# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:21:45:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198214&pdata=https%253A%252F%252Fcfpj.tg%252Fpresentation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041515 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/presentation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 21:44:38 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 21:44:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:50002: 535 Incorrect authentication data (set_id=db2user)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [09/Jun/2026:21:46:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881498&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041589 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.238.77
country_id: 6252001
description:
[2026-06-09 21:45:50 +0000] info [cpaneld] 216.26.238.77 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:21:46:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182693&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041609 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p>dans le cadre de la mise en \xc5\x93uvre du projet action climatique f\xc3\xa9ministe en afrique de l\xe2\x80\x99ouest (acf-ao), inades-formation togo lance un appel d\xe2\x80\x99offres pour la fourniture de mat\xc3\xa9riels et \xc3\xa9quipements agricoles r\xc3\xa9partis en huit lots, notamment des pirogues avec moteurs hors-bord, bornes de d\xc3\xa9limitation, abreuvoirs et mangeoires, filets de p\xc3\xaache et gilets de sauvetage, composti\xc3\xa8res, cong\xc3\xa9lateurs solaires, tricycle et grillages de protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les entreprises l\xc3\xa9galement constitu\xc3\xa9es et disposant des capacit\xc3\xa9s requises sont invit\xc3\xa9es \xc3\xa0 soumissionner. les dossiers d\xe2\x80\x99appel d\xe2\x80\x99offres peuvent \xc3\xaatre obtenus gratuitement par demande adress\xc3\xa9e \xc3\xa0 : <strong>procurement.togo@inadesfo.net</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les offres doivent \xc3\xaatre d\xc3\xa9pos\xc3\xa9es au si\xc3\xa8ge d\xe2\x80\x99inades-formation togo \xc3\xa0 lom\xc3\xa9 au plus tard le <strong>18 juin 2026 \xc3\xa0 15h00.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":23971,\"href\":\"https://tdn.tg/wp-content/uploads/2026/06/avis-acfao.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://tdn.tg/wp-content/uploads/2026/06/avis-acfao.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"avis acfao\"></object><a id=\"wp-block-file--media-3b63ebd2-3093-4573-bf8f-e371eae425f1\" href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-acfao.pdf\">avis acfao</a><a href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-acfao.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-3b63ebd2-3093-4573-bf8f-e371eae425f1\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.178
country_id: 6252001
description:
[2026-06-09 21:47:15 +0000] info [cpaneld] 216.189.152.178 NEW aopsacai:w9txs6oUEriu_Mzu address=216.189.152.178,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun  9 21:48:27 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:21:48:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580584&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcan-2021-reportee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041721 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/can-2021-reportee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:21:48:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13288802&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmali-tunisie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041733 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mali-tunisie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:21:50:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661547&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041822 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 21:49:41 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:21:50:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870535&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcan-2021-reportee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041802 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/can-2021-reportee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.6.1.153
country_id: 6254930
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:21:51:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171733&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmonseigneur-barrigah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/monseigneur-barrigah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.6.1.153
country_id: 6254930
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:21:51:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130797&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041880 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [09/Jun/2026:21:52:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015441&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fao-alliance-foundation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041959 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ao-alliance-foundation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:21:52:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789533&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-certificat-daptitude-professionnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041966 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-certificat-daptitude-professionnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:21:52:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158550&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-internationale-des-hommes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-internationale-des-hommes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.198
country_id: 1880251
description:
47.128.119.198 - - [09/Jun/2026:21:54:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908569&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10119&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042042 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10119" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.198


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-09 21:54:20 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:36228: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [09/Jun/2026:21:54:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855325&pdata=https%253A%252F%252Ftdn.tg%252Frepartition-centres-ecrit-ministere-economie-finances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042059 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/repartition-centres-ecrit-ministere-economie-finances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.121
country_id: 2413451
description:
Jun  9 21:53:41 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.121
country_id: 2413451
description:
Jun  9 21:55:08 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.121 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:21:54:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-internationale-des-hommes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042078 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-internationale-des-hommes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [09/Jun/2026:21:56:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793430&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042159 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-09 21:57:10 +0000] info [cpaneld] 64.44.59.157 NEW mgvybwur:CiqIx9QF8NYZFFHH address=64.44.59.157,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.46
country_id: 2635167
