
country_id: 6252001
description:
[2026-06-07 20:47:10 +0000] info [whostmgrd] 23.83.53.79 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.253.20.38
country_id: 3469034
description:
[2026-06-07 20:47:11 +0000] info [whostmgrd] 191.253.20.38 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.114.73.38
country_id: 1861060
description:
[2026-06-07 20:47:11 +0000] info [whostmgrd] 13.114.73.38 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:20-48.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Win Your Closed-and-Approved Prize bonotdamvam.blogspot.in 1b||Email:ernesto_martin00@hotmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.105.113.186
country_id: 3469034
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.105.113.186
country_id: 3469034
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.73.225
country_id: 2542007
domain: brmn.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66709.brmn.tg||ServerName:brmn.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa0d1d4e0d2a94d78a977aff8d1f553a095b5b1d||Title:i5i8ikzjrjwg652i0||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 20:55:59 +0000] info [cpaneld] 196.179.7.81 - e.carine "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 20:56:56 +0000] info [cpaneld] 196.179.7.81 - e.sanvee "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.69.108.86
country_id: 2542007
description:
[2026-06-07 20:58:14 +0000] info [whostmgrd] 105.69.108.86 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.173.172
country_id: 3996063
description:
46.250.173.172 - - [07/Jun/2026:20:58:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147494&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D4106&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780865892 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=4106" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.173.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.21.163
country_id: 6252001
description:
2026-06-07 21:00:56 dovecot_plain authenticator failed for H=(5v4ugug2tolwv6hvbailm5uc) [72.56.21.163]:42304: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.56.21.163
country_id: 6252001
description:
Jun  7 21:00:54 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.56.21.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [07/Jun/2026:21:02:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934020&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780866120 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 68.235.46.115
country_id: 6252001
domain: hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.39.162.72
country_id: 285570
description:
[2026-06-07 21:02:23 +0000] info [whostmgrd] 37.39.162.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [07/Jun/2026:21:03:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985063&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbruit-eleve-des-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780866226 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bruit-eleve-des-eglises/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [07/Jun/2026:21:02:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180903&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-lig%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780866175 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-lig/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.153.197.110
country_id: 1814991
description:
180.153.197.110 - - [07/Jun/2026:21:05:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790611&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252F7179%252Finternational%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780866314 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/7179/international/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.153.197.110


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.221.106
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-05.188.130.221.106||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-07 21:05:12 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:58266: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.43.66.64
country_id: 2510769
description:
[2026-06-07 21:05:15 +0000] info [whostmgrd] 193.43.66.64 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.184
country_id: 6252001
description:
[2026-06-07 21:07:51 +0000] info [cpaneld] 64.44.59.184 NEW wwayrzpl:lUDE_ePC6JFKdcR1 address=64.44.59.184,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
country_id: 290557
description:
Jun  7 21:10:52 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-06-07 21:10:54 dovecot_plain authenticator failed for H=(troerited) [80.227.147.94]:60617: 535 Incorrect authentication data (set_id=admin@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.102.101.248
country_id: 1269750
description:
Jun  7 21:11:23 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.102.101.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.226.17.197
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.12.40.35
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-celebre-66-ans-de-souverainete-par-une-grande-tournee-musicale/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [07/Jun/2026:21:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077335&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780866943 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=6" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.248.8
country_id: 1605651
description:
[2026-06-07 21:19:09 +0000] info [cpaneld] 216.26.248.8 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.26
country_id: 1562822
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-19.117.5.142.26||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [07/Jun/2026:21:20:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866328%26pdata=http://collation.ucao-uut.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1780867196 HTTP/1.1" 404 561 collation.ucao-uut.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:21:19:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866328&pdata=http%253A%252F%252Fcollation.ucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867196 HTTP/1.1" 302 0 collation.ucao-uut.tg "http://collation.ucao-uut.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.126.246
country_id: 6252001
description:
2026-06-07 21:20:49 dovecot_login authenticator failed for H=(ADMIN) [68.183.126.246]:57300: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [07/Jun/2026:21:20:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792099&pdata=http%253A%252F%252Fcollation.ucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867200 HTTP/1.1" 302 0 collation.ucao-uut.tg "http://collation.ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:21:20:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262379&pdata=https%253A%252F%252Fcollation.ucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867217 HTTP/2.0" 302 0 collation.ucao-uut.tg "https://collation.ucao-uut.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.126.246
country_id: 6252001
description:
Jun  7 21:20:47 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.183.126.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 21:22:17 +0000] info [cpaneld] 196.179.7.81 - wifizoneuser "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  7 21:22:06 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-07 21:22:08 dovecot_plain authenticator failed for H=(idlz4c7a22h47ikmnl) [27.73.209.71]:48339: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.255.160
country_id: 3865483
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.255.160
country_id: 3865483
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 1.92.197.155
country_id: 1814991
description:
1.92.197.155 - - [07/Jun/2026:21:25:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854254&pdata=https%253A%252F%252Fvitrinenews.tg%252Fpage%252F14%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867553 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/page/14/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:1.92.197.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-07 21:26:40 +0000] info [whostmgrd] 157.66.56.227 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID exf4wt) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-07 21:26:48 +0000] info [whostmgrd] 157.66.56.227 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-07 21:26:52 +0000] info [cpaneld] 157.66.56.227 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN cpaneld: openid connect: 'cpaneld' provider 'cpanelid' encountered an error: (XID yy48aj) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “cpaneld”.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:21:27:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7325033&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867629 HTTP/1.1" 302 0 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:21:27:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185067&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867659 HTTP/1.1" 404 561 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.164.217
country_id: 6252001
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/uploads/images/246.png HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.31.25.250
country_id: 6252001
description:
2026-06-07 21:28:40 dovecot_plain authenticator failed for H=(o5cp0l890lu9vxo581lc7ya) [64.31.25.250]:43962: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.158.231
country_id: 1819730
description:
159.138.158.231 - - [07/Jun/2026:21:29:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055273&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867770 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.158.231


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.102.45
country_id: 1562822
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/office365 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.102.45
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/office365 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 21:30:16 ns5 pure-ftpd[66951]: (?@196.179.7.81) [WARNING] Authentication failed for user [enadamso]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-06-07 21:31:39 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:56240: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
country_id: 2017370
description:
Jun  7 21:31:37 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.213.157.79
country_id: 6252001
description:
[2026-06-07 21:32:36 +0000] info [cpaneld] 129.213.157.79 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:21:32:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581654&pdata=http%253A%252F%252Fsbvdn6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780867915 HTTP/1.1" 404 561 sbvdn6.mediatopnews.tg "http://sbvdn6.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.126.246
country_id: 6252001
description:
2026-06-07 21:35:58 dovecot_login authenticator failed for H=(ADMIN) [68.183.126.246]:40458: 535 Incorrect authentication data (set_id=kevin.k@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:21:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7434394&pdata=http%253A%252F%252Fowuls2.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780868235 HTTP/1.1" 302 0 owuls2.mediatopnews.tg "http://owuls2.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:21:38:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853579&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780868297 HTTP/1.1" 404 561 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.166.9
country_id: 2750405
description:
2026-06-07 21:39:09 dovecot_plain authenticator failed for H=(YTA94269302) [104.28.166.9]:12715: 535 Incorrect authentication data (set_id=587)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.124
country_id: 3469034
description:
Jun  7 21:39:54 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.124
country_id: 3469034
description:
2026-06-07 21:39:56 dovecot_plain authenticator failed for H=(be2gny8ib61tacp8oi) [200.174.198.124]:32327: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.235.79.4
country_id: 298795
description:
[2026-06-07 21:41:00 +0000] info [whostmgrd] 88.235.79.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.226.219
country_id: 6252001
description:
[2026-06-07 21:41:57 +0000] info [cpaneld] 216.26.226.219 - heroes "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 21:44:52 ns5 pure-ftpd[78533]: (?@196.179.7.81) [WARNING] Authentication failed for user [e.carine]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 21:46:04 ns5 pure-ftpd[79689]: (?@196.179.7.81) [WARNING] Authentication failed for user [e.sanvee]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.9
country_id: 2750405
description:
[2026-06-07 21:47:28 +0000] info [cpaneld] 104.28.166.9 - zsfyjiji "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 104.28.166.9
country_id: 2750405
description:
[2026-06-07 21:47:32 +0000] info [cpaneld] 104.28.166.9 - ruuwezvf "GET /frontend/jupiter/security/two_factor_auth/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.50.204.254
country_id: 3658394
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/carlbro/pages/doc2/index.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.50.204.254
country_id: 3658394
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/carlbro/pages/doc2/index.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.31.25.250
country_id: 6252001
description:
2026-06-07 21:52:52 dovecot_plain authenticator failed for H=(npbch7eylltkrm4j7az) [64.31.25.250]:49592: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  7 21:54:23 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.82.151.45
country_id: 3469034
description:
[2026-06-07 21:55:22 +0000] info [cpaneld] 170.82.151.45 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.187.224.61
country_id: 3996063
description:
[2026-06-07 21:55:28 +0000] info [cpaneld] 187.187.224.61 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.131.237.205
country_id: 3996063
description:
[2026-06-07 21:55:46 +0000] info [cpaneld] 201.131.237.205 - davetec2 "GET /login/?login_only=1&user=davetec2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetec2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.45.49
country_id: 1733045
description:
[2026-06-07 21:55:00 +0000] info [cpaneld] 180.75.45.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.145.201
country_id: 294640
description:
[2026-06-07 21:55:18 +0000] info [cpaneld] 79.177.145.201 - davetec "GET /login/?login_only=1&user=davetec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.195.95.200
country_id: 2510769
description:
[2026-06-07 21:55:30 +0000] info [cpaneld] 213.195.95.200 - dave "GET /login/?login_only=1&user=dave&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dave (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.167.183.73
country_id: 102358
description:
[2026-06-07 21:55:33 +0000] info [cpaneld] 82.167.183.73 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.91.145.49
country_id: 953987
description:
[2026-06-07 21:55:43 +0000] info [cpaneld] 197.91.145.49 - davetec1 "GET /login/?login_only=1&user=davetec1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetec1 (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.15
country_id: 690791
description:
2026-06-07 21:56:56 H=([77.83.39.15]) [77.83.39.15]:52642 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<root@mail.niiao.ru> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.76.248.5
country_id: 6252001
description:
[2026-06-07 21:59:49 +0000] info [cpaneld] 45.76.248.5 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-00.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.213.172.147
country_id: 3017382
description:
[2026-06-07 22:00:24 +0000] info [whostmgrd] 62.213.172.147 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Easy-to-Use Extra vamvozmviigr.blogspot.ie pl||Email:agabajohnbosco24@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.110.164
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:163.198.110.164||TA:163.198.110.164||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 37.204.54.123
country_id: 2017370
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.163 Mobile Safari/537.36 SamsungBrowser/26.0||MV:/wp-json/wp/v2/users/me||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.95.28
country_id: 1814991
description:
Jun  7 22:01:29 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.95.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.196.95.28
country_id: 1814991
description:
2026-06-07 22:01:31 dovecot_plain authenticator failed for H=(rj3skcdn2jt0epeq9bwdil186fzsn) [139.196.95.28]:33646: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.72
country_id: 690791
description:
Jun  7 22:06:30 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun  7 22:06:37 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun  7 22:06:14 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jun  7 22:07:45 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun  7 22:07:49 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jun  7 22:07:52 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.26
country_id: 6252001
description:
[2026-06-07 22:09:33 +0000] info [cpaneld] 45.38.17.26 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.4.209
country_id: 1527747
description:
2026-06-07 22:13:32 H=([212.241.4.209]) [212.241.4.209]:21679 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.26
country_id: 6252001
description:
[2026-06-07 22:16:08 +0000] info [whostmgrd] 45.38.17.26 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.226.52.110
country_id: 1269750
description:
Jun  7 22:18:36 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.226.52.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  7 22:20:02 ns5 pure-ftpd[103716]: (?@196.179.7.81) [WARNING] Authentication failed for user [wifizoneuser]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.26
country_id: 6252001
description:
[2026-06-07 22:20:11 +0000] info [cpaneld] 45.38.17.26 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 138.84.54.118
country_id: 3996063
domain: www.gatti.free.netmaster.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ayety.www.gatti.free.netmaster.tg||ServerName:www.gatti.free.netmaster.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.86.204.118
country_id: 3469034
domain: gatti.free.netmaster.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ayety.gatti.free.netmaster.tg||ServerName:gatti.free.netmaster.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Unlock Your Snug Games sepoladi.blogspot.ru mq||Email:being.sebi20@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.175.94
country_id: 3996063
description:
46.250.175.94 - - [07/Jun/2026:22:25:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867974&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fpaged%253D332%2526author%253D2&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780871099 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?paged=332&author=2" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.175.94


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-07 22:27:45 +0000] info [cpaneld] 64.44.62.240 NEW libertepansel:xM4Tq_S57U8sgHb3 address=64.44.62.240,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.172
country_id: 3469034
description:
Jun  7 22:29:39 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.172
country_id: 3469034
description:
Jun  7 22:29:54 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.9
country_id: 2750405
description:
[2026-06-07 22:32:09 +0000] info [cpaneld] 104.28.166.9 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.86.134
country_id: 6252001
description:
[2026-06-07 22:34:04 +0000] info [cpaneld] 82.40.86.134 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.68
country_id: 2395170
description:
Jun  7 22:34:09 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.68 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 165.231.121.147
country_id: 3144096
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:165.231.121.147||TA:165.231.121.147||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  7 22:41:29 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-07 22:41:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:59596: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.42.224.229
country_id: 6252001
description:
Jun  7 22:42:38 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.42.224.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.182.147.97
country_id: 6252001
description:
Jun  7 22:42:48 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.182.147.97 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:22:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170148&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780872277 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:22:44:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132165&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780872285 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:22:45:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039688&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780872323 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:22:45:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738133&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780872299 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-47.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.56.146
country_id: 6252001
description:
[2026-06-07 22:47:17 +0000] info [cpaneld] 23.83.56.146 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Digital Holding Reward eropolik.blogspot.ru 6F||Email:matija08vuk@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-07 22:48:05 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:11693: 535 Incorrect authentication data (set_id=yangjun)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  7 22:48:03 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.20.166
country_id: 2361809
description:
2026-06-07 22:50:15 dovecot_plain authenticator failed for H=(V4836VC8A) [102.23.20.166]:50181: 535 Incorrect authentication data (set_id=b.blaodekissi@ese2i.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 196.207.222.138
country_id: 2245662
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.nsiassurancestogo.com||User:egjvuiox||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.222.138
country_id: 2245662
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.nsiassurancestogo.com HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.242
country_id: 3469034
description:
Jun  7 22:50:51 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.22
country_id: 1269750
description:
Jun  7 22:51:12 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.36.6
country_id: 1605651
description:
[2026-06-07 22:52:34 +0000] info [cpaneld] 184.22.36.6 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.91.248.82
country_id: 2921044
description:
[2026-06-07 22:52:29 +0000] info [cpaneld] 95.91.248.82 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.91
country_id: 99237
description:
[2026-06-07 22:52:38 +0000] info [cpaneld] 212.237.121.91 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 22:51:51 +0000] info [cpaneld] 196.179.7.81 - a.kesso "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.207
country_id: 3469034
description:
Jun  7 22:52:53 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.45.172
country_id: 6252001
description:
[2026-06-07 22:52:58 +0000] info [cpaneld] 104.207.45.172 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  7 22:54:10 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-07 22:54:12 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:63833: 535 Incorrect authentication data (set_id=xxx)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  7 22:56:23 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-07 22:57:01 +0000] info [cpaneld] 5.175.229.179 NEW hgfdcvbnk:JcNVUAPt7k3Yuqih address=5.175.229.179,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun  7 22:57:04 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.166
country_id: 1269750
description:
Jun  7 22:58:09 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.166 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [07/Jun/2026:22:58:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117676&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780873117 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.56.28.27
country_id: 6252001
description:
[2026-06-07 23:00:04 +0000] info [whostmgrd] 193.56.28.27 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  7 23:00:25 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-07 23:00:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:36771: 535 Incorrect authentication data (set_id=pulse)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  7 23:00:37 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun  7 23:01:12 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-06-07 23:01:14 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:55434: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.117.0.29
country_id: 2750405
description:
[2026-06-07 23:01:48 +0000] info [webmaild] 185.117.0.29 - ccit@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.78.44.42
country_id: 2017370
description:
[2026-06-07 23:02:39 +0000] info [cpaneld] 178.78.44.42 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.53.96.37
country_id: 3686110
description:
[2026-06-07 23:02:10 +0000] info [cpaneld] 181.53.96.37 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.62.25.136
country_id: 1733045
description:
[2026-06-07 23:02:15 +0000] info [cpaneld] 182.62.25.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.239.190.114
country_id: 3895114
description:
[2026-06-07 23:02:19 +0000] info [cpaneld] 170.239.190.114 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.158.139.178
country_id: 3017382
description:
[2026-06-07 23:02:37 +0000] info [cpaneld] 176.158.139.178 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.29.197.229
country_id: 2017370
description:
[2026-06-07 23:02:22 +0000] info [cpaneld] 31.29.197.229 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.217.140.81
country_id: 2542007
description:
[2026-06-07 23:02:24 +0000] info [cpaneld] 196.217.140.81 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.16.39
country_id: 2542007
description:
[2026-06-07 23:02:26 +0000] info [cpaneld] 196.115.16.39 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.89.64.49
country_id: 3469034
description:
[2026-06-07 23:02:32 +0000] info [cpaneld] 187.89.64.49 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.22.246.47
country_id: 3469034
description:
[2026-06-07 23:02:35 +0000] info [cpaneld] 191.22.246.47 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [07/Jun/2026:23:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986917&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbruit-eleve-des-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780873403 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bruit-eleve-des-eglises/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [07/Jun/2026:23:04:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685403&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbruit-eleve-des-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780873445 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bruit-eleve-des-eglises/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.160.153
country_id: 2363686
description:
[2026-06-07 23:05:14 +0000] info [cpaneld] 102.64.160.153 NEW fhmqxwla:6zux6bdlH_fO_cTm address=102.64.160.153,app=cpaneld,creator=fhmqxwla,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-07 23:05:02 +0000] info [webmaild] 196.171.46.177 - jwanta@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.180.77.19
country_id: 3017382
description:
88.180.77.19 - - [07/Jun/2026:23:09:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6582471&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F05%252F26%252Fpharmacies-de-garde-semaine-du-25-mai-au-1er-juin-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780873749 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/05/26/pharmacies-de-garde-semaine-du-25-mai-au-1er-juin-2026/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.180.77.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.239
country_id: 6252001
description:
2026-06-07 23:09:39 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.239]:17296: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.245.236.66
country_id: 6252001
description:
91.245.236.66 - - [07/Jun/2026:23:10:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067463&pdata=https%253A%252F%252Fbelali.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780873826 HTTP/2.0" 302 0 belali.tg "https://belali.tg/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.37" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.245.236.66