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.279441572044358.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:21:57:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724718&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042239 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:21:58:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142613&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [09/Jun/2026:21:59:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449005&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconseiller-special-du-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042340 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conseiller-special-du-chef-de-letat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:22:00:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260309&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042427 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.90
country_id: 6252001
description:
2026-06-09 22:00:43 dovecot_plain authenticator failed for H=(0lk9qygsmuqzts73i510g369my) [104.28.158.90]:42722: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:22:01:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842210&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042473 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:22:02:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052252&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepp-agokpo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042546 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epp-agokpo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:22:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117971&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dun-camion-citerne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042603 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dun-camion-citerne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:22:05:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985576&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasteur-awanyoh-mawuli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042709 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pasteur-awanyoh-mawuli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:22:05:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038407&pdata=https%253A%252F%252Fcfpj.tg%252Fcfpj-rapport-dactivite-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042712 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/cfpj-rapport-dactivite-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:22:05:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10395035&pdata=https%253A%252F%252Ftdn.tg%252Fcategory%252Factualites%252Fpage%252F51%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042722 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/category/actualites/page/51/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.149.21.12
country_id: 2750405
description:
193.149.21.12 - - [09/Jun/2026:22:05:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778516&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffaure-gnassingbe-trace-la-voie-dun-togo-souverain-et-resilient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042741 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/faure-gnassingbe-trace-la-voie-dun-togo-souverain-et-resilient/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.6979.1289 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.149.21.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:22:07:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869721&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-lome-nouvelle-licence-professionnelle-rentree-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042875 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-lome-nouvelle-licence-professionnelle-rentree-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-09 22:08:50 +0000] info [cpaneld] 5.230.153.38 NEW mbyqtkiw:OYW360FJi96Tmzhh address=5.230.153.38,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:22:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922970&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F3e-mandat-au-niger%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042943 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/3e-mandat-au-niger/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:22:09:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052708&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frenonciation-a-la-nationalite-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781042987 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/renonciation-a-la-nationalite-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.139.211.91
country_id: 6252001
description:
34.139.211.91 - - [09/Jun/2026:22:11:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144660&pdata=https%253A%252F%252Fblitta1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043086 HTTP/2.0" 302 0 blitta1.mairie.tg "https://blitta1.mairie.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.139.211.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:22:10:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079144&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjo-tokyo-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043050 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jo-tokyo-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.215
country_id: 3469034
description:
Jun  9 22:11:03 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.18.135
country_id: 3895114
domain: www.direct7.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:nrzector||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.139.211.91
country_id: 6252001
description:
34.139.211.91 - - [09/Jun/2026:22:11:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078152&pdata=https%253A%252F%252Fblitta1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043114 HTTP/2.0" 302 0 blitta1.mairie.tg "https://blitta1.mairie.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.139.211.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:22:11:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12882840&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043115 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [09/Jun/2026:22:12:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647652&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjo-tokyo-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043133 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jo-tokyo-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:22:13:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790043&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmalfrats-a-legbassito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043181 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/malfrats-a-legbassito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.17.86
country_id: 6252001
description:
[2026-06-09 22:12:58 +0000] info [cpaneld] 72.80.17.86 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:22:13:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684328&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-des-produits-petroliers-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043221 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-des-produits-petroliers-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:22:13:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015958&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeeper-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deeper-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:22:14:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000744&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043265 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:22:15:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791130&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-recrutement-unites-soins-peripheriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-recrutement-unites-soins-peripheriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:22:16:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327752&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcongres-mondial-de-la-jci-rabiatou-mamoudou-amadou-elue-vice-presidente-internationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043390 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/congres-mondial-de-la-jci-rabiatou-mamoudou-amadou-elue-vice-presidente-internationale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:22:17:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855429&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faffaire-madjoulba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043449 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/affaire-madjoulba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:22:16:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671777&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043405 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 20.241.164.5
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:Signature-Input||MV:sig1=(\"@authority\" \"signature-agent\");created=1781043486;expires=1781044086;keyid=\"ov3hdsa8jq39dpeyfvffn-cupnz9yni8ldvr-5leibm\";alg=\"ed25519\";tag=\"web-bot-auth\"||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.88.25
country_id: 3865483
description:
[2026-06-09 22:18:11 +0000] info [whostmgrd] 45.176.88.25 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 22:18:19 +0000] info [cpaneld] 103.65.237.227 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:22:18:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128217&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043511 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.9.123
country_id: 1880251
description:
43.134.9.123 - - [09/Jun/2026:22:18:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867874&pdata=https%253A%252F%252Flaunetogo.tg%252Ftous-ensemble-contre-la-poliomyelite-faites-vacciner-vos-enfants-du-12-au-14-mars%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043517 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/tous-ensemble-contre-la-poliomyelite-faites-vacciner-vos-enfants-du-12-au-14-mars/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.9.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:22:18:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738089&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043523 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 114.138.219.108
country_id: 1814991
description:
2026-06-09 22:18:46 H=([114.138.216.196]) [114.138.219.108]:14065 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
country_id: 294640
description:
Jun  9 22:18:51 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:22:20:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909850&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043637 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:22:21:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197661&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043672 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:22:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841755&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043694 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:22:23:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066069&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouvelles-nominations-au-ministere-du-commerce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043782 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouvelles-nominations-au-ministere-du-commerce/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 22:23:29 +0000] info [cpaneld] 103.65.237.227 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [09/Jun/2026:22:22:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672092&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouvelles-nominations-au-ministere-du-commerce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043770 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouvelles-nominations-au-ministere-du-commerce/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.253.156.50
country_id: 732800
description:
[2026-06-09 22:25:24 +0000] info [whostmgrd] 185.253.156.50 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 22:24:49 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 22:24:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57825: 535 Incorrect authentication data (set_id=db2user)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [09/Jun/2026:22:25:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396100&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781043916 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.61
country_id: 2921044
description:
Jun  9 22:26:22 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.61
country_id: 2921044
description:
2026-06-09 22:26:24 dovecot_plain authenticator failed for H=tor-exit-61.for-privacy.net (mmxjquxvbyix79gogplgajp214el0g5) [185.220.101.61]:46721: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:22:27:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987367&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-de-nestor-gansou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044036 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-de-nestor-gansou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:22:27:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000486&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044042 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:22:26:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184811&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-liste-fournitures-scolaires-2025-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044004 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-liste-fournitures-scolaires-2025-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:22:27:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209181&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-liste-fournitures-scolaires-2025-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044073 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-liste-fournitures-scolaires-2025-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:22:28:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12960915&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044092 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.140.218
country_id: 3017382
description:
Jun  9 22:28:18 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.65.140.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-06-09 22:28:20 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net ([200.223.200.26]) [82.65.140.218]:46802: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:22:28:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935980&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fglobal-trade-corporation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044131 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/global-trade-corporation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:22:29:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383215&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044155 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:22:29:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393702&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconseiller-special-du-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044175 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conseiller-special-du-chef-de-letat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:22:28:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208623&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dun-camion-citerne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044119 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dun-camion-citerne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [09/Jun/2026:22:28:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842314&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044124 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:22:31:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907804&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frenonciation-a-la-nationalite-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044262 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/renonciation-a-la-nationalite-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.101.64.6