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [07/Jun/2026:23:10:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051928&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780873850 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.176.99.252
country_id: 798549
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:193.176.99.252||TA:193.176.99.252||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [07/Jun/2026:23:13:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235686&pdata=http%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780874023 HTTP/1.1" 302 0 appflutter.free.netmaster.tg "http://appflutter.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.143.145
country_id: 6252001
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/uploads/images/449.png HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.169.230
country_id: 6252001
description:
[2026-06-07 23:20:40 +0000] info [cpaneld] 209.50.169.230 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.101.54.254
country_id: 1880251
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/uploads/images/659.png HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.180
country_id: 3469034
description:
Jun  7 23:24:35 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.34.9.33
country_id: 1282988
description:
[2026-06-07 23:26:09 +0000] info [cpaneld] 110.34.9.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.188.244.117
country_id: 337996
description:
[2026-06-07 23:26:13 +0000] info [cpaneld] 196.188.244.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [07/Jun/2026:23:26:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738090&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780874781 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.222
country_id: 3469034
description:
Jun  7 23:25:53 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.238.190.156
country_id: 3996063
description:
[2026-06-07 23:26:17 +0000] info [cpaneld] 45.238.190.156 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.68.59.61
country_id: 298795
description:
[2026-06-07 23:26:25 +0000] info [cpaneld] 212.68.59.61 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.211.255.200
country_id: 102358
description:
[2026-06-07 23:26:35 +0000] info [cpaneld] 51.211.255.200 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.163.67
country_id: 3017382
description:
[2026-06-07 23:26:37 +0000] info [cpaneld] 37.65.163.67 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.152.239
country_id: 6252001
description:
Jun  7 23:29:28 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.152.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.239
country_id: 6252001
description:
2026-06-07 23:29:30 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.239]:44170: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.243.245.4
country_id: 3996063
description:
2026-06-07 23:30:11 dovecot_plain authenticator failed for H=([10.5.0.2]) [104.243.245.4]:1239: 535 Incorrect authentication data (set_id=executive@auditeccandco.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.193.67.222
country_id: 3017382
description:
2026-06-07 23:31:54 dovecot_login authenticator failed for H=cust-east-par-46-193-67-222.cust.wifirst.net (ccit.tg) [46.193.67.222]:8903: 535 Incorrect authentication data (set_id=l.amegee@ccit.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.83.114.68
country_id: 6252001
domain: cfpj.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:23:33:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103381&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780875189 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.248.128
country_id: 3608932
description:
2026-06-07 23:33:52 dovecot_plain authenticator failed for H=([10.5.0.2]) [31.217.248.128]:14679: 535 Incorrect authentication data (set_id=executive@auditeccandco.com)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Use Your Free-to-Play Credit vamvozmviigr.blogspot.tw ZR||Email:janeab@cox.net||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-34.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.248.128
country_id: 3608932
description:
2026-06-07 23:33:58 dovecot_login authenticator failed for H=([10.5.0.2]) [31.217.248.128]:14679: 535 Incorrect authentication data (set_id=executive@auditeccandco.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:23:34:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933979&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780875240 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.122.60.77
country_id: 2017370
description:
[2026-06-07 23:35:44 +0000] info [cpaneld] 91.122.60.77 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.191.93
country_id: 3658394
description:
[2026-06-07 23:35:48 +0000] info [cpaneld] 157.100.191.93 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.200.125
country_id: 3437598
description:
[2026-06-07 23:35:39 +0000] info [cpaneld] 186.158.200.125 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.32.51.18
country_id: 953987
description:
[2026-06-07 23:35:42 +0000] info [cpaneld] 102.32.51.18 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-07 23:35:38 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49890: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.158.91.48
country_id: 3017382
description:
[2026-06-07 23:36:00 +0000] info [cpaneld] 92.158.91.48 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.233.31.33
country_id: 3865483
description:
[2026-06-07 23:36:05 +0000] info [cpaneld] 170.233.31.33 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.84.88.72
country_id: 3686110
description:
[2026-06-07 23:35:54 +0000] info [cpaneld] 186.84.88.72 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 59.153.224.87
country_id: 1562822
description:
[2026-06-07 23:35:58 +0000] info [cpaneld] 59.153.224.87 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:23:37:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186182&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780875451 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.69.155
country_id: 3895114
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2024/07/29/un-petrolier-battant-pavillon-togolais-intercepte-en-iran/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:23:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314887&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780875456 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.57.34
country_id: 2921044
description:
[2026-06-07 23:36:51 +0000] info [cpaneld] 104.207.57.34 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:23:38:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854296&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780875497 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.204.66.184
country_id: 1814991
description:
116.204.66.184 - - [07/Jun/2026:23:38:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724200&pdata=http%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D7147&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780875518 HTTP/1.1" 302 0 mediatopnews.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/26.4 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.204.66.184


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.193.127.132
country_id: 953987
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/48eme-edition-de-lassemblee-generale-annuelle-de-la-fanaf HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  7 23:43:34 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 192.253.248.23
country_id: 130758
description:
Jun  7 23:44:32 ns5 pure-ftpd[166440]: (?@192.253.248.23) [WARNING] Authentication failed for user [conseilnsaftogo]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.154
country_id: 3077311
description:
Jun  7 23:45:38 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.154
country_id: 3077311
description:
Jun  7 23:45:51 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 192.253.248.18
country_id: 130758
description:
Jun  7 23:48:18 ns5 pure-ftpd[169340]: (?@192.253.248.18) [WARNING] Authentication failed for user [togocarrieretsevie]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.215
country_id: 3469034
description:
Jun  7 23:49:07 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.86.104
country_id: 690791
description:
Jun  7 23:49:26 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.86.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.118.11
country_id: 6252001
description:
[2026-06-07 23:51:18 +0000] info [cpaneld] 76.38.118.11 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.34.67
country_id: 2635167
description:
[2026-06-07 23:55:57 +0000] info [cpaneld] 77.68.34.67 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.29
country_id: 3469034
description:
Jun  7 23:56:04 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.1
country_id: 3469034
description:
Jun  7 23:56:22 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.72
country_id: 3865483
description:
Jun  7 23:56:28 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.221.164
country_id: 294640
description:
[2026-06-07 23:57:47 +0000] info [cpaneld] 147.235.221.164 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.162.128
country_id: 3996063
description:
[2026-06-07 23:57:50 +0000] info [cpaneld] 187.190.162.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.34.67
country_id: 2635167
description:
[2026-06-07 23:56:59 +0000] info [cpaneld] 77.68.34.67 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.255.16.151
country_id: 2017370
description:
[2026-06-07 23:58:13 +0000] info [cpaneld] 87.255.16.151 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.0.194.20
country_id: 2921044
description:
[2026-06-07 23:58:46 +0000] info [cpaneld] 176.0.194.20 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.195.28.57
country_id: 6251999
description:
[2026-06-07 23:58:01 +0000] info [cpaneld] 15.195.28.57 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-58.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.234.210.11
country_id: 3686110
description:
[2026-06-07 23:58:43 +0000] info [cpaneld] 181.234.210.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.79.80.121
country_id: 3469034
description:
[2026-06-07 23:57:54 +0000] info [cpaneld] 170.79.80.121 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.115.59
country_id: 2017370
description:
[2026-06-07 23:58:03 +0000] info [cpaneld] 95.26.115.59 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.112.93
country_id: 3658394
description:
[2026-06-07 23:57:59 +0000] info [cpaneld] 131.196.112.93 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.251.184.204
country_id: 1522867
description:
[2026-06-07 23:58:15 +0000] info [cpaneld] 5.251.184.204 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Carefully Selected Prize Bundle eropolik.blogspot.jp SO||Email:rafaallure@outlook.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.226.207.160
country_id: 3469034
description:
[2026-06-07 23:58:08 +0000] info [cpaneld] 38.226.207.160 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.183.122
country_id: 3865483
description:
[2026-06-07 23:59:20 +0000] info [cpaneld] 153.67.183.122 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.176.56.4
country_id: 3624060
description:
[2026-06-07 23:59:24 +0000] info [cpaneld] 186.176.56.4 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.64.172.81
country_id: 3625428
description:
[2026-06-07 23:59:30 +0000] info [cpaneld] 38.64.172.81 - togoint2 "GET /login/?login_only=1&user=togoint2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.31.98.207
country_id: 2635167
description:
[2026-06-07 23:59:10 +0000] info [cpaneld] 86.31.98.207 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.228.119.233
country_id: 2017370
description:
[2026-06-07 23:59:13 +0000] info [cpaneld] 46.228.119.233 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.175.221
country_id: 3658394
description:
[2026-06-07 23:59:17 +0000] info [cpaneld] 45.228.175.221 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.193.125
country_id: 2510769
description:
[2026-06-07 23:58:54 +0000] info [cpaneld] 79.117.193.125 - togointeri "GET /login/?login_only=1&user=togointeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointeri (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.84.70
country_id: 3865483
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.gtaassurancesvie.tg HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:00:04:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722718&pdata=http%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877079 HTTP/1.1" 302 0 tontonedouard-togo.com "http://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:00:05:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13091784&pdata=https%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877104 HTTP/2.0" 404 561 tontonedouard-togo.com "https://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [08/Jun/2026:00:05:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247768&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877115 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:00:05:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932372&pdata=http%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877126 HTTP/1.1" 302 0 tontonedouard-togo.com "http://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:00:05:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7299272&pdata=https%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877130 HTTP/2.0" 302 0 tontonedouard-togo.com "https://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.224.52
country_id: 6252001
description:
[2026-06-08 00:05:48 +0000] info [cpaneld] 216.26.224.52 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:00:04:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315719&pdata=https%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877087 HTTP/2.0" 404 561 tontonedouard-togo.com "https://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:00:06:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802601&pdata=https%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877162 HTTP/2.0" 302 0 tontonedouard-togo.com "https://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [08/Jun/2026:00:10:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934741&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-voleurs-de-motos-demantele-a-zanguera%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877441 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-voleurs-de-motos-demantele-a-zanguera/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [08/Jun/2026:00:09:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-voleurs-de-motos-demantele-a-zanguera%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877390 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-voleurs-de-motos-demantele-a-zanguera/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [08/Jun/2026:00:09:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13066849&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbac-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877395 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bac-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [08/Jun/2026:00:10:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870747&pdata=http%253A%252F%252Fwww.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877404 HTTP/1.1" 302 0 www.kpmg.tg "http://www.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.173.3
country_id: 2363686
description:
102.64.173.3 - - [08/Jun/2026:00:11:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081491&pdata=https%253A%252F%252Fcpanel.cfpj.tg%252F%253Flocale%253Dth&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877486 HTTP/2.0" 302 0 cpanel.cfpj.tg "https://www.google.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/128.0.6613.98 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.173.3


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-08 00:11:12 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:36182: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-08 00:13:22 +0000] info [cpaneld] 196.179.7.81 - Turbolte "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [08/Jun/2026:00:13:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593938&pdata=http%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877623 HTTP/1.1" 302 0 appflutter.free.netmaster.tg "http://appflutter.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  8 00:14:42 ns5 pure-ftpd[187671]: (?@196.179.7.81) [WARNING] Authentication failed for user [a.kesso]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-08 00:14:01 +0000] info [whostmgrd] 157.66.56.227 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID jd8xnr) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-08 00:14:04 +0000] info [whostmgrd] 157.66.56.227 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [08/Jun/2026:00:16:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168665&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877768 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.138.61.153
country_id: 1814991
description:
2026-06-08 00:16:22 H=([0.0.0.0]) [183.138.61.153]:64908 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [08/Jun/2026:00:16:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301780&pdata=http%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877797 HTTP/1.1" 302 0 appflutter.free.netmaster.tg "http://appflutter.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [08/Jun/2026:00:16:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987272&pdata=http%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877803 HTTP/1.1" 302 0 appflutter.free.netmaster.tg "http://appflutter.free.netmaster.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.158.45
country_id: 6252001
description:
[2026-06-08 00:19:43 +0000] info [cpaneld] 47.148.158.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.252.144.184
country_id: 1210997
description:
[2026-06-08 00:19:49 +0000] info [cpaneld] 138.252.144.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.106.221.231
country_id: 3595528
description:
2026-06-08 00:19:29 H=([0.0.0.0]) [190.106.221.231]:63600 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.42
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.793664376845859.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.116.150.69
country_id: 3895114
description:
[2026-06-08 00:20:05 +0000] info [cpaneld] 191.116.150.69 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.190.9.163
country_id: 298795
description:
[2026-06-08 00:20:07 +0000] info [cpaneld] 78.190.9.163 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.250.200.107
country_id: 294640
description:
[2026-06-08 00:20:15 +0000] info [cpaneld] 85.250.200.107 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.161.117.106
country_id: 2510769
description:
[2026-06-08 00:19:53 +0000] info [cpaneld] 147.161.117.106 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: cl_dos
name: DOS detection
abuser: 34.185.214.41
country_id: 2921044
description:
2026-06-08 00:20:12.469242732 +0000 GMT m=+242727.266353521 Denial of Service attack was discovered from 34.185.214.41, on port 443. Open connections: 269


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.100.206.148
country_id: 1269750
domain: www.sp-eau.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/frontend/.env.backup||User:doufelg||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.124.52.119
country_id: 3437598
description:
[2026-06-08 00:19:59 +0000] info [cpaneld] 181.124.52.119 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.89.159.171
country_id: 2542007
description:
[2026-06-08 00:19:51 +0000] info [cpaneld] 196.89.159.171 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-08 00:19:59 +0000] info [cpaneld] 5.230.133.110 NEW zauwogvk:mwHYBx2r_z52R2QV address=5.230.133.110,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.239.180.243
country_id: 1694008
description:
[2026-06-08 00:20:02 +0000] info [cpaneld] 136.239.180.243 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.14.143.92
country_id: 3595528
description:
2026-06-08 00:21:10 H=([0.0.0.0]) [190.14.143.92]:28818 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: cl_dos
name: DOS detection
abuser: 34.185.214.41
country_id: 2921044
description:
2026-06-08 00:21:13.217346705 +0000 GMT m=+242788.014457394 Denial of Service attack was discovered from 34.185.214.41, on port 443. Open connections: 269


plugin: cl_dos
name: DOS detection
abuser: 34.185.214.41
country_id: 2921044
description:
2026-06-08 00:22:14.028761949 +0000 GMT m=+242848.825872738 Denial of Service attack was discovered from 34.185.214.41, on port 443. Open connections: 269


plugin: cl_dos
name: DOS detection
abuser: 34.185.214.41
country_id: 2921044
description:
2026-06-08 00:23:14.726542195 +0000 GMT m=+242909.523652884 Denial of Service attack was discovered from 34.185.214.41, on port 443. Open connections: 269


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.106.221.231
country_id: 3595528
description:
2026-06-08 00:24:10 H=([0.0.0.0]) [190.106.221.231]:63632 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: cl_dos
name: DOS detection
abuser: 34.185.214.41
country_id: 2921044
description:
2026-06-08 00:24:15.388644899 +0000 GMT m=+242970.185755688 Denial of Service attack was discovered from 34.185.214.41, on port 443. Open connections: 269


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.14.143.92
country_id: 3595528
description:
2026-06-08 00:23:57 H=([0.0.0.0]) [190.14.143.92]:28815 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.100.206.148
country_id: 1269750
domain: www.sp-eau.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:doufelg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.235.68.84
country_id: 1562822
description:
2026-06-08 00:26:14 dovecot_plain authenticator failed for H=(15WC133) [14.235.68.84]:58663: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.171.105
country_id: 6252001
description:
[2026-06-08 00:30:47 +0000] info [cpaneld] 163.5.171.105 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.245.240.235
country_id: 953987
domain: vo2.mairie.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vo2.mairie.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.151.74
country_id: 1880251
domain: dagl.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/communes/www.lomegolfe3.com||User:myxlsnta||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.12.84.48
country_id: 2750405
domain: mail.monde-ai.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-08 00:31:13 +0000] info [cpaneld] 173.211.89.232 NEW elmkvzcm:EPkopBTbfXIdq9kk address=173.211.89.232,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.110.15.207
country_id: 3469034
domain: pnls.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Kisiniov@msn.com.pnls.tg||ServerName:pnls.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.26.43.67
country_id: 2635167
domain: www.pnls.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Kisiniov@msn.com.www.pnls.tg||ServerName:www.pnls.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.206.235.56
country_id: 1814991
description:
140.206.235.56 - - [08/Jun/2026:00:34:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275687&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F01%252F10%252Finternet-society-togo-un-nouveau-ca-pour-consolider-les-acquis-et-connecter-davantage-de-localites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780878851 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/01/10/internet-society-togo-un-nouveau-ca-pour-consolider-les-acquis-et-connecter-davantage-de-localites/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.4 Mobile/15A372 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.206.235.56


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.225.176.87
country_id: 3996063
description:
2026-06-08 00:34:17 dovecot_plain authenticator failed for H=([91.92.243.93]) [177.225.176.87]:55250: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.101.75
country_id: 3895114
description:
2026-06-08 00:34:32 dovecot_plain authenticator failed for H=([91.92.243.93]) [186.189.101.75]:5360: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.7.38
country_id: 1522867
description:
2026-06-08 00:35:50 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.130.7.38]:1725: 535 Incorrect authentication data (set_id=financeiro@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.70.142.239
country_id: 3686110
description:
2026-06-08 00:35:36 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.70.142.239]:52454: 535 Incorrect authentication data (set_id=contacto@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.231.187.169
country_id: 3469034
description:
2026-06-08 00:34:52 dovecot_plain authenticator failed for H=([91.92.243.93]) [170.231.187.169]:59340: 535 Incorrect authentication data (set_id=marketing@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.205.174
country_id: 3996063
description:
2026-06-08 00:35:06 dovecot_plain authenticator failed for H=fixed-189-203-205-174.totalplay.net ([91.92.243.93]) [189.203.205.174]:39316: 535 Incorrect authentication data (set_id=contact@togointerim.net)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.19
country_id: 6252001
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.599991396425602.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-08 00:35:16 +0000] info [cpaneld] 5.230.153.167 NEW nerohostfreenetm:p5S8V1ro77Lk3_Kr address=5.230.153.167,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.235.103.33
country_id: 102358
description:
2026-06-08 00:35:21 dovecot_plain authenticator failed for H=([91.92.243.93]) [51.235.103.33]:3951: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.113.208.30
country_id: 2017370
description:
2026-06-08 00:36:04 dovecot_plain authenticator failed for H=([91.92.243.93]) [37.113.208.30]:59823: 535 Incorrect authentication data (set_id=comercial@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.145.57.99
country_id: 2017370
description:
2026-06-08 00:36:18 dovecot_plain authenticator failed for H=pppoe-185-145-57-099.prtcom.ru ([91.92.243.93]) [185.145.57.99]:47430: 535 Incorrect authentication data (set_id=it@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.168
country_id: 1733045
description:
2026-06-08 00:36:34 dovecot_plain authenticator failed for H=([91.92.243.93]) [113.211.215.168]:23989: 535 Incorrect authentication data (set_id=accounts@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.70.120
country_id: 290557
description:
2026-06-08 00:36:51 dovecot_plain authenticator failed for H=([91.92.243.93]) [91.74.70.120]:37591: 535 Incorrect authentication data (set_id=suporte@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.7.38
country_id: 1522867
description:
2026-06-08 00:35:57 dovecot_login authenticator failed for H=([91.92.243.93]) [45.130.7.38]:1725: 535 Incorrect authentication data (set_id=financeiro@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.120.152
country_id: 99237
description:
2026-06-08 00:37:20 dovecot_plain authenticator failed for H=([91.92.243.93]) [212.237.120.152]:28839: 535 Incorrect authentication data (set_id=office@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.103.253.106
country_id: 3865483
description:
2026-06-08 00:37:41 dovecot_plain authenticator failed for H=([91.92.243.93]) [190.103.253.106]:34673: 535 Incorrect authentication data (set_id=ventas@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.70.120
country_id: 290557
description:
2026-06-08 00:36:59 dovecot_login authenticator failed for H=([91.92.243.93]) [91.74.70.120]:37591: 535 Incorrect authentication data (set_id=suporte@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.6.243.102
country_id: 6254930
description:
2026-06-08 00:37:06 dovecot_plain authenticator failed for H=([91.92.243.93]) [213.6.243.102]:47808: 535 Incorrect authentication data (set_id=hr@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.107.191.167
country_id: 3686110
description:
2026-06-08 00:38:13 dovecot_plain authenticator failed for H=([91.92.243.93]) [191.107.191.167]:34368: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.118.51
country_id: 1643084
description:
2026-06-08 00:37:58 dovecot_plain authenticator failed for H=([91.92.243.93]) [103.172.118.51]:51766: 535 Incorrect authentication data (set_id=clients@togointerim.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.185.197.33
country_id: 2921044
domain: mail.monde-ai.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:hgfdcvbnk||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.186.234.195
country_id: 6252001
domain: mail.monde-ai.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:hgfdcvbnk||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.185.197.33
country_id: 2921044
domain: mail.monde-ai.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Web Downloader/6.9||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.186.234.195
country_id: 6252001
domain: mail.monde-ai.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.14||T:APACHE||MV:.env~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 126.209.2.81
country_id: 1694008
description:
2026-06-08 00:42:48 dovecot_plain authenticator failed for H=(56QUULLY) [126.209.2.81]:60067: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.130.91.206
country_id: 2921044
description:
[2026-06-08 00:43:43 +0000] info [cpaneld] 84.130.91.206 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.179.187.246
country_id: 2542007
description:
[2026-06-08 00:43:45 +0000] info [cpaneld] 160.179.187.246 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.45.206.250
country_id: 3865483
description:
[2026-06-08 00:43:48 +0000] info [cpaneld] 200.45.206.250 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.0.168.40
country_id: 2464461
description:
[2026-06-08 00:43:32 +0000] info [cpaneld] 197.0.168.40 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.98.196
country_id: 2017370
description:
[2026-06-08 00:43:34 +0000] info [cpaneld] 95.174.98.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.238.183.182
country_id: 3686110
description:
[2026-06-08 00:43:41 +0000] info [cpaneld] 45.238.183.182 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 126.209.2.81
country_id: 1694008
description:
2026-06-08 00:42:52 dovecot_plain authenticator failed for H=(UJZECE2W) [126.209.2.81]:60068: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.227.120
country_id: 3625428
description:
[2026-06-08 00:43:38 +0000] info [cpaneld] 45.181.227.120 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.28.140
country_id: 3865483
description:
[2026-06-08 00:43:53 +0000] info [cpaneld] 38.51.28.140 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.121.105.74
country_id: 6254930
description:
[2026-06-08 00:44:05 +0000] info [cpaneld] 45.121.105.74 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.0.130
country_id: 1819730
description:
159.138.0.130 - - [08/Jun/2026:00:44:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936492&pdata=https%253A%252F%252Flaunetogo.tg%252Framadan-2023-officiel-la-journee-du-vendredi-21-avril-2023-chomee-et-payee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780879480 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/ramadan-2023-officiel-la-journee-du-vendredi-21-avril-2023-chomee-et-payee/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.0.130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.80.61
country_id: 1512440
description:
[2026-06-08 00:43:57 +0000] info [cpaneld] 84.54.80.61 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.207.153
country_id: 1327865
description:
[2026-06-08 00:44:02 +0000] info [cpaneld] 103.134.207.153 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.64.188.3
country_id: 1835841
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:hphhdcxi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun  8 00:44:43 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.64.188.3
country_id: 1835841
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:hphhdcxi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  8 00:45:17 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun  8 00:44:52 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun  8 00:46:07 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 125.46.93.174
country_id: 1814991
description:
2026-06-08 00:48:54 H=([125.46.93.174]) [125.46.93.174]:51658 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [08/Jun/2026:00:51:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684885&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvictime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780879870 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/victime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [08/Jun/2026:00:51:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063498&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaire-de-la-commune-de-keran-1%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780879909 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/maire-de-la-commune-de-keran-1/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [08/Jun/2026:00:52:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924254&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvictime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780879974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/victime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.123.198.203
country_id: 298795
description:
[2026-06-08 00:53:22 +0000] info [cpaneld] 94.123.198.203 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.116.74.29
country_id: 3686110
description:
[2026-06-08 00:53:49 +0000] info [cpaneld] 186.116.74.29 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.73.23.180
country_id: 6252001
description:
[2026-06-08 00:53:35 +0000] info [cpaneld] 173.73.23.180 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.62.143.147
country_id: 3686110
description:
[2026-06-08 00:53:40 +0000] info [cpaneld] 206.62.143.147 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.192.3
country_id: 1512440
description:
[2026-06-08 00:53:45 +0000] info [cpaneld] 144.124.192.3 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.2.44.193
country_id: 6290252
description:
[2026-06-08 00:53:58 +0000] info [cpaneld] 188.2.44.193 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.222.99
country_id: 2287781
description:
[2026-06-08 00:54:01 +0000] info [cpaneld] 102.209.222.99 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-08 00:56:04 +0000] info [cpaneld] 196.179.7.81 - e.sanvee "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.5.109.4
country_id: 2017370
description:
Jun  8 00:58:19 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.5.109.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-06-08 00:58:21 dovecot_plain authenticator failed for H=(coneed) [213.5.109.4]:33850: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 39.165.33.227
country_id: 1814991
description:
39.165.33.227 - - [08/Jun/2026:01:00:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197917&pdata=https%253A%252F%252Ftdn.tg%252Fmixx-virements-instantanes-uemoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780880434 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mixx-virements-instantanes-uemoa/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:39.165.33.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.173.92
country_id: 3996063
description:
46.250.173.92 - - [08/Jun/2026:01:00:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946772&pdata=http%253A%252F%252Fvitrinenews.tg%252F2021%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780880438 HTTP/1.1" 302 0 vitrinenews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.173.92


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 125.46.93.174
country_id: 1814991
description:
2026-06-08 01:01:00 H=([125.46.93.174]) [125.46.93.174]:35226 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.8.149.85
country_id: 3175395
description:
Jun  8 01:06:29 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.8.149.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.70.111.187
country_id: 3017382
description:
2026-06-08 01:06:41 dovecot_login authenticator failed for H=ip187.ip-193-70-111.eu (ADMIN) [193.70.111.187]:52196: 535 Incorrect authentication data (set_id=l.amegee@ccit.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 14.243.42.102
country_id: 1562822
domain: tensai.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.tensai.tg||ServerName:tensai.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 186.116.139.169
country_id: 3686110
domain: www.tensai.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.www.tensai.tg||ServerName:www.tensai.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.232.211.142
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:104.232.211.142||TA:104.232.211.142||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-11.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Begin Progressing with Your Prize vamvozmviigr.blogspot.nl MT||Email:tpcm2020@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.191.162.16
country_id: 1562822
description:
2026-06-08 01:13:27 H=([0.0.0.0]) [14.191.162.16]:22044 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.89.246.144
country_id: 6252001
description:
Jun  8 01:14:00 ns5 pure-ftpd[231905]: (?@47.89.246.144) [WARNING] Authentication failed for user [sodigaz]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.34.4
country_id: 6252001
description:
[2026-06-08 01:19:21 +0000] info [cpaneld] 45.3.34.4 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.102.120.216
country_id: 1269750
description:
2026-06-08 01:20:13 dovecot_plain authenticator failed for H=(localhost) [103.102.120.216]:5418: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.144
country_id: 3175395
description:
Jun  8 01:21:50 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.144
country_id: 3175395
description:
Jun  8 01:21:57 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.40.60.136
country_id: 1668284
description:
154.40.60.136 - - [08/Jun/2026:01:25:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853784&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fwp-admin%252Fjs%252Fwidgets%252Fclasa99.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780881899 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/wp-admin/js/widgets/clasa99.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.40.60.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-08 01:27:46 +0000] info [cpaneld] 196.179.7.81 - a.kesso "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.237
country_id: 6252001
description:
Jun  8 01:30:01 ns5 pure-ftpd[243309]: (?@147.185.132.237) [INFO] New connection from 147.185.132.237


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.146.249
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/prix-jean-julien-codjovi HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.71.15.16
country_id: 2017370
description:
2026-06-08 01:32:29 H=([178.71.15.16]) [178.71.15.16]:55001 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:01:32:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868235&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780882363 HTTP/1.1" 302 0 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:01:32:54 +0000] "GET /favicon.ico HTTP/1.1" 415 587 dioceseatakpame.tg "http://dioceseatakpame.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999256&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780882365" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 58.216.142.70
country_id: 1814991
description:
2026-06-08 01:33:41 H=([58.216.142.70]) [58.216.142.70]:44993 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:01:32:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999256&pdata=http%253A%252F%252Fdioceseatakpame.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780882365 HTTP/1.1" 404 561 dioceseatakpame.tg "http://dioceseatakpame.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.210
country_id: 3469034
description:
Jun  8 01:35:46 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-35.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.210
country_id: 3469034
description:
Jun  8 01:35:54 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Substantial Bet Reward vamvozmviigr.blogspot.mx 9c||Email:hickswayman@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-08 01:41:55 +0000] info [cpaneld] 45.61.130.187 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.9.238
country_id: 1819730
description:
159.138.9.238 - - [08/Jun/2026:01:42:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197142&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftag%252Fmicrofinance%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780882976 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/tag/microfinance/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.9.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.198.116.150
country_id: 6251999
description:
Jun  8 01:47:02 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.198.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.198.116.150
country_id: 6251999
description:
2026-06-08 01:47:04 dovecot_plain authenticator failed for H=bras-base-toroon2643w-grc-04-142-198-116-150.dsl.bell.ca (jwarmh6fdvnt9vrdchtic) [142.198.116.150]:63090: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.72
country_id: 690791
description:
Jun  8 01:48:14 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.47
country_id: 1512440
description:
2026-06-08 01:48:25 H=([84.54.70.47]) [84.54.70.47]:22700 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-08 01:51:27 +0000] info [cpaneld] 45.61.130.187 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [08/Jun/2026:01:56:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039386&pdata=http%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780883769 HTTP/1.1" 302 0 togomedia24.tg "http://togomedia24.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  8 01:57:08 ns5 pure-ftpd[264049]: (?@196.179.7.81) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.113.49
country_id: 1880251
description:
43.163.113.49 - - [08/Jun/2026:01:57:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078108&pdata=http%253A%252F%252Ftogodailynews.tg%252Fmsc-robert-dussey-invite-les-etats-a-travailler-davantage-sur-les-inegalites-socio-economiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780883835 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.113.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:01:58:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881754&pdata=http%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780883912 HTTP/1.1" 404 561 togomedia24.tg "http://togomedia24.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:01:58:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198125&pdata=http%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780883925 HTTP/1.1" 302 0 togomedia24.tg "http://togomedia24.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:01:58:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817520&pdata=http%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780883932 HTTP/1.1" 302 0 togomedia24.tg "http://togomedia24.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.54.72
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/anpe-15-000-chercheurs-demploi-accompagnes/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Digital Asset Extra bonotdamvam.blogspot.be Bn||Email:korgesjames3@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-00.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.9.123
country_id: 1880251
description:
43.134.9.123 - - [08/Jun/2026:02:01:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143339&pdata=https%253A%252F%252Flaunetogo.tg%252Fdeveloppement-inclusif-le-togo-et-le-pnud-un-engagement-commun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780884111 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/developpement-inclusif-le-togo-et-le-pnud-un-engagement-commun/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.9.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.154
country_id: 3469034
description:
Jun  8 02:02:40 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.154
country_id: 3469034
description:
Jun  8 02:02:54 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.154 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [08/Jun/2026:02:03:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002090&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsalif-keita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780884238 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/salif-keita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [08/Jun/2026:02:04:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725792&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaire-de-la-commune-de-keran-1%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780884246 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/maire-de-la-commune-de-keran-1/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.204
country_id: 6252001
description:
Jun  8 02:04:17 ns5 pure-ftpd[269607]: (?@147.185.132.204) [INFO] New connection from 147.185.132.204