country_id: 2017370
description:
5.101.64.6 - - [09/Jun/2026:22:31:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131866&pdata=https%253A%252F%252F154.70.82.244&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044290 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.101.64.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [09/Jun/2026:22:32:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328431&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fboston-university%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044332 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/boston-university/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:22:32:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933972&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044338 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:22:32:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066532&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frenonciation-a-la-nationalite-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044351 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/renonciation-a-la-nationalite-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:22:34:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6606026&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044439 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:22:34:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185110&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044458 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:22:33:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181506&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnotation-moodys-maintient-la-cote-de-credit-dafreximbank-a-baa1%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044428 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/notation-moodys-maintient-la-cote-de-credit-dafreximbank-a-baa1/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:22:33:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460057&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftribunaux-dinstance-a-competence-correctionnelle-et-civile-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044428 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tribunaux-dinstance-a-competence-correctionnelle-et-civile-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:22:35:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920345&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbande-darnaqueurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044515 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bande-darnaqueurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:22:35:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735256&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdimas-dzikodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044528 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dimas-dzikodo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.98.254
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/financement-ohada-lome-carrefour-de-lintegration-africaine/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [09/Jun/2026:22:35:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669763&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044535 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.98.254
country_id: 1512440
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/financement-ohada-lome-carrefour-de-lintegration-africaine/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [09/Jun/2026:22:35:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856300&pdata=https%253A%252F%252Ftogomedia24.tg%252F2023%252F06%252F18%252Ffootball-encore-une-can-sans-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044543 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2023/06/18/football-encore-une-can-sans-le-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.161.205.149
country_id: 2635167
domain: soroubat.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64873.soroubat.tg||ServerName:soroubat.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77b802f6da8579847f2f143b16dae26ac9c07e32||Title:0x0aacd576||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:22:35:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118234&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcomite-interministeriel-de-prevention-et-de-lutte-contre-lextremisme-violent%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044541 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/comite-interministeriel-de-prevention-et-de-lutte-contre-lextremisme-violent/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:22:37:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252433&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkokou-agbleta%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044642 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kokou-agbleta/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.241.36
country_id: 3469034
domain: v2.cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/v2.cfpj.tg/wp-admin/install.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 22:36:41 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53648: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [09/Jun/2026:22:36:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199980&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044598 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 22:36:39 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:22:37:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081755&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044662 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.118.82.50
country_id: 2542007
description:
196.118.82.50 - - [09/Jun/2026:22:37:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736484&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044669 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4604.1296 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.118.82.50


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [09/Jun/2026:22:38:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871833&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044681 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 22:38:08 +0000] info [cpaneld] 103.65.237.227 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:22:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130632&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-candidatures-bourses-chevening-angleterre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044654 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-candidatures-bourses-chevening-angleterre/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:22:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066885&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044656 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.217.169.90
country_id: 1527747
description:
2026-06-09 22:38:37 H=([178.217.169.90]) [178.217.169.90]:58738 F=<John@4452.com> rejected RCPT <realestate@confortis.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:22:38:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054765&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fzidane-et-cristiano-ronaldo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044738 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/zidane-et-cristiano-ronaldo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:22:39:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407890&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044750 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [09/Jun/2026:22:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777496&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fanniversaire-de-la-disparition-du-general-gnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044807 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/anniversaire-de-la-disparition-du-general-gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.22.0
country_id: 3469034
description:
2026-06-09 22:40:49 dovecot_plain authenticator failed for H=([198.23.185.222]) [45.178.22.0]:19470: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.71.54
country_id: 1512440
description:
2026-06-09 22:41:02 dovecot_plain authenticator failed for H=([198.23.185.222]) [84.54.71.54]:33432: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.221
country_id: 99237
description:
2026-06-09 22:41:17 dovecot_plain authenticator failed for H=([198.23.185.222]) [185.106.30.221]:64433: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:22:41:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869416&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044877 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.242.169.167
country_id: 2017370
description:
2026-06-09 22:41:31 dovecot_plain authenticator failed for H=([198.23.185.222]) [94.242.169.167]:5235: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.242.169.167
country_id: 2017370
description:
2026-06-09 22:41:38 dovecot_login authenticator failed for H=([198.23.185.222]) [94.242.169.167]:5235: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:22:41:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923228&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-recrutement-unites-soins-peripheriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781044902 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-recrutement-unites-soins-peripheriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.38.45.105
country_id: 290557
description:
2026-06-09 22:42:03 dovecot_plain authenticator failed for H=gprs-emirnet17377.emirates.net.ae ([198.23.185.222]) [5.38.45.105]:47134: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.122.1.32
country_id: 3865483
description:
2026-06-09 22:42:21 dovecot_plain authenticator failed for H=([198.23.185.222]) [186.122.1.32]:45562: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.249.31.44
country_id: 3469034
description:
2026-06-09 22:41:47 dovecot_plain authenticator failed for H=dynamic-186-249-31-44.telecominternet.net.br ([198.23.185.222]) [186.249.31.44]:33678: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.33.52.226
country_id: 3686110
description:
2026-06-09 22:43:17 dovecot_plain authenticator failed for H=([198.23.185.222]) [179.33.52.226]:43002: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.149.245.52
country_id: 690791
description:
2026-06-09 22:43:32 dovecot_plain authenticator failed for H=([198.23.185.222]) [45.149.245.52]:45048: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [09/Jun/2026:22:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145962&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmonseigneur-barrigah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045008 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/monseigneur-barrigah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.201.176
country_id: 1210997
description:
2026-06-09 22:42:38 dovecot_plain authenticator failed for H=([198.23.185.222]) [43.246.201.176]:49542: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.119.15.1
country_id: 6254930
description:
2026-06-09 22:42:55 dovecot_plain authenticator failed for H=([198.23.185.222]) [92.119.15.1]:54532: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.149.245.52
country_id: 690791
description:
2026-06-09 22:43:39 dovecot_login authenticator failed for H=([198.23.185.222]) [45.149.245.52]:45048: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:22:43:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726313&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftelevision-togolaise-tvt%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045022 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/television-togolaise-tvt/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.144.87.0
country_id: 1210997
description:
2026-06-09 22:43:49 dovecot_plain authenticator failed for H=([198.23.185.222]) [192.144.87.0]:35902: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.14.100.195
country_id: 6252001
description:
2026-06-09 22:44:19 dovecot_plain authenticator failed for H=d14-69-195-100.try.wideopenwest.com ([198.23.185.222]) [69.14.100.195]:37990: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.52.52.64
country_id: 2017370
description:
2026-06-09 22:44:34 dovecot_plain authenticator failed for H=([198.23.185.222]) [176.52.52.64]:2233: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:22:44:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251370&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyndicat-des-hommes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045073 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syndicat-des-hommes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.163.77.39
country_id: 2017370
description:
2026-06-09 22:44:05 dovecot_plain authenticator failed for H=([198.23.185.222]) [178.163.77.39]:39192: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [09/Jun/2026:22:44:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128981&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvisite-de-faure-gnassingbe-chez-mohamed-ould-cheikh-el-ghazouani%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045067 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/visite-de-faure-gnassingbe-chez-mohamed-ould-cheikh-el-ghazouani/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.148.62
country_id: 1733045
description:
2026-06-09 22:45:11 dovecot_plain authenticator failed for H=([198.23.185.222]) [161.142.148.62]:22511: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:22:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999303&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045118 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.8.11.116
country_id: 3625428
description:
2026-06-09 22:44:54 dovecot_plain authenticator failed for H=([198.23.185.222]) [200.8.11.116]:58148: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:22:45:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050906&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045100 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.52.52.64
country_id: 2017370
description:
2026-06-09 22:44:41 dovecot_login authenticator failed for H=([198.23.185.222]) [176.52.52.64]:2233: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.68
country_id: 1512440
description:
2026-06-09 22:45:07 H=([185.139.137.68]) [185.139.137.68]:52164 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 102.64.145.237
country_id: 2363686
domain: www.misstogo.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 16_7_16 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/604.1 musical_ly_45.4.0 BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.misstogo.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; SM-G990U2 Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/en ByteFullLocale/en Region/JM AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:22:46:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592402&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcanal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045175 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/canal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:22:45:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003927&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetat-durgence-sanitaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045149 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etat-durgence-sanitaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.64.8