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.88.33.136
country_id: 6252001
description:
Jun  8 02:05:39 ns5 pure-ftpd[270454]: (?@47.88.33.136) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [08/Jun/2026:02:13:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6791111&pdata=https%253A%252F%252Ftdn.tg%252Fafricsearch-togo-recrute-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780884800 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/africsearch-togo-recrute-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 222.85.211.12
country_id: 1814991
description:
2026-06-08 02:18:02 H=([222.85.211.12]) [222.85.211.12]:54430 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  8 02:20:42 ns5 pure-ftpd[280907]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 222.85.211.12
country_id: 1814991
description:
2026-06-08 02:20:06 H=([222.85.211.12]) [222.85.211.12]:58905 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  8 02:20:37 ns5 pure-ftpd[280907]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Biggest Extra sepoladi.blogspot.ca Qm||Email:jason.narronrealestate@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-24.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 222.85.211.12
country_id: 1814991
description:
2026-06-08 02:28:41 H=([222.85.211.12]) [222.85.211.12]:61081 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun  8 02:28:58 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-08 02:29:00 dovecot_plain authenticator failed for H=(xzh00wzvjlgl4k3bm64yaozq1aehng13) [117.1.213.160]:48445: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.175.94
country_id: 3996063
description:
46.250.175.94 - - [08/Jun/2026:02:31:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515098&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Fle-togo-sur-la-liste-des-beneficiaires-dun-nouveau-programme-de-ladministration-trump%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780885890 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/economie/le-togo-sur-la-liste-des-beneficiaires-dun-nouveau-programme-de-ladministration-trump/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.175.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.236.14.254
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-suppression-des-frais-descorte/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.69
country_id: 3175395
description:
Jun  8 02:35:27 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.68
country_id: 298795
description:
Jun  8 02:35:09 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:addefca7ed097913335e60cff8052c28f565d3f4||Title:cy5exbezj7azq1tdhe||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3290fc7b5353747aa6eef3d3a88b07801346640f||Title:i7xoumr9nfek1yt4lx||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bed3728d0c803a5add25d956ea6234e8fad24e35||Title:gqzjwv5n35dyimd||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:693ce4e708aebaead4352204721f9264e6f36e44||Title:l3z3277q39u4cfvg6e||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-08 02:42:25 +0000] info [cpaneld] 196.179.7.81 - esso "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0746daeb0ea6276d06679ae1c246c290c14e7b08||Title:8oa3c2tlfat79jccv||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b22c4b32d03758e3ec49be275ee81f09e80ec741||Title:lnnydp1a1iv0spoe||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [08/Jun/2026:02:45:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869468&pdata=http%253A%252F%252Fv2lhxq.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780886750 HTTP/1.1" 302 0 v2lhxq.mediatopnews.tg "http://v2lhxq.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ce5304111a7acdd8fd0e1e09df9310d8815ac82||Title:efa7g97bh6rl27||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:605483dd512e785e4b186e3c7b9ecc0a24c60ed9||Title:9gsh7oqyforerg70ye||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2969086a52293e70d9914beaf5f471edecbd117||Title:8iu009zlsqotatw||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Limitless Bonus vamvozmviigr.blogspot.cz 3w||Email:mwbakersxy1@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.179.7.81
country_id: 2464461
description:
Jun  8 02:48:47 ns5 pure-ftpd[302171]: (?@196.179.7.81) [WARNING] Authentication failed for user [e.sanvee]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-48.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8f03bf1d173d5b109b97f292d9053e4e65b3511||Title:y5tu7nm7s0mlpa||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.157
country_id: 3469034
description:
Jun  8 02:48:10 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.157
country_id: 3469034
description:
2026-06-08 02:48:12 dovecot_plain authenticator failed for H=(qrzn5ht8clk29uvw63at4) [200.174.198.157]:49117: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fefa86605b407e0a3a39440b09d60abb3066094c||Title:18m96mkm2viofb4jb||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:761bad2debb3cc02d87a6e5f1a6793cc207f175c||Title:1t03kcjxx57jiw69e||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-08 02:51:42 +0000] info [cpaneld] 196.179.7.81 - lxsenjdd_farms "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53316d72abe00a9488f828376dfcc4faf38be694||Title:jy0cs5x54wbfp0vqd||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:359d11f5deeb641c1637a4e02f0924effc9fc864||Title:nul13y8g8n6wa4vb8||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5feff1c2ae5a5527a54044b589b376fb72602d7||Title:6yrs1ap6k7v4ia38||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.199.182
country_id: 2750405
description:
[2026-06-08 02:53:12 +0000] info [cpaneld] 165.22.199.182 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2197d1ff7ea859d842ecee5387f43bc14d1d0276||Title:0ab2z4uvgwwpyb9||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4694f0d46a9faa517147e26835267e71d563e287||Title:62shrsb3nk7iyek||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.19
country_id: 6252001
description:
205.169.39.19 - - [08/Jun/2026:02:55:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170201&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780887320 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.19


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.239.82.176
country_id: 1210997
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:76d610c6a8d8222bcdfc2bb56cb153ea218df3db||Title:6zohtxswb5064p||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [08/Jun/2026:03:06:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853533&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780887959 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.99
country_id: 1269750
description:
2026-06-08 03:07:11 dovecot_login authenticator failed for H=(nsg-corporate-99.230.187.122.airtel.in) [122.187.230.99]:55272: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.147
country_id: 3175395
description:
Jun  8 03:08:19 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.73.29
country_id: 6252001
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.confortis.tg/robots.txt HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.88.38
country_id: 2750405
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.confortis.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Appreciate Your Bonus Right Now bonotdamvam.blogspot.ae xo||Email:state2state87@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-12.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [08/Jun/2026:03:13:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538644&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finhumation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780888406 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inhumation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [08/Jun/2026:03:13:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921947&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgbadamassi-obtient-master-professionnel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780888411 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gbadamassi-obtient-master-professionnel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [08/Jun/2026:03:14:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185108&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsalif-keita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780888440 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/salif-keita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [08/Jun/2026:03:14:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659949&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finhumation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780888452 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inhumation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Jun  8 03:14:26 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-06-08 03:14:28 dovecot_login authenticator failed for H=(103.174.34.49.nstplnet.com) [103.174.34.49]:55051: 535 Incorrect authentication data (set_id=hr@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-06-08 03:15:06 dovecot_login authenticator failed for H=(103.174.34.49.nstplnet.com) [103.174.34.49]:59652: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Jun  8 03:15:04 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.132
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:198.105.119.132||TA:198.105.119.132||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.144.252.77
country_id: 1814991
description:
2026-06-08 03:22:29 H=([0.0.0.0]) [183.144.252.77]:45250 F=<John@4452.com> rejected RCPT <evendeur@soena.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [08/Jun/2026:03:25:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081192&pdata=http%253A%252F%252Fcpcalendars.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889139 HTTP/1.1" 302 0 cpcalendars.cfpj.tg "http://cpcalendars.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [08/Jun/2026:03:26:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185369&pdata=http%253A%252F%252Fcfpj.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889198 HTTP/1.1" 302 0 cfpj.tg.154-70-82-246.cpanel.site "http://cfpj.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [08/Jun/2026:03:26:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527083&pdata=http%253A%252F%252Fwebmail.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889198 HTTP/1.1" 302 0 webmail.cfpj.tg "http://webmail.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [08/Jun/2026:03:26:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197097&pdata=http%253A%252F%252Fwww.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889209 HTTP/1.1" 302 0 www.cfpj.tg "http://www.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [08/Jun/2026:03:27:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473619&pdata=http%253A%252F%252Fwww.v2.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889244 HTTP/1.1" 302 0 www.v2.cfpj.tg "http://www.v2.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jun  8 03:27:30 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [08/Jun/2026:03:27:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645958&pdata=http%253A%252F%252Fwww.cfpj.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889259 HTTP/1.1" 302 0 www.cfpj.tg.154-70-82-246.cpanel.site "http://www.cfpj.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [08/Jun/2026:03:26:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262929&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889212 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [08/Jun/2026:03:28:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052180&pdata=http%253A%252F%252Fcpanel.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889300 HTTP/1.1" 302 0 cpanel.cfpj.tg "http://cpanel.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [08/Jun/2026:03:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580589&pdata=http%253A%252F%252Fautodiscover.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889276 HTTP/1.1" 302 0 autodiscover.cfpj.tg "http://autodiscover.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.1
country_id: 3469034
description:
Jun  8 03:28:07 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [08/Jun/2026:03:29:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104412&pdata=http%253A%252F%252Fv2.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889341 HTTP/1.1" 302 0 v2.cfpj.tg "http://v2.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [08/Jun/2026:03:29:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711144&pdata=http%253A%252F%252Fcpcontacts.cfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889348 HTTP/1.1" 302 0 cpcontacts.cfpj.tg "http://cpcontacts.cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.241.167.253
country_id: 1562822
description:
2026-06-08 03:29:36 H=([14.241.167.253]) [14.241.167.253]:63292 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.43
country_id: 3469034
description:
Jun  8 03:30:43 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.43
country_id: 3469034
description:
2026-06-08 03:30:45 dovecot_plain authenticator failed for H=(b0aq5cuee24samekue7th9iee) [200.174.198.43]:46506: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.200
country_id: 2661886
description:
45.84.107.200 - - [08/Jun/2026:03:31:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13078887&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889466 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.200


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.144.252.77
country_id: 1814991
description:
2026-06-08 03:34:26 H=([0.0.0.0]) [183.144.252.77]:45398 F=<John@4452.com> rejected RCPT <evendeur@soena.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.185
country_id: 6252001
description:
Jun  8 03:34:00 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Surprise Funds sepoladi.blogspot.dk fr||Email:mrweber1992@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-35.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:03:36:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7445915&pdata=http%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889777 HTTP/1.1" 302 0 confortis.tg "http://confortis.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.113.30.150
country_id: 174982
description:
2026-06-08 03:39:13 H=([217.113.30.150]) [217.113.30.150]:64002 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:03:39:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882058&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780889987 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [08/Jun/2026:03:42:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921937&pdata=http%253A%252F%252Fdza52a.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780890125 HTTP/1.1" 302 0 dza52a.mediatopnews.tg "http://dza52a.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.113.30.150
country_id: 174982
description:
2026-06-08 03:45:23 H=([217.113.30.150]) [217.113.30.150]:62175 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.16.0
country_id: 3895114
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seance-de-restitution-de-la-mission-dimmersion-du-cat-a-lasa-ci HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.10.34
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-51.65.111.10.34||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [08/Jun/2026:03:50:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919780&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780890653 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-08 03:52:11 +0000] info [cpaneld] 5.230.133.146 NEW newistm:CxGSDxW7Qygcm0sf address=5.230.133.146,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [08/Jun/2026:03:52:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fong-adventist-development-and-relief-agency-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780890747 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ong-adventist-development-and-relief-agency-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.122.27.233
country_id: 6252001
description:
[2026-06-08 03:54:25 +0000] info [cpaneld] 134.122.27.233 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.173.219.222
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/48.jpeg HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.42.41
country_id: 1861060
description:
2026-06-08 03:57:01 dovecot_plain authenticator failed for H=(672mpx3ksqphtiazu2rk0) [47.79.42.41]:48194: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.188
country_id: 6252001
domain: 54.214.137.149
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.214.137.149/azenv5.php HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your Supreme User Cash eropolik.blogspot.ch EM||Email:larrydorcasgyar@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-59.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.148.228.133
country_id: 2635167
description:
[2026-06-08 04:00:49 +0000] info [cpaneld] 91.148.228.133 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.102.158.164
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-une-nouvelle-etape-pour-laccompagnement-entrepreneurial-des-jeunes/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-08 04:05:41 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:43692: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-08 04:05:56 +0000] info [cpaneld] 5.230.133.89 NEW frtwilql:ii_izwGFHZ4uP7Pq address=5.230.133.89,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [08/Jun/2026:04:09:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882222&pdata=http%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780891782 HTTP/1.1" 302 0 confortis.tg "http://confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bb2ac2c46c479ef79a3669c3950ca1ecdea57a2a||Title:d22f72kwgxfxxow||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.220.13.98
country_id: 2017370
description:
Jun  8 04:12:43 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.220.13.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.220.13.98
country_id: 2017370
description:
2026-06-08 04:12:45 dovecot_login authenticator failed for H=(psvJPqs) [212.220.13.98]:34429: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48a580e48a9ff2045cbed8c7b77903bae17a1197||Title:kz2uqymhkdcrqfsz4g||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.228.226
country_id: 3865483
description:
Jun  8 04:14:47 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.228.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:236058e76febe0aefe460c0b86340f35d2550b8a||Title:zj8uaqshtal7ewyh||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 54.214.137.149
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.214.137.149/azenv4.php HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:17b199cff2c925da03b9dc91b69987ab643ffb8e||Title:x674wqbhfw78p25||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.228.226
country_id: 3865483
description:
Jun  8 04:14:55 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.228.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:baaa04e215687169fa772ef3e6bbad3a61be2b1e||Title:t3wg2mdx5274r2j50||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:17fc1eb861ccfb37c0becf407fe52a3a3820a42c||Title:il6rn020vc1uo7p37w||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:479c9856e52d056b81016de91584d9112e2d9c3a||Title:axi9s4nhkt0iwwy||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2efe5bb0b30fd92954b762aef4baa30d23ce2664||Title:pc2xjpcdw0zws6e||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f839a040c868460e6f35aaf94e3db422a6da3eea||Title:0o61o3hfmcpnmc1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.150.230
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40b3a3e91390f002c354956aad42d3178e5b9de1||Title:0tx8fifkcb6o8b6||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.205
country_id: 6290252
description:
Jun  8 04:23:02 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Start Your Electronic Table Game Funds eropolik.blogspot.gr f2||Email:Charlesmontgomery80@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-24.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.216
country_id: 1512440
description:
2026-06-08 04:31:08 H=([213.230.87.216]) [213.230.87.216]:8688 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.70.30.197
country_id: 1814991
description:
2026-06-08 04:32:16 H=([39.70.30.197]) [39.70.30.197]:41014 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.120.205.122
country_id: 1605651
description:
Jun  8 04:33:25 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.120.205.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.120.205.122
country_id: 1605651
description:
2026-06-08 04:33:27 dovecot_plain authenticator failed for H=ppp-124-120-205-122.revip2.asianet.co.th (E1261D68V5UP6) [124.120.205.122]:53167: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:04:34:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777233&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780893250 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.68
country_id: 690791
description:
Jun  8 04:36:29 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.211.12
country_id: 1512440
description:
2026-06-08 04:37:43 H=([37.110.211.12]) [37.110.211.12]:29814 F=<John@4452.com> rejected RCPT <reseaux@soena.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.242.49.194
country_id: 2328926
description:
[2026-06-08 04:38:26 +0000] info [cpaneld] 41.242.49.194 NEW pnls:ewm1tqQkfltfG46h address=41.242.49.194,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.38.19.173
country_id: 690791
description:
2026-06-08 04:39:00 dovecot_plain authenticator failed for H=host-176-38-19-173.b026.la.net.ua ([31.76.125.49]) [176.38.19.173]:44302: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.127.56.125
country_id: 3469034
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/7 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 171.22.251.195
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:171.22.251.195||TA:171.22.251.195||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.173.172
country_id: 3996063
description:
46.250.173.172 - - [08/Jun/2026:04:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146003&pdata=https%253A%252F%252Fvitrinenews.tg%252F2024%252F03%252F17%252Flunion-des-organisations-professionnelles-des-artisans-dhygiene-et-soins-corporels-du-togo-uopahct-en-fete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780893691 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2024/03/17/lunion-des-organisations-professionnelles-des-artisans-dhygiene-et-soins-corporels-du-togo-uopahct-en-fete/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.4 Mobile/15A372 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.173.172


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.129.164.6
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/plu-enregistrement-des-parcelles-de-terrain-dans-zio-2-et-ave-2/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-06-08 04:44:54 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:56078: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.206.14
country_id: 1269750
description:
Jun  8 04:44:52 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.206.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.33
country_id: 6252001
description:
[2026-06-08 04:45:14 +0000] info [cpaneld] 64.44.59.33 NEW wcnyaruu:YY06uLnchefaiH9I address=64.44.59.33,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Web Coin Extra eropolik.blogspot.kr Jg||Email:rupankarpalit101@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-48.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.248
country_id: 1880251
description:
47.128.112.248 - - [08/Jun/2026:04:51:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9553565&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fepe-ekpe-360e-edition-voici-le-programme-des-activites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780894279 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/epe-ekpe-360e-edition-voici-le-programme-des-activites/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.248


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-08 04:53:29 dovecot_plain authenticator failed for H=(3z1n7f8myom5hhqawekc5vru1qmkdnz0) [27.73.209.71]:58495: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  8 04:53:27 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.76.172.30
country_id: 660013
description:
Jun  8 04:54:31 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.76.172.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.76.172.30
country_id: 660013
description:
2026-06-08 04:54:33 dovecot_plain authenticator failed for H=(4ndl02c12t6jgvw7fpw7oiiu) [194.76.172.30]:21188: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.193.153
country_id: 1512440
description:
2026-06-08 04:55:22 H=([198.163.193.153]) [198.163.193.153]:11400 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.190
country_id: 6252001
description:
Jun  8 04:56:02 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.190
country_id: 6252001
description:
2026-06-08 04:56:04 dovecot_plain authenticator failed for H=(nzkg3z46xcdm2u10qe9b1cr9ij) [23.129.64.190]:62135: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.221.48
country_id: 2363686
description:
[2026-06-08 04:57:41 +0000] info [webmaild] 196.168.221.48 - chef.dgi@ucao-uut.tg "POST /cpsess5543632399/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.176.253.226] != Current IP Address [196.168.221.48]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.73.72
country_id: 1512440
description:
2026-06-08 05:00:37 H=([84.54.73.72]) [84.54.73.72]:30026 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.199.119
country_id: 2510769
description:
Jun  8 05:03:30 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.199.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.34.74.202
country_id: 1522867
description:
2026-06-08 05:03:27 H=([5.34.74.202]) [5.34.74.202]:49305 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [08/Jun/2026:05:04:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078622&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895039 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.161.97
country_id: 2363686
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/site/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.161.97
country_id: 2363686
domain: cfpj.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tghttp/cfpj.tg/site/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.229.209
country_id: 6252001
description:
[2026-06-08 05:07:24 +0000] info [cpaneld] 216.26.229.209 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.109.117.250
country_id: 102358
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/10 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Top Cash vamvozmviigr.blogspot.ae 2J||Email:auburnstahl0226@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-12.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.17.87.188
country_id: 1643084
description:
203.17.87.188 - - [08/Jun/2026:05:13:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672857&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895595 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.17.87.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.153.213.101
country_id: 1880251
description:
43.153.213.101 - - [08/Jun/2026:05:12:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999775&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-augmentation-du-taux-brut-de-scolarisation-au-lycee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895570 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-augmentation-du-taux-brut-de-scolarisation-au-lycee/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.153.213.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.66.217.97
country_id: 1861060
description:
Jun  8 05:14:00 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.66.217.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.66.217.97
country_id: 1861060
description:
2026-06-08 05:14:02 dovecot_login authenticator failed for H=(rtyV11KQP5) [45.66.217.97]:55931: 535 Incorrect authentication data (set_id=l.amegee@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [08/Jun/2026:05:16:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185831&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frentree-scolaire-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895767 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rentree-scolaire-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [08/Jun/2026:05:16:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001562&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgbadamassi-obtient-master-professionnel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895801 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gbadamassi-obtient-master-professionnel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.103.181.54
country_id: 1168579
description:
2026-06-08 05:16:41 H=([59.103.181.54]) [59.103.181.54]:55886 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [08/Jun/2026:05:17:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789320&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-allemagne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895863 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-allemagne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [08/Jun/2026:05:17:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738138&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895870 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-06-08 05:19:00 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:47735: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.115.206
country_id: 732800
description:
Jun  8 05:18:58 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.115.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 203.188.251.78
country_id: 1210997
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [08/Jun/2026:05:19:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13213127&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-allemagne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780895997 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-allemagne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.138.53
country_id: 1512440
description:
2026-06-08 05:22:43 H=([185.139.138.53]) [185.139.138.53]:64428 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jun  8 05:22:50 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.103.181.54
country_id: 1168579
description:
2026-06-08 05:21:59 H=([59.103.181.54]) [59.103.181.54]:12251 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-06-08 05:22:52 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:42800: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.232
country_id: 6252001
description:
[2026-06-08 05:23:22 +0000] info [cpaneld] 216.189.152.232 NEW sahamtg:N9LBq8YJGOTwOjnA address=216.189.152.232,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.14
country_id: 2635167
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.394849574005697.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 185.241.208.231
country_id: 798544
domain: butodra.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 185.241.208.231
country_id: 798544
domain: butodra.tg
description:
IM360 WAF: Block .suspected files||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun  8 05:28:30 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.228.200
country_id: 1512440
description:
2026-06-08 05:28:33 H=([188.113.228.200]) [188.113.228.200]:18040 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun  8 05:29:33 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.228.200
country_id: 1512440
description:
2026-06-08 05:30:13 H=([188.113.228.200]) [188.113.228.200]:17973 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun  8 05:30:14 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun  8 05:31:21 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.47
country_id: 2413451
description:
Jun  8 05:30:55 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.229.10
country_id: 1512440
description:
2026-06-08 05:31:15 H=([185.213.229.10]) [185.213.229.10]:26974 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.118
country_id: 1814991
description:
Jun  8 05:35:00 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2026-06-08 05:35:02 dovecot_login authenticator failed for H=([111.61.175.118]) [111.61.175.118]:42478: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-08 05:36:31 +0000] info [cpaneld] 5.230.153.46 NEW he24djure:AtF1K8hx1l0TE1DR address=5.230.153.46,app=cpaneld,creator=he24djure,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-08 05:37:02 +0000] info [cpaneld] 5.230.153.114 NEW abttogo:GWWbsX2aSQlbCA4X address=5.230.153.114,app=cpaneld,creator=abttogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 193.148.66.209
country_id: 130758
description:
2026-06-08 05:37:37 H=([193.148.66.209]) [193.148.66.209]:57301 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-08 05:37:17 +0000] info [cpaneld] 5.230.153.122 NEW sadis:wxTyLgEGkaT9xmdI address=5.230.153.122,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.86
country_id: 3017382
description:
[2026-06-08 05:37:28 +0000] info [cpaneld] 5.231.64.86 NEW glfmqhlj:P4Jn8RMO7ZgY09Ky address=5.231.64.86,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-08 05:36:56 +0000] info [cpaneld] 5.230.133.179 - cetitiuu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Appreciate Your Distinct Financial Gem sepoladi.blogspot.dk Im||Email:kennethdperry78@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-37.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-08 05:37:46 +0000] info [cpaneld] 5.231.64.100 NEW iwtfuxpj:WOpoybs5XopcSuI1 address=5.231.64.100,app=cpaneld,creator=iwtfuxpj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-06-08 05:38:31 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:11302: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.54
country_id: 6252001
description:
[2026-06-08 05:38:49 +0000] info [cpaneld] 134.195.82.54 NEW antasadmin:_rdSZiDCNmE5cMgJ address=134.195.82.54,app=cpaneld,creator=antasadmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.147.150.225
country_id: 130758
description:
2026-06-08 05:37:55 H=([2.147.150.225]) [2.147.150.225]:41519 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-08 05:38:01 +0000] info [cpaneld] 5.230.153.136 - xflhqsmv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-08 05:38:11 +0000] info [cpaneld] 5.230.153.23 NEW ljrwwgxg:zaAfvK3dvC0ddJzw address=5.230.153.23,app=cpaneld,creator=ljrwwgxg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.5
country_id: 1814991
description:
Jun  8 05:38:29 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-08 05:38:34 +0000] info [cpaneld] 5.230.133.115 NEW lfzqsiwv:FV_qfiATs6ftwhed address=5.230.133.115,app=cpaneld,creator=lfzqsiwv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-06-08 05:38:50 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:38728: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-08 05:38:07 +0000] info [cpaneld] 173.211.89.202 - ubwmytwf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-08 05:38:28 +0000] info [cpaneld] 173.211.89.138 - ywpozjfl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun  8 05:39:03 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.88.241
country_id: 6252001
description:
[2026-06-08 05:39:06 +0000] info [cpaneld] 173.211.88.241 - apicafe "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.168
country_id: 6252001
description:
[2026-06-08 05:39:10 +0000] info [cpaneld] 64.44.62.168 NEW tvnlfsbb:YmkRyhbUT4Jb1FrY address=64.44.62.168,app=cpaneld,creator=tvnlfsbb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-08 05:39:25 +0000] info [cpaneld] 5.230.153.211 - arsetg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.238
country_id: 6252001
description:
[2026-06-08 05:39:33 +0000] info [cpaneld] 216.189.152.238 NEW qwrfphgl:8dUNq8eamLnY3nI5 address=216.189.152.238,app=cpaneld,creator=qwrfphgl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-08 05:39:05 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:28002: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-08 05:39:54 +0000] info [cpaneld] 64.44.59.244 NEW gwkaeanh:DWo2b3SU32fEqRpK address=64.44.59.244,app=cpaneld,creator=gwkaeanh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.155
country_id: 6252001
description:
[2026-06-08 05:40:10 +0000] info [cpaneld] 45.58.50.155 NEW zsfyjiji:cdnwlAtdwCCRIwcO address=45.58.50.155,app=cpaneld,creator=zsfyjiji,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.241
country_id: 6252001
description:
[2026-06-08 05:40:28 +0000] info [cpaneld] 173.211.88.241 NEW pjwfvzan:s0dcsmzliVQh7ui3 address=173.211.88.241,app=cpaneld,creator=pjwfvzan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-08 05:40:50 +0000] info [cpaneld] 5.230.153.227 NEW nadngfzn:_yX8XyyWbUMDrMU8 address=5.230.153.227,app=cpaneld,creator=nadngfzn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-08 05:41:30 +0000] info [cpaneld] 5.230.153.18 NEW dmmkifel:pXqfiP46LnRLrQ3x address=5.230.153.18,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-08 05:41:46 +0000] info [cpaneld] 5.230.133.154 NEW udkscvak:UkT5wG3Pp5uUFL0O address=5.230.133.154,app=cpaneld,creator=udkscvak,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.102.180
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/50.jpeg HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-08 05:42:39 +0000] info [cpaneld] 134.195.83.16 - zgqykfsi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-08 05:42:01 +0000] info [cpaneld] 5.230.153.156 - himcuijv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User himcuijv has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.190
country_id: 3017382
description:
[2026-06-08 05:42:20 +0000] info [cpaneld] 5.231.255.190 - hsufgiqg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User hsufgiqg has their account suspended. Login blocked.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-08 05:42:07 +0000] info [cpaneld] 5.231.255.233 NEW bilirando:bI35ceVowYhfBrKV address=5.231.255.233,app=cpaneld,creator=bilirando,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-08 05:42:26 +0000] info [cpaneld] 5.230.153.13 NEW titrisat:CaTHp8nm7hReVVEf address=5.230.153.13,app=cpaneld,creator=titrisat,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-08 05:42:52 +0000] info [cpaneld] 5.230.133.64 NEW cietg:lyEOzCTWby0tlowv address=5.230.133.64,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.184
country_id: 6252001
description:
[2026-06-08 05:43:09 +0000] info [cpaneld] 64.44.59.184 - egjvuiox "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.190
country_id: 3017382
description:
[2026-06-08 05:43:30 +0000] info [cpaneld] 5.231.255.190 NEW cafetg:nG1sIWjYl6w2KUmx address=5.231.255.190,app=cpaneld,creator=cafetg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-08 05:43:36 +0000] info [cpaneld] 5.230.133.110 NEW cafeitadm:YsNnGQ7lvhyiRqGG address=5.230.133.110,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-08 05:43:49 +0000] info [cpaneld] 5.230.153.33 - assedderetrm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-08 05:44:01 +0000] info [cpaneld] 5.175.229.201 NEW zoykjvzb:BOXjN3vYXKA4EC_T address=5.175.229.201,app=cpaneld,creator=zoykjvzb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-08 05:43:58 +0000] info [cpaneld] 5.231.255.174 NEW iwtfuxpj:rz1pIAzcPMjLyqbU address=5.231.255.174,app=cpaneld,creator=iwtfuxpj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-08 05:43:55 +0000] info [cpaneld] 5.230.153.229 NEW gwkaeanh:YWAcVY6jB3U829wG address=5.230.153.229,app=cpaneld,creator=gwkaeanh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.130
country_id: 2921044
description:
[2026-06-08 05:43:57 +0000] info [cpaneld] 5.175.229.130 NEW antasadmin:EuetwV1L5KfxX3E5 address=5.175.229.130,app=cpaneld,creator=antasadmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-08 05:44:50 +0000] info [cpaneld] 5.230.153.38 - centif "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.226
country_id: 2635167
description:
[2026-06-08 05:43:54 +0000] info [cpaneld] 5.230.153.226 NEW bilirando:t_FRnkYo3GqjMWZ6 address=5.230.153.226,app=cpaneld,creator=bilirando,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.180
country_id: 2635167
description:
[2026-06-08 05:43:55 +0000] info [cpaneld] 5.230.153.180 NEW camaegdtomgo:WGJqq86uJgI14Kas address=5.230.153.180,app=cpaneld,creator=camaegdtomgo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.88.145
country_id: 6252001
description:
[2026-06-08 05:44:19 +0000] info [cpaneld] 173.211.88.145 - ubwrvcfr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.180
country_id: 2635167
description:
[2026-06-08 05:44:44 +0000] info [cpaneld] 5.230.153.180 - muzsajnk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-08 05:45:17 +0000] info [cpaneld] 5.230.153.52 NEW cinemafreenetmas:CoONwLse9jVwrzf_ address=5.230.153.52,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-08 05:45:42 +0000] info [cpaneld] 134.195.83.207 NEW nxpivbcy:68nRJOQRcX1TXrKV address=134.195.83.207,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-08 05:44:54 +0000] info [cpaneld] 107.174.169.229 NEW uzomgvkg:mlUq4rBnPeZUvXLl address=107.174.169.229,app=cpaneld,creator=uzomgvkg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-08 05:45:04 +0000] info [cpaneld] 134.195.83.78 - cfpjusti "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-08 05:45:12 +0000] info [cpaneld] 5.231.255.112 - qdhgtoly "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.197
country_id: 2635167
description:
[2026-06-08 05:45:29 +0000] info [cpaneld] 5.230.153.197 NEW aifkjzqm:EcVJNJSc9dKja7T4 address=5.230.153.197,app=cpaneld,creator=aifkjzqm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-08 05:45:08 +0000] info [cpaneld] 5.230.153.33 - yxhnfwxr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-08 05:46:48 +0000] info [cpaneld] 5.230.133.74 NEW grzpnymi:1QAnOnd577wjlzgk address=5.230.133.74,app=cpaneld,creator=grzpnymi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.184
country_id: 6252001
description:
[2026-06-08 05:45:57 +0000] info [cpaneld] 64.44.59.184 NEW cloudtracks:j7KqyqyfF9GGcrvV address=64.44.59.184,app=cpaneld,creator=cloudtracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.177.75.37
country_id: 130758
description:
2026-06-08 05:46:05 H=([94.177.75.37]) [94.177.75.37]:51115 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-08 05:46:13 +0000] info [cpaneld] 5.230.133.44 NEW cndhtogo:7Bw3uuFlNDPV1DAs address=5.230.133.44,app=cpaneld,creator=cndhtogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-08 05:47:37 +0000] info [cpaneld] 5.230.133.20 - crrhuemo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.20.112
country_id: 3469034
description:
[2026-06-08 05:47:49 +0000] info [cpaneld] 65.111.20.112 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-08 05:47:21 +0000] info [cpaneld] 5.230.153.34 NEW crepsad:CIx8mhwUIymomr2b address=5.230.153.34,app=cpaneld,creator=crepsad,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.145
country_id: 6252001
description:
[2026-06-08 05:47:45 +0000] info [cpaneld] 173.211.88.145 NEW rbnbkmre:qzQKtICGvlKGxqFh address=173.211.88.145,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-08 05:48:30 +0000] info [cpaneld] 5.230.133.177 NEW zykoahbv:CkcQeeks0Gg2o7n5 address=5.230.133.177,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-08 05:48:22 +0000] info [cpaneld] 5.230.133.152 - mvfxewjz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.16.87.193
country_id: 298795
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-48.212.16.87.193||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-08 05:48:44 +0000] info [cpaneld] 5.230.153.169 - dgdntogo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-08 05:48:51 +0000] info [cpaneld] 107.174.169.209 NEW ohuuvcqw:5Dbg_1gHfsbs2DeD address=107.174.169.209,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-08 05:49:16 +0000] info [cpaneld] 107.175.5.140 - zmfpejke "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User zmfpejke has their account suspended. Login blocked.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-08 05:49:40 +0000] info [cpaneld] 5.230.133.14 NEW edjatiapougloe:diY1a84J6ZucwkUJ address=5.230.133.14,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-08 05:49:54 +0000] info [cpaneld] 5.230.153.219 - qpeitowf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User qpeitowf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.169
country_id: 6252001
description:
[2026-06-08 05:50:02 +0000] info [cpaneld] 64.44.62.169 - vodvpozo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-08 05:50:07 +0000] info [cpaneld] 134.195.83.16 - kygyhxkc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.75
country_id: 2635167
description:
[2026-06-08 05:50:16 +0000] info [cpaneld] 5.230.133.75 NEW expirefreenetmas:OHxUkJPbIzthKdgy address=5.230.133.75,app=cpaneld,creator=expirefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-08 05:49:58 +0000] info [cpaneld] 5.230.153.48 - uubplgpf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-08 05:50:33 +0000] info [cpaneld] 173.211.89.202 NEW uypcrwbr:KJK3mqo7f2fDqzsv address=173.211.89.202,app=cpaneld,creator=uypcrwbr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.55
country_id: 2921044
description:
2026-06-08 05:51:43 dovecot_plain authenticator failed for H=tor-exit-55.for-privacy.net (8362wu9vu3jy9uy4a4n145u9a) [185.220.101.55]:36423: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-08 05:50:53 +0000] info [cpaneld] 64.44.62.228 NEW njdbfcnn:vQY6ccANk6MJHevZ address=64.44.62.228,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-08 05:51:18 +0000] info [cpaneld] 134.195.82.68 NEW hnzwgoog:UUEEyTceYacfQqur address=134.195.82.68,app=cpaneld,creator=hnzwgoog,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.130.38.45
country_id: 6252001
description:
Jun  8 05:51:06 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.130.38.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.167
country_id: 1512440
description:
2026-06-08 05:52:01 H=([188.113.240.49]) [213.230.93.167]:42465 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.78
country_id: 3017382
description:
[2026-06-08 05:52:13 +0000] info [cpaneld] 5.231.255.78 - geekhllo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-08 05:52:39 +0000] info [cpaneld] 5.230.153.33 - tubobkfl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-08 05:52:16 +0000] info [cpaneld] 5.230.133.133 NEW mgvybwur:2KIinWsY9ixyqWmV address=5.230.133.133,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-08 05:53:44 +0000] info [cpaneld] 5.230.153.242 NEW fgbegmfv:7z54hgVm6x80US0q address=5.230.153.242,app=cpaneld,creator=fgbegmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-08 05:52:55 +0000] info [cpaneld] 5.230.133.20 NEW rdlizssu:xfgdW5zNvCQCDwEV address=5.230.133.20,app=cpaneld,creator=rdlizssu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-08 05:53:07 +0000] info [cpaneld] 5.230.153.179 - jvrzfkho "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-08 05:53:11 +0000] info [cpaneld] 5.231.64.168 NEW tvedylqu:3U9Bv21nN_WXJ7PS address=5.231.64.168,app=cpaneld,creator=tvedylqu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-08 05:54:47 +0000] info [cpaneld] 5.230.133.217 NEW xfmcxmea:JsSfrTfZztte21Os address=5.230.133.217,app=cpaneld,creator=xfmcxmea,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-08 05:54:01 +0000] info [cpaneld] 173.211.88.116 - tpcjcbrf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User tpcjcbrf has their account suspended. Login blocked.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-08 05:54:16 +0000] info [cpaneld] 5.230.133.223 NEW oviaiart:zZlyLJLgwM15wICY address=5.230.133.223,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-08 05:54:31 +0000] info [cpaneld] 5.230.153.108 NEW kooladmin:yuh7YX9L2daO_XIo address=5.230.153.108,app=cpaneld,creator=kooladmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-08 05:55:24 +0000] info [cpaneld] 5.230.153.230 NEW segasetic:X9e5ssLivIqrVMpO address=5.230.153.230,app=cpaneld,creator=segasetic,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.109
country_id: 6252001
description:
[2026-06-08 05:55:43 +0000] info [cpaneld] 134.195.83.109 NEW cndhtogo:su9B91s0u622AcfU address=134.195.83.109,app=cpaneld,creator=cndhtogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.47
country_id: 6252001
description:
[2026-06-08 05:54:57 +0000] info [cpaneld] 45.58.50.47 NEW kpmg:oGWu5TB4HajtyUlE address=45.58.50.47,app=cpaneld,creator=kpmg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-08 05:55:11 +0000] info [cpaneld] 5.230.133.42 NEW sayfuswa:kXBVvKbmd604roRo address=5.230.133.42,app=cpaneld,creator=sayfuswa,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-08 05:55:40 +0000] info [cpaneld] 5.230.153.219 NEW cndhtogo:cTf6QZ6pfb0C1Pdo address=5.230.153.219,app=cpaneld,creator=cndhtogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-08 05:55:45 +0000] info [cpaneld] 5.230.133.179 NEW olvyoktk:vtwvcjgDjI3mikn0 address=5.230.133.179,app=cpaneld,creator=olvyoktk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [08/Jun/2026:05:56:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080941&pdata=http%253A%252F%252Fl3cgzg.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780898183 HTTP/1.1" 302 0 l3cgzg.mediatopnews.tg "http://l3cgzg.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-08 05:56:38 +0000] info [cpaneld] 5.230.153.156 NEW vuvwskxh:vZngCn7vbL44V9ma address=5.230.153.156,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-08 05:56:06 +0000] info [cpaneld] 5.230.133.216 NEW natozafk:qZaYqzKxwHqy_v_X address=5.230.133.216,app=cpaneld,creator=natozafk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.253
country_id: 2635167
description:
[2026-06-08 05:56:19 +0000] info [cpaneld] 5.230.133.253 NEW zmmjcejv:0XI5u13Nhwisntrj address=5.230.133.253,app=cpaneld,creator=zmmjcejv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-08 05:56:34 +0000] info [cpaneld] 5.230.153.254 - lhxhatyj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-08 05:57:01 +0000] info [cpaneld] 107.175.5.84 NEW ocrlqfut:fTlfV8iKEqDICCGV address=107.175.5.84,app=cpaneld,creator=ocrlqfut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.233
country_id: 2635167
description:
[2026-06-08 05:57:24 +0000] info [cpaneld] 5.230.133.233 - newglevfer "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-08 05:57:44 +0000] info [cpaneld] 5.230.153.33 NEW utkxprkk:Ft3vsoJfCVMRCSKS address=5.230.153.33,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-08 05:57:17 +0000] info [cpaneld] 5.230.153.211 - qmpqeesf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User qmpqeesf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-08 05:57:40 +0000] info [cpaneld] 5.230.153.185 - pnlpzmfv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-08 05:58:16 +0000] info [cpaneld] 5.230.153.136 NEW natozafk:ih_gAjz6s5e4QB7H address=5.230.153.136,app=cpaneld,creator=natozafk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.78
country_id: 2635167
description:
[2026-06-08 05:58:40 +0000] info [cpaneld] 5.230.133.78 NEW hwirjjwo:PiZIIsDy9u9gusMI address=5.230.133.78,app=cpaneld,creator=hwirjjwo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.146.17.181
country_id: 2017370
description:
[2026-06-08 05:57:54 +0000] info [cpaneld] 46.146.17.181 - nwjvzxzr:@kf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-08 05:58:15 +0000] info [cpaneld] 5.230.133.240 NEW libertepansel:OQbnR548An0kjmtG address=5.230.133.240,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-08 05:59:29 +0000] info [cpaneld] 134.195.82.52 - dxsiclpd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.49
country_id: 2635167
description:
[2026-06-08 05:59:34 +0000] info [cpaneld] 5.230.153.49 NEW lxyrcgwu:yw_WgxP9froGwGvo address=5.230.153.49,app=cpaneld,creator=lxyrcgwu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.68
country_id: 3017382
description:
[2026-06-08 05:59:12 +0000] info [cpaneld] 5.231.255.68 NEW lhqeyybr:_4cGqAY0nUPremad address=5.231.255.68,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.40.154
country_id: 6252001
description:
[2026-06-08 05:59:34 +0000] info [cpaneld] 104.207.40.154 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-08 05:58:54 +0000] info [cpaneld] 134.195.83.78 NEW aluaddvimor:sE6FY2JGJYJ02OTO address=134.195.83.78,app=cpaneld,creator=aluaddvimor,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-08 06:00:32 +0000] info [cpaneld] 134.195.82.55 NEW marketplacenetma:lHDmbO21an2hPJ3u address=134.195.82.55,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-08 06:00:02 +0000] info [cpaneld] 107.175.5.43 NEW ruuwezvf:dk7L0KQ5kCSaRUq_ address=107.175.5.43,app=cpaneld,creator=ruuwezvf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-08 06:01:21 +0000] info [cpaneld] 64.44.59.102 NEW rqgqpxof:4RXqqkEkROBHgeaU address=64.44.59.102,app=cpaneld,creator=rqgqpxof,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-08 06:01:36 +0000] info [cpaneld] 216.189.152.23 - jmtctoni "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-08 06:01:09 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:47384: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-01.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.229.214.92
country_id: 1562822
description:
2026-06-08 06:02:06 dovecot_plain authenticator failed for H=(0meflad4dk66b2gumlt8mmuz96) [171.229.214.92]:47815: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-08 06:02:34 +0000] info [cpaneld] 5.230.153.185 NEW qfsioddr:Pla6zvdZMjrZfz3p address=5.230.153.185,app=cpaneld,creator=qfsioddr,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Crown Reward eropolik.blogspot.ae m0||Email:shajipappan137@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-08 06:02:20 +0000] info [cpaneld] 5.231.64.90 NEW sbstwrzw:tsSHyw28MnmRb_JM address=5.231.64.90,app=cpaneld,creator=sbstwrzw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-08 06:03:15 +0000] info [cpaneld] 5.230.153.169 NEW mlsbilese:novrL8ZfPiUM94B8 address=5.230.153.169,app=cpaneld,creator=mlsbilese,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.153
country_id: 6252001
description:
[2026-06-08 06:03:37 +0000] info [cpaneld] 173.211.88.153 NEW hgfdcvbnk:nFP6MgdcNVIkTmpY address=173.211.88.153,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [08/Jun/2026:06:03:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328470&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccination-covid-19-en-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780898634 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccination-covid-19-en-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 06:04:28 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.169
country_id: 6252001
description:
[2026-06-08 06:04:33 +0000] info [cpaneld] 64.44.62.169 NEW netfreenet:BoiqWIPF4OD7Rf6Z address=64.44.62.169,app=cpaneld,creator=netfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.121
country_id: 6252001
description:
[2026-06-08 06:04:05 +0000] info [cpaneld] 134.195.83.121 NEW discover:pbK4QVLezeyZXxLa address=134.195.83.121,app=cpaneld,creator=discover,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.125
country_id: 2635167
description:
[2026-06-08 06:05:26 +0000] info [cpaneld] 5.230.153.125 NEW vejjghdd:aaWx2ghvPM1HtOHl address=5.230.153.125,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.232.131.13
country_id: 3996063
description:
149.232.131.13 - - [08/Jun/2026:06:05:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117207&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D2266&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780898739 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=2266" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.232.131.13


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-08 06:04:55 +0000] info [cpaneld] 5.231.64.56 NEW newistm:3dQJ3IfUsSogKjtc address=5.231.64.56,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-08 06:05:44 +0000] info [cpaneld] 64.44.62.229 NEW xodjvari:3AiknMkc9O7ox7pt address=64.44.62.229,app=cpaneld,creator=xodjvari,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.102.50.25
country_id: 1269750
description:
Jun  8 06:06:36 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.102.50.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-08 06:06:30 +0000] info [cpaneld] 107.175.5.177 NEW steotrv:zF4EQynclm54Zq1p address=107.175.5.177,app=cpaneld,creator=steotrv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jun  8 06:07:15 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-06-08 06:07:36 +0000] info [cpaneld] 5.231.64.68 NEW zxtqbmmj:UR6tDjAF0SRDeQqq address=5.231.64.68,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.163
country_id: 3017382
description:
[2026-06-08 06:07:02 +0000] info [cpaneld] 5.231.255.163 NEW ncbakalw:ceLpZFfyIA0nV3pL address=5.231.255.163,app=cpaneld,creator=ncbakalw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Jun  8 06:07:08 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-06-08 06:07:17 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:16850: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.78
country_id: 3017382
description:
[2026-06-08 06:07:18 +0000] info [cpaneld] 5.231.255.78 NEW sbkrhjex:y6IbaiNcFov5XjQz address=5.231.255.78,app=cpaneld,creator=sbkrhjex,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-08 06:06:58 +0000] info [cpaneld] 5.231.255.112 - pmalabvi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-08 06:08:17 +0000] info [cpaneld] 5.230.133.34 - qjzcsoob "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.36.7
country_id: 1269750
description:
2026-06-08 06:08:12 dovecot_plain authenticator failed for H=(58F1THHLM15) [103.81.36.7]:54443: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-08 06:08:21 +0000] info [cpaneld] 64.44.62.24 NEW sahamtg:stiBP8g7qL4mmtvm address=64.44.62.24,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-08 06:08:33 +0000] info [cpaneld] 64.44.59.71 NEW lybbyhoq:cr9cJWFvXly9NTXN address=64.44.59.71,app=cpaneld,creator=lybbyhoq,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.36.7
country_id: 1269750
description:
Jun  8 06:08:10 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.36.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-06-08 06:09:27 +0000] info [cpaneld] 64.44.59.166 NEW fagowrlx:bJnTCvygu3P64yPN address=64.44.59.166,app=cpaneld,creator=fagowrlx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-08 06:10:35 +0000] info [cpaneld] 173.211.89.138 NEW sodigaz:iGdVFAbZLiBmw0O9 address=173.211.89.138,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-08 06:10:18 +0000] info [cpaneld] 107.175.5.140 NEW pkyvzjjc:IPgYsybD_5bdMyuw address=107.175.5.140,app=cpaneld,creator=pkyvzjjc,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-08 06:10:29 +0000] info [cpaneld] 5.230.133.152 - sxoyfjqv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.19
country_id: 6252001
description:
[2026-06-08 06:11:40 +0000] info [cpaneld] 64.44.59.19 NEW jdzxeovw:Ke6Bz2H8vr35Pb54 address=64.44.59.19,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-08 06:10:53 +0000] info [cpaneld] 134.195.83.16 NEW aneos:TXvWRAjY1wP98NEz address=134.195.83.16,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-08 06:11:53 +0000] info [cpaneld] 5.230.153.74 NEW sotragonet:Jc9XXEwqDMxo1js8 address=5.230.153.74,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-08 06:12:38 +0000] info [cpaneld] 173.211.89.232 - waywcbyw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-08 06:12:44 +0000] info [cpaneld] 5.175.229.192 - atddem "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-08 06:13:19 +0000] info [cpaneld] 5.230.133.158 - ulduzncs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-08 06:13:23 +0000] info [cpaneld] 5.230.133.56 NEW hphhdcxi:mIyj8iJmwblhfYgc address=5.230.133.56,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-08 06:13:35 +0000] info [cpaneld] 5.231.64.143 NEW naduwpdk:gqIYn6ZUtvnvmRMc address=5.231.64.143,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 81.91.185.45
country_id: 1522867
description:
2026-06-08 06:12:56 H=([0.0.0.0]) [81.91.185.45]:55382 F=<John@4452.com> rejected RCPT <contractor@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-08 06:14:05 +0000] info [cpaneld] 5.230.153.208 - wttzshhf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.96.87.147
country_id: 1522867
description:
2026-06-08 06:14:14 H=([212.96.87.147]) [212.96.87.147]:39232 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-06-08 06:14:23 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:47978: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.67
country_id: 6252001
description:
[2026-06-08 06:14:46 +0000] info [cpaneld] 107.175.5.67 NEW qledpnjw:5Gzl4DO0BAizI_An address=107.175.5.67,app=cpaneld,creator=qledpnjw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Jun  8 06:14:21 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-08 06:14:29 +0000] info [cpaneld] 5.230.153.14 - cipvzfnv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User cipvzfnv has their account suspended. Login blocked.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.235.174.38
country_id: 2017370
description:
2026-06-08 06:15:15 H=([188.235.174.38]) [188.235.174.38]:45905 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-08 06:15:27 +0000] info [cpaneld] 5.230.153.211 NEW togorer:EaxqN2EAJHMAmk58 address=5.230.153.211,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-08 06:16:33 +0000] info [cpaneld] 5.230.153.48 - ezowcpdc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-08 06:16:49 +0000] info [cpaneld] 5.175.229.179 NEW yydrdvav:gg9lRww4aOK39k4W address=5.175.229.179,app=cpaneld,creator=yydrdvav,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 54.162.78.112
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\",\"chromium\";v=\"96\",\"google chrome\";v=\"96\",||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.182
country_id: 6252001
description:
[2026-06-08 06:17:35 +0000] info [cpaneld] 134.195.82.182 NEW aopsacai:dug64YfP4AaZ92Z9 address=134.195.82.182,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.156
country_id: 2635167
description:
[2026-06-08 06:18:13 +0000] info [cpaneld] 5.230.133.156 NEW wwayrzpl:tPkuqXX345Z5Xf5h address=5.230.133.156,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [08/Jun/2026:06:18:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143343&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frentree-scolaire-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899517 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rentree-scolaire-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.140
country_id: 6252001
domain: universcom.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/kqracgxh/public_html/.510584543159675.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.195
country_id: 6252001
description:
[2026-06-08 06:19:21 +0000] info [cpaneld] 64.44.62.195 NEW lecdsntn:srKNX4k_5RLKR7mQ address=64.44.62.195,app=cpaneld,creator=lecdsntn,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.14
country_id: 2635167
domain: net.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/netfreenet/public_html/.312007026982592.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-06-08 06:19:18 +0000] info [cpaneld] 5.230.133.215 NEW gsizyncj:qJZcNIx3bZL8YQQZ address=5.230.133.215,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.232
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/gsizyncj/public_html/.867372029733307.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [08/Jun/2026:06:19:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646430&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgbadamassi-obtient-master-professionnel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899559 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gbadamassi-obtient-master-professionnel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [08/Jun/2026:06:20:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856601&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbalema-kossivi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899635 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/balema-kossivi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [08/Jun/2026:06:20:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054036&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbruit-eleve-des-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899641 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bruit-eleve-des-eglises/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [08/Jun/2026:06:19:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816683&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899597 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [08/Jun/2026:06:20:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235989&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgbadamassi-obtient-master-professionnel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899605 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gbadamassi-obtient-master-professionnel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [08/Jun/2026:06:21:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922718&pdata=https%253A%252F%252Fsoena.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899697 HTTP/2.0" 302 0 soena.tg "https://soena.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [08/Jun/2026:06:20:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405268&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780899654 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.193.125.59
country_id: 1522867
description:
2026-06-08 06:22:32 H=([0.0.0.0]) [85.193.125.59]:13462 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-08 06:22:34 +0000] info [cpaneld] 5.230.153.48 NEW sodigaz:JIEQ4E9_cGGMxrTb address=5.230.153.48,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-08 06:22:40 +0000] info [cpaneld] 5.230.153.154 NEW moodlefreenetmas:RnUg6mkOe6y5LjXz address=5.230.153.154,app=cpaneld,creator=moodlefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-08 06:22:29 +0000] info [cpaneld] 5.231.64.159 NEW sodigaz:6MNcoLnm__P02Ga1 address=5.231.64.159,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.115
country_id: 1512440
description:
2026-06-08 06:23:15 H=([213.230.92.115]) [213.230.92.115]:41921 F=<John@4452.com> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.152
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.448958254070607.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.14
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.771355126105138.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-08 06:25:49 +0000] info [cpaneld] 5.230.153.14 NEW fagowrlx:P8OkOrUWFAb2AQln address=5.230.153.14,app=cpaneld,creator=fagowrlx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-08 06:25:43 +0000] info [cpaneld] 5.230.153.26 NEW mibdwfeh:o7lnyFzUCkMo2HW1 address=5.230.153.26,app=cpaneld,creator=mibdwfeh,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.208
country_id: 2635167
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.846943115706605.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-08 06:25:34 +0000] info [cpaneld] 5.230.153.42 NEW usrcbecb7:hDe__jEYYtq90kYb address=5.230.153.42,app=cpaneld,creator=usrcbecb7,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-08 06:25:11 +0000] info [cpaneld] 173.211.89.232 NEW ylhgcaui:gERyhgPt7qjyKKFe address=173.211.89.232,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.148
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.936810079575931.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.151
country_id: 6252001
description:
[2026-06-08 06:25:12 +0000] info [cpaneld] 173.211.89.151 NEW ylhgcaui:ieEf537JuKCzKpho address=173.211.89.151,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-08 06:26:02 +0000] info [cpaneld] 5.230.153.167 NEW moodlefreenetmas:qz5rQxO_XWAno4nj address=5.230.153.167,app=cpaneld,creator=moodlefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-08 06:26:10 +0000] info [cpaneld] 5.230.133.135 NEW matinlib:wCVmO9PREfa_nEmi address=5.230.133.135,app=cpaneld,creator=matinlib,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.31
country_id: 6252001
description:
[2026-06-08 06:26:17 +0000] info [cpaneld] 134.195.83.31 NEW vuvwskxh:kLKDfBKcSPWhrWBX address=134.195.83.31,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-08 06:26:07 +0000] info [cpaneld] 134.195.82.52 NEW sbstwrzw:K4TbwCrfhtuD5QlD address=134.195.82.52,app=cpaneld,creator=sbstwrzw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-08 06:26:14 +0000] info [cpaneld] 5.175.229.192 NEW iccrailoma:xkyejcPEHYVYygJL address=5.175.229.192,app=cpaneld,creator=iccrailoma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-08 06:25:55 +0000] info [cpaneld] 64.44.59.151 NEW ncbakalw:91RTvOT7pc_BXxVo address=64.44.59.151,app=cpaneld,creator=ncbakalw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.240
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/gsizyncj/public_html/.089320051097125.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.23
country_id: 6252001
domain: net.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/netfreenet/public_html/.684895158636089.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.245
country_id: 3017382
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.011738605997330.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.38
country_id: 1269750
description:
Jun  8 06:27:49 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun  8 06:27:44 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-06-08 06:27:51 dovecot_login authenticator failed for H=([122.187.230.38]) [122.187.230.38]:49923: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun  8 06:28:17 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  8 06:28:17 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun  8 06:28:35 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun  8 06:27:59 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  8 06:29:13 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.33
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:163.198.109.33||TA:163.198.109.33||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun  8 06:28:59 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.234
country_id: 2328926
description:
2026-06-08 06:33:48 dovecot_plain authenticator failed for H=(T8FWR3M6R) [41.207.248.234]:64187: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-08 06:33:37 +0000] info [cpaneld] 173.211.89.140 NEW formationfreenet:DzqXGOLv9dYyivnT address=173.211.89.140,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.234
country_id: 2328926
description:
2026-06-08 06:33:54 dovecot_login authenticator failed for H=(T8FWR3M6R) [41.207.248.234]:64187: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2026-06-08 06:36:47 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [200.159.14.187]:44993: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.73.101.205
country_id: 1168579
description:
2026-06-08 06:37:05 dovecot_plain authenticator failed for H=static-host119-73-101-205.link.net.pk (6LCBR6) [119.73.101.205]:52226: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 134.195.83.86
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: Hidden file access||RSV:8.14||T:APACHE||QS:to=michaelbaraloki@universitasnasional506.onmicrosoft.com||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:06:39:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327960&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780900789 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-08 06:39:46 +0000] info [cpaneld] 173.211.88.116 NEW dvhzmira:8PlMGwP3L9AVFFjS address=173.211.88.116,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [08/Jun/2026:06:39:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866839&pdata=http%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780900788 HTTP/1.1" 302 0 cfpj.tg "http://cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-08 06:40:19 +0000] info [cpaneld] 5.230.133.148 NEW njdbfcnn:Bk9mlxC8l5Xrg3ZG address=5.230.133.148,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:06:40:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6317158&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780900842 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-08 06:40:04 +0000] info [cpaneld] 5.230.133.158 NEW discover:_CPrONQ3bVqS4K8G address=5.230.133.158,app=cpaneld,creator=discover,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-08 06:39:52 +0000] info [cpaneld] 134.195.83.234 NEW ifxmoxbf:pMJ55Fb0u7mPmBT9 address=134.195.83.234,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-08 06:40:28 +0000] info [cpaneld] 5.230.153.208 NEW zabtjxvu:OB28_M4xdwJzRvHE address=5.230.153.208,app=cpaneld,creator=zabtjxvu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-08 06:40:04 +0000] info [cpaneld] 64.44.59.157 NEW discover:zmZms5yTPCGJmJaf address=64.44.59.157,app=cpaneld,creator=discover,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.223.242.210
country_id: 2750405
description:
159.223.242.210 - - [08/Jun/2026:06:44:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985414&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901053 HTTP/2.0" 302 0 crepsad.tg "https://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.223.242.210


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.24.61.113
country_id: 3439705
description:
2026-06-08 06:45:33 dovecot_plain authenticator failed for H=r179-24-61-113.dialup.adsl.anteldata.net.uy (P756S1ACH72QLPV) [179.24.61.113]:60979: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.232
country_id: 3469034
description:
Jun  8 06:45:33 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.28
country_id: 1269750
description:
Jun  8 06:45:12 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.24.61.113
country_id: 3439705
description:
Jun  8 06:45:31 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.24.61.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.146.60.149
country_id: 2782113
description:
156.146.60.149 - - [08/Jun/2026:06:46:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170459&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fdon-boule-de-neige&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901178 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/tag/don-boule-de-neige" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.146.60.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 06:46:40 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:65184: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.96.241
country_id: 3469034
description:
Jun  8 06:47:49 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.96.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 06:48:45 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:57099: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.96.241
country_id: 3469034
description:
Jun  8 06:47:56 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.96.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 06:48:53 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:57102: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 06:49:55 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:57167: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 06:50:11 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:58142: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.173.88.233
country_id: 298795
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.213.83.159
country_id: 1643084
description:
[2026-06-08 06:52:22 +0000] info [cpaneld] 185.213.83.159 NEW titrisat:aEtMkmXqE4DhGiQq address=185.213.83.159,app=cpaneld,creator=titrisat,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 06:52:26 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 125.165.105.51
country_id: 1643084
description:
[2026-06-08 06:51:53 +0000] info [cpaneld] 125.165.105.51 NEW gsizyncj:p9gsjJIAFf0OMM0E address=125.165.105.51,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 06:52:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49503: 535 Incorrect authentication data (set_id=portal)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Primary-Member Extra eropolik.blogspot.hu Mr||Email:moro35956@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.83.124.221
country_id: 1210997
description:
2026-06-08 06:53:19 dovecot_plain authenticator failed for H=(56QUULLY) [202.83.124.221]:62424: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.217
country_id: 2635167
domain: afrique-distribution.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/sadis/public_html/.821561997733473.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.249
country_id: 1512440
description:
2026-06-08 06:54:49 H=([213.230.87.249]) [213.230.87.249]:13249 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.146.38.155
country_id: 1814991
description:
2026-06-08 06:53:56 H=([0.0.0.0]) [183.146.38.155]:9172 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [08/Jun/2026:06:54:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801520&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdon-de-mawu-fe-nuse-au-ceg-attikpa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901689 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/don-de-mawu-fe-nuse-au-ceg-attikpa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.145.218.158
country_id: 1733045
domain: anamek.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:41140.anamek.tg||ServerName:anamek.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c6a825d1667fc869b183a6df8bc8d5306c356a2||Title:0xd43e500b||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.66.70
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/faure-gnassingbe-en-mission-de-paix-a-kigali/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-08 06:56:36 +0000] info [cpaneld] 5.230.153.254 NEW steotrv:KjnyVpZR37EJjVi5 address=5.230.153.254,app=cpaneld,creator=steotrv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.178
country_id: 6252001
description:
[2026-06-08 06:56:42 +0000] info [cpaneld] 216.189.152.178 NEW pjwfvzan:SA_r0Y6NhkDhMYjh address=216.189.152.178,app=cpaneld,creator=pjwfvzan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:06:57:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791595&pdata=http%253A%252F%252Fmail.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901821 HTTP/1.1" 302 0 mail.test.free.netmaster.tg "http://mail.test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:06:57:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121154&pdata=http%253A%252F%252Ftest.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901823 HTTP/1.1" 302 0 test.free.netmaster.tg "http://test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:06:57:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931354&pdata=http%253A%252F%252Fwebmail.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901825 HTTP/1.1" 302 0 webmail.test.free.netmaster.tg "http://webmail.test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun  8 06:57:15 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.166
country_id: 1269750
description:
Jun  8 06:57:39 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.166 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:06:57:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737879&pdata=http%253A%252F%252Fwebdisk.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901822 HTTP/1.1" 302 0 webdisk.test.free.netmaster.tg "http://webdisk.test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:06:57:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805158&pdata=http%253A%252F%252Fwebdisk.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780901877 HTTP/1.1" 302 0 webdisk.test.free.netmaster.tg "http://webdisk.test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 85.12.29.33
country_id: 6251999
description:
Jun  8 07:00:47 ns5 pure-ftpd[518311]: (?@85.12.29.33) [WARNING] Authentication failed for user [czqxxxnu]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 85.12.29.33
country_id: 6251999
description:
Jun  8 07:00:56 ns5 pure-ftpd[518394]: (?@85.12.29.33) [WARNING] Authentication failed for user [esso]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 07:07:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57385: 535 Incorrect authentication data (set_id=portal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 07:06:59 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.132.117.163
country_id: 587116
description:
2026-06-08 07:07:14 H=([85.132.117.163]) [85.132.117.163]:12000 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.179
country_id: 2635167
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.601327708746330.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-08 07:08:57 +0000] info [cpaneld] 5.230.133.16 NEW hphhdcxi:GR4uh7TbEy2vCtdv address=5.230.133.16,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.4
country_id: 3017382
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.758635111121601.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-08 07:13:24 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:49550: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 85.12.29.33
country_id: 6251999
description:
Jun  8 07:13:36 ns5 pure-ftpd[528273]: (?@85.12.29.33) [WARNING] Authentication failed for user [afxvhoxo]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 07:14:50 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun  8 07:14:17 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-08 07:14:39 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:VI0T0kMx7mnK1FaG address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - visite@cloud-et-racks.tg [06/08/2026:07:15:03 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: visite@cloud-et-racks.tg


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.15.33
country_id: 6252001
description:
Jun  8 07:15:11 ns5 pure-ftpd[529769]: (?@45.38.15.33) [WARNING] Authentication failed for user [czqxxxnu]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 07:14:57 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Rank Bonus bonotdamvam.blogspot.ru fz||Email:oflawless504@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.222.231.34
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b67fb035d1bf8750374913033906223c4a548c7||Title:gh63v9kazt48rdk4o||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.132.117.163
country_id: 587116
description:
2026-06-08 07:16:52 H=([85.132.117.163]) [85.132.117.163]:12697 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-08 07:18:38 +0000] info [cpaneld] 5.230.133.34 NEW wwayrzpl:rL74aThSiZ0TcLUv address=5.230.133.34,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-08 07:18:45 +0000] info [cpaneld] 64.44.62.223 NEW sahamtg:q_QDnf2PGKzPcW6Q address=64.44.62.223,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-08 07:18:40 +0000] info [cpaneld] 216.189.152.23 NEW yydrdvav:HT6KZtLRkWZVPh5F address=216.189.152.23,app=cpaneld,creator=yydrdvav,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.233
country_id: 2635167
description:
[2026-06-08 07:18:52 +0000] info [cpaneld] 5.230.133.233 NEW marketplacenetma:3u9_Tr70L4AcXzoY address=5.230.133.233,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-08 07:19:20 +0000] info [cpaneld] 64.44.62.240 NEW nxpivbcy:0YW6dBOYw7lztf6f address=64.44.62.240,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.86
country_id: 6252001
description:
[2026-06-08 07:19:08 +0000] info [cpaneld] 134.195.83.86 NEW formationfreenet:ERf0yo7XIQZ66U9t address=134.195.83.86,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.217
country_id: 2635167
description:
[2026-06-08 07:18:52 +0000] info [cpaneld] 5.230.153.217 NEW marketplacenetma:x0Nf5PPiPRiEf9hx address=5.230.153.217,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [08/Jun/2026:07:20:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063144&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgbadamassi-obtient-master-professionnel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903211 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gbadamassi-obtient-master-professionnel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [08/Jun/2026:07:20:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015658&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903204 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [08/Jun/2026:07:22:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054499&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkoc-university%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903321 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/koc-university/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [08/Jun/2026:07:22:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051624&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbruit-eleve-des-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903327 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bruit-eleve-des-eglises/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [08/Jun/2026:07:22:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515864&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkoc-university%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903365 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/koc-university/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [08/Jun/2026:07:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131613&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaster-en-litterature-anglophone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903429 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/master-en-litterature-anglophone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.251.26.165
country_id: 1522867
description:
2026-06-08 07:24:30 H=([5.251.26.165]) [5.251.26.165]:17733 F=<John@4452.com> rejected RCPT <admin@soena.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.69
country_id: 1512440
description:
2026-06-08 07:26:38 H=([213.230.87.69]) [213.230.87.69]:26185 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.11.117
country_id: 6252001
description:
[2026-06-08 07:27:35 +0000] info [cpaneld] 65.111.11.117 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  8 07:29:45 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.29.144.142
country_id: 1522867
description:
2026-06-08 07:29:36 H=([85.29.144.142]) [85.29.144.142]:56027 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  8 07:29:53 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-08 07:31:25 +0000] info [cpaneld] 5.230.153.179 NEW netfreenet:CJlFQctup6liPWwb address=5.230.153.179,app=cpaneld,creator=netfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  8 07:31:12 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.12.169.169
country_id: 1819730
description:
119.12.169.169 - - [08/Jun/2026:07:32:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791084&pdata=https%253A%252F%252Flaunetogo.tg%252Fjournee-mondiale-de-leau-le-togo-appelle-a-laction-pour-un-acces-equitable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780903921 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/journee-mondiale-de-leau-le-togo-appelle-a-laction-pour-un-acces-equitable/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.12.169.169


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.28.179
country_id: 6251999
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:104.252.28.179||TA:104.252.28.179||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.171.71
country_id: 6252001
description:
[2026-06-08 07:34:00 +0000] info [cpaneld] 209.50.171.71 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.214.16.246
country_id: 3658394
description:
2026-06-08 07:36:28 dovecot_plain authenticator failed for H=246.16.214.190.static.anycast.cnt-grms.ec (dgdn-togo.tg) [190.214.16.246]:35531: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.248.14.220
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:109.248.14.220||TA:109.248.14.220||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.252
country_id: 3686110
description:
2026-06-08 07:36:20 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [201.46.124.252]:2558: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.54.253
country_id: 3017382
description:
2026-06-08 07:37:50 dovecot_plain authenticator failed for H=ip253.ip-5-196-54.eu (zjpzqku67itqmtw5sm6wnt8exu1h9iz) [5.196.54.253]:46544: 535 Incorrect authentication data (set_id=alfred.aguim@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  8 07:38:16 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Favorable Game Prize vamvozmviigr.blogspot.de 3l||Email:tarynsmith111@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-40.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.29.144.142
country_id: 1522867
description:
2026-06-08 07:40:34 H=([85.29.144.142]) [85.29.144.142]:56133 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.34.5.79
country_id: 6252001
description:
2026-06-08 07:40:43 dovecot_plain authenticator failed for H=ec2-52-34-5-79.us-west-2.compute.amazonaws.com (ux3nn2oj2n18slfcgy4gsbnu) [52.34.5.79]:40062: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  8 07:41:03 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.58.193
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-un-nouveau-cadre-juridique-pour-la-concurrence-et-la-protection-des-consommateurs/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.31.20.12
country_id: 6252001
description:
[2026-06-08 07:42:26 +0000] info [cpaneld] 64.31.20.12 - qnlprotv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [08/Jun/2026:07:42:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157783&pdata=http%253A%252F%252F4hssjy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780904572 HTTP/1.1" 302 0 4hssjy.mediatopnews.tg "http://4hssjy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 07:42:58 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 07:43:00 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49333: 535 Incorrect authentication data (set_id=portal)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.233.183.177
country_id: 1814991
description:
49.233.183.177 - - [08/Jun/2026:07:45:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907796&pdata=http%253A%252F%252Fwww.letabloid.tg%252F2025%252F08%252F28%252Flatc-soutient-lenquete-du-synphot-sur-laccueil-dans-les-hopitaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780904750 HTTP/1.1" 302 0 www.letabloid.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.4 Mobile/15A372 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.233.183.177


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 5.135.140.47
country_id: 3017382
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.164.183.202
country_id: 1831722
description:
[2026-06-08 07:50:05 +0000] info [cpaneld] 103.164.183.202 - aifkjzqm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.64.246.8
country_id: 690791
description:
Jun  8 07:50:06 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.64.246.8 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.202
country_id: 1831722
description:
[2026-06-08 07:50:09 +0000] info [cpaneld] 103.164.183.202 NEW aifkjzqm:_Yh5ykUhAhCIRnwh address=103.164.183.202,app=cpaneld,creator=aifkjzqm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [08/Jun/2026:07:51:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383819&pdata=http%253A%252F%252Fmail.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780905097 HTTP/1.1" 302 0 mail.test.free.netmaster.tg "http://mail.test.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 07:53:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52014: 535 Incorrect authentication data (set_id=share)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.95
country_id: 3996063
description:
Jun  8 07:52:52 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.48.193.15
country_id: 1168579
description:
2026-06-08 07:52:59 dovecot_plain authenticator failed for H=(V4836VC8A) [39.48.193.15]:53496: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 07:53:44 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-08 07:54:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36714: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-06-08 07:54:30 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:39542: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.185.27.143
country_id: 1819730
description:
89.185.27.143 - - [08/Jun/2026:07:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131305&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fwp-admin%252Fcss%252Fcolors%252Fblue%252Fclasa99.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780905268 HTTP/2.0" 302 0 haplucia-togo.tg "https://www.bing.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.185.27.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
country_id: 1814991
description:
Jun  8 07:54:28 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.158.166.144
country_id: 1814991
description:
2026-06-08 07:55:09 dovecot_login authenticator failed for H=(hSjUpZV) [180.158.166.144]:60942: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.133.0
country_id: 1168579
description:
2026-06-08 07:55:59 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [154.192.133.0]:14572: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.154.202
country_id: 1655842
description:
2026-06-08 07:56:32 dovecot_login authenticator failed for H=([202.137.154.202]) [202.137.154.202]:38724: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.212
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.446452734446492.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  8 07:56:45 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [08/Jun/2026:07:56:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710941&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finhumation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780905388 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inhumation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun  8 07:56:24 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun  8 07:56:29 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.137.154.202
country_id: 1655842
description:
Jun  8 07:56:30 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.137.154.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.187.65.135
country_id: 1814991
description:
Jun  8 07:57:11 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.187.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.181.138
country_id: 3469034
description:
Jun  8 07:57:50 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  8 07:56:52 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 07:56:51 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  8 07:57:21 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jun  8 07:57:37 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Jun  8 07:57:46 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [08/Jun/2026:07:57:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542294&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaster-en-litterature-anglophone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780905431 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/master-en-litterature-anglophone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.12
country_id: 1269750
description:
2026-06-08 07:57:14 dovecot_login authenticator failed for H=(nsg-corporate-12.230.187.122.airtel.in) [122.187.230.12]:41692: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun  8 07:57:19 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.137.154.202
country_id: 1655842
description:
Jun  8 07:57:02 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.137.154.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.220.10.60
country_id: 1269750
description:
Jun  8 07:57:01 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.220.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.14.134
country_id: 1269750
description:
Jun  8 07:57:40 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.14.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun  8 07:57:12 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun  8 07:56:58 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun  8 07:57:31 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [08/Jun/2026:07:57:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132124&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780905462 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun  8 07:58:06 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun  8 07:58:09 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.58.204
country_id: 1835841
description:
Jun  8 07:58:15 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.58.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun  8 07:58:26 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.220.10.60
country_id: 1269750
description:
Jun  8 07:58:39 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.220.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun  8 07:57:54 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 07:57:59 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
country_id: 1814991
description:
Jun  8 07:58:10 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun  8 07:58:14 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Jun  8 07:58:26 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
country_id: 1835841
description:
Jun  8 07:58:45 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun  8 07:58:48 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.137.154.202
country_id: 1655842
description:
Jun  8 07:58:08 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.137.154.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.149.59
country_id: 6252001
description:
Jun  8 07:58:11 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.149.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.104.153.51
country_id: 1814991
description:
Jun  8 07:57:52 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.104.153.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun  8 07:58:59 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun  8 07:59:02 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun  8 07:59:46 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.220.10.60
country_id: 1269750
description:
Jun  8 07:58:56 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.220.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.187.65.135
country_id: 1814991
description:
Jun  8 07:58:57 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.187.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [08/Jun/2026:07:59:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856149&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaster-en-litterature-anglophone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780905571 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/master-en-litterature-anglophone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 07:59:14 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.14.134
country_id: 1269750
description:
Jun  8 07:59:28 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.14.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Jun  8 07:58:53 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  8 07:59:44 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun  8 07:59:46 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
country_id: 1819730
description:
Jun  8 07:59:52 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.149.59
country_id: 6252001
description:
Jun  8 08:00:07 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.149.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun  8 08:00:36 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.58.204
country_id: 1835841
description:
Jun  8 07:59:52 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.58.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun  8 07:59:53 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.220.10.60
country_id: 1269750
description:
Jun  8 07:59:53 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.220.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.93.156.3
country_id: 1269750
description:
Jun  8 08:00:25 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.93.156.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 145.255.160.105
country_id: 1522867
description:
2026-06-08 08:01:12 H=([145.255.160.105]) [145.255.160.105]:8514 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.187.65.135
country_id: 1814991
description:
Jun  8 08:01:18 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.187.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun  8 08:01:00 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-08 08:03:23 H=([127.0.0.1]) [161.35.78.120]:41304 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <pouweyemalice8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.111.175
country_id: 1512440
description:
2026-06-08 08:04:14 H=([213.230.111.175]) [213.230.111.175]:49373 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.114.2.75
country_id: 2017370
description:
2026-06-08 08:04:27 dovecot_plain authenticator failed for H=msk-be-vm-proxy.steccom.net (i9gifufo7c7qhv12aotxqdkj) [82.114.2.75]:61826: 535 Incorrect authentication data (set_id=belmonde.zossou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 08:04:43 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 08:04:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60762: 535 Incorrect authentication data (set_id=share)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 145.255.160.105
country_id: 1522867
description:
2026-06-08 08:05:45 H=([145.255.160.105]) [145.255.160.105]:6314 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 08:05:00 +0000] info [webmaild] 196.171.46.177 - contact@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-08 08:06:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50454: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.111.175
country_id: 1512440
description:
2026-06-08 08:07:27 H=([213.230.111.175]) [213.230.111.175]:61106 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun  8 08:07:55 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.26.12.11
country_id: 2921044
description:
2.26.12.11 - - [08/Jun/2026:08:08:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459496&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2025%252F10%252F20%252Fla-feuille-de-route-du-maire-jean-pierre-fabre-pour-son-nouveau-mandat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780906111 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2025/10/20/la-feuille-de-route-du-maire-jean-pierre-fabre-pour-son-nouveau-mandat/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.26.12.11


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.128.134.82
country_id: 3017382
description:
Jun  8 08:10:39 ns5 pure-ftpd[575099]: (?@45.128.134.82) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.239.211.136
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-et-israel-consolident-leurs-relations-diplomatiques/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-08 08:11:26 +0000] info [cpaneld] 107.175.5.35 NEW dvhzmira:3Pn9nQkTNYQ2gjYh address=107.175.5.35,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 08:14:48 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.172.238
country_id: 2363686
description:
[2026-06-08 08:14:17 +0000] info [cpaneld] 102.64.172.238 NEW sxoyfjqv:c_MrIqQ_BqNePgMk address=102.64.172.238,app=cpaneld,creator=sxoyfjqv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.186.50
country_id: 3175395
description:
[2026-06-08 08:18:02 +0000] info [cpaneld] 209.50.186.50 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.110.60
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:163.198.110.60||TA:163.198.110.60||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.98
country_id: 6252001
description:
[2026-06-08 08:23:19 +0000] info [cpaneld] 107.175.5.98 NEW sahamtg:NFKWoicBj_m6fgLw address=107.175.5.98,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.178.6
country_id: 3469034
description:
2026-06-08 08:24:17 dovecot_login authenticator failed for H=([187.8.89.114]) [186.238.178.6]:35929: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.178.6
country_id: 3469034
description:
Jun  8 08:24:15 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.178.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.24.247
country_id: 2363686
description:
[2026-06-08 08:25:58 +0000] info [webmaild] 196.169.24.247 - benjamin.bahe@togointerim.net "POST /cpsess5127477712/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.46.177] != Current IP Address [196.169.24.247]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun  8 08:26:18 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.12
country_id: 1269750
description:
2026-06-08 08:26:20 dovecot_login authenticator failed for H=([122.187.230.12]) [122.187.230.12]:41684: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Protected Money sepoladi.blogspot.tw 5T||Email:eduardoarone2016@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-28.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.243.191.142
country_id: 1643084
description:
2026-06-08 08:32:10 dovecot_plain authenticator failed for H=(1VT5KO7) [180.243.191.142]:31598: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-08 08:33:12 +0000] info [whostmgrd] 80.248.64.198 NEW root:Ad_pKy2lnEPcwf75 address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 102.212.94.42
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.14||T:APACHE||User:tqbcalqt||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.243.173.65
country_id: 2963597
domain: macite.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.212.94.42
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=50&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.16.231
country_id: 3469034
description:
Jun  8 08:34:22 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.16.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.212.94.42
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/17?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (39.38.211.147) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:faf99e955f888f2b5d5d8365e68ba77afd922630||Title:qrgxke78d7jn63zm||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.152
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.692604038229482.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:44165aff424513df1373f25a26b603fc3d134c88||Title:k917zmd9yq1l0s04j||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8dd3a8df16231fec6791c2331aee15b315fe72ae||Title:yqgi10h6fmdaqm||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [08/Jun/2026:08:39:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13398123&pdata=https%253A%252F%252Fekeasarl.com%252Fa-propos%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780907945 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/a-propos/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 08:40:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:56796: 535 Incorrect authentication data (set_id=share)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b76dacbfa47f79cc8c7006e3be16e7697d1dff41||Title:bqugnknoyy5dl0q0n0||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 08:40:28 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b6ccf76a2da919976841fcd03af493a05a6dbd8||Title:amf6t94sfnnsg8||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:08:41:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776682&pdata=http%253A%252F%252Fywxmm6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908105 HTTP/1.1" 302 0 ywxmm6.mediatopnews.tg "http://ywxmm6.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1218020a0ca05ef88efd2adc67b7c109cc7422d||Title:70fotj51bxmbbkl||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:08:41:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857174&pdata=http%253A%252F%252Fywxmm6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908111 HTTP/1.1" 302 0 ywxmm6.mediatopnews.tg "http://ywxmm6.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f5e3a25e3d0460b9c7215065352c5a36a5952bc||Title:pagcskf9gq3vmvst||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [08/Jun/2026:08:43:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647496&pdata=https%253A%252F%252Fekeasarl.com%252Ffaqs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908186 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/faqs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.143.198.102
country_id: 1527747
description:
2026-06-08 08:43:08 dovecot_plain authenticator failed for H=(398XN2FAL8) [94.143.198.102]:52272: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [08/Jun/2026:08:44:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882009&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908285 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 08:43:53 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6aba0bd77b35df90fa433e6b1931842a2a7e6a87||Title:ofn12ru1oc9c8s9w4y||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84d750637398b26bbce9bc2d2e10414ba7f7c051||Title:q9dit8ax6xcd6px1l1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [08/Jun/2026:08:46:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658203&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908396 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7a3d2f91b74fedf43be7663c3b4d82811527291||Title:cqklo8yglde1crapst||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5096f899a8be644a617b62fa2062b28f268e9c0c||Title:5ve0dzbuz4ilr7o||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c2ad3bfd8e7066a4d96e67b38011b138fcae126||Title:7ifw8i946yl459||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun  8 08:48:14 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bff97c999b52a3856460a920ca03101777b11494||Title:e8kpkqlzux3f9k9d0||RSV:8.14||T:APACHE||