country_id: 2017370
description:
45.91.64.8 - - [09/Jun/2026:22:46:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908104&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045208 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.8


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:22:46:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606250&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045214 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.68
country_id: 1512440
description:
2026-06-09 22:47:10 H=([185.139.137.68]) [185.139.137.68]:52166 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 22:47:33 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 22:47:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60520: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
country_id: 1819730
description:
Jun  9 22:47:20 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-06-09 22:47:22 dovecot_plain authenticator failed for H=69-172-79-198.static.imsbiz.com (ulcal) [69.172.79.198]:60282: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.86.234.242
country_id: 2921044
description:
[2026-06-09 22:47:51 +0000] info [whostmgrd] 217.86.234.242 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [09/Jun/2026:22:48:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194821&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconseiller-special-du-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045335 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conseiller-special-du-chef-de-letat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:22:49:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608035&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 22:49:21 +0000] info [cpaneld] 102.54.238.57 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:22:48:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776982&pdata=http%253A%252F%252Ftogodailynews.tg%252Fentretien-routier-des-milliers-de-kilometres-renoves-en-2024-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045315 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/entretien-routier-des-milliers-de-kilometres-renoves-en-2024-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:22:48:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252141&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045323 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.97
country_id: 2921044
description:
[2026-06-09 22:49:54 +0000] info [cpaneld] 195.63.21.97 - phoicdxb "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.176.25.108
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/integration-energetique-le-togo-prepare-son-interconnexion-gaziere/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
country_id: 1835841
description:
Jun  9 22:54:05 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2026-06-09 22:54:07 dovecot_login authenticator failed for H=([27.123.91.97]) [121.189.198.60]:56414: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.2.226.34
country_id: 1522867
description:
2026-06-09 22:54:08 H=([185.2.226.34]) [185.2.226.34]:50693 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.58.95.140
country_id: 1522867
description:
2026-06-09 22:54:16 dovecot_login authenticator failed for H=95.58.95.140.dynamic.telecom.kz ([49.124.159.197]) [95.58.95.140]:42036: 535 Incorrect authentication data (set_id=olivier.gadawouye)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.176.25.108
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/integration-energetique-le-togo-prepare-son-interconnexion-gaziere/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.58.95.140
country_id: 1522867
description:
Jun  9 22:54:14 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.58.95.140 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [09/Jun/2026:22:55:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935460&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bts-les-frais-dinscription-desormais-gratuits%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045713 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bts-les-frais-dinscription-desormais-gratuits/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:22:55:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130538&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045722 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.2
country_id: 6252001
description:
Jun  9 22:56:33 ns5 pure-ftpd[111832]: (?@207.90.244.2) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.109
country_id: 1880251
description:
47.128.121.109 - - [09/Jun/2026:22:57:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986605&pdata=https%253A%252F%252Ftogomedia24.tg%252F2025%252F05%252F09%252Fvatican-leon-xiv-le-nouveau-pape-elu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045877 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2025/05/09/vatican-leon-xiv-le-nouveau-pape-elu/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-06-09 22:58:15 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [182.78.69.178]:59520: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.69.178
country_id: 1269750
description:
Jun  9 22:58:13 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.69.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:22:59:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987937&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045997 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [09/Jun/2026:23:00:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804136&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-de-minamata%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046028 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-de-minamata/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-09 23:00:00 +0000] info [cpaneld] 5.230.133.135 NEW marketplacenetma:WtZ89BjwSToQpuKE address=5.230.133.135,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:23:00:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081495&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045999 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:23:01:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580634&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046080 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:23:01:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937319&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046060 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.58.79.216
country_id: 1643084
description:
[2026-06-09 23:01:57 +0000] info [whostmgrd] 202.58.79.216 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [09/Jun/2026:23:01:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939410&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bts-les-frais-dinscription-desormais-gratuits%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046097 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bts-les-frais-dinscription-desormais-gratuits/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:23:03:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234207&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046184 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [09/Jun/2026:23:03:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660013&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-nouveau-calendrier-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046188 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-nouveau-calendrier-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.153.18.205
country_id: 1210997
description:
59.153.18.205 - - [09/Jun/2026:23:03:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040923&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-jeunesse-togolaise-moteur-de-transformation-nationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046198 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-jeunesse-togolaise-moteur-de-transformation-nationale/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.6019.1763 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.153.18.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:23:03:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052181&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmoyen-orient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046213 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/moyen-orient/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:23:04:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739370&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046271 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.64.23
country_id: 6252001
description:
[2026-06-09 23:03:47 +0000] info [cpaneld] 217.181.64.23 - vodvpozo "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:23:03:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934444&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flycee-francais-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046232 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lycee-francais-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-09 23:04:00 +0000] info [cpaneld] 5.230.133.148 NEW iwtfuxpj:FEbADeMPF9cM1KSf address=5.230.133.148,app=cpaneld,creator=iwtfuxpj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [09/Jun/2026:23:04:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169991&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F3e-mandat-au-niger%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046277 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/3e-mandat-au-niger/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.21.247.58
country_id: 6252001
description:
[2026-06-09 23:04:41 +0000] info [cpaneld] 3.21.247.58 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.52.154
country_id: 3469034
description:
[2026-06-09 23:05:25 +0000] info [whostmgrd] 45.3.52.154 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:23:04:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313559&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046273 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:23:06:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050599&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasteur-awanyoh-mawuli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046365 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pasteur-awanyoh-mawuli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:23:06:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644422&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperiode-derogatoire-de-paiement-des-frais-dinscription%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046372 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/periode-derogatoire-de-paiement-des-frais-dinscription/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:23:05:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592661&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-ville-de-dapaong-abrite-la-premiere-etape-du-forum-des-producteurs-agricoles-du-togo-fopat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046345 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-ville-de-dapaong-abrite-la-premiere-etape-du-forum-des-producteurs-agricoles-du-togo-fopat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:23:07:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607785&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-lig%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046422 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-lig/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [09/Jun/2026:23:08:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885602&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftelevision-togolaise-tvt%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046504 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/television-togolaise-tvt/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 81.70.182.252
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/planet-one-327-millions-de-dollars-pour-booster-les-competences-tg/<script async src=||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:23:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999818&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcierea-ptci%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046568 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cierea-ptci/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:23:09:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920602&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781045990 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:23:10:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924462&pdata=http%253A%252F%252Ftogodailynews.tg%252Fle-togo-met-le-cap-sur-2026-avec-des-ambitions-mesurees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046635 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/le-togo-met-le-cap-sur-2026-avec-des-ambitions-mesurees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [09/Jun/2026:23:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312491&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftelevision-togolaise-tvt%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046637 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/television-togolaise-tvt/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.188.11.67
country_id: 6252001
description:
35.188.11.67 - - [09/Jun/2026:23:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247814&pdata=https%253A%252F%252Frelanceinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046646 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.188.11.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.188.11.67
country_id: 6252001
description:
35.188.11.67 - - [09/Jun/2026:23:12:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012824&pdata=https%253A%252F%252Frelanceinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046752 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.188.11.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [09/Jun/2026:23:11:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062378&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcandidat-au-bepc-se-donne-la-mort-par-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046712 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/candidat-au-bepc-se-donne-la-mort-par-pendaison/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.7
country_id: 798544
description:
Jun  9 23:12:05 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:23:12:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790833&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046770 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:23:13:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002904&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcamion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [09/Jun/2026:23:13:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921940&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcandidat-au-bepc-se-donne-la-mort-par-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046782 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/candidat-au-bepc-se-donne-la-mort-par-pendaison/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.78.9.138
country_id: 1562822
description:
2026-06-09 23:13:21 dovecot_plain authenticator failed for H=(faf73c14doyf3s99qze81ygxv8u3f) [115.78.9.138]:38162: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.133.51
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">quelques jours apr\xc3\xa8s son match nul contre la centrafrique, le togo a r\xc3\xa9agi de la plus belle des mani\xc3\xa8res en s\xe2\x80\x99imposant largement face au b\xc3\xa9nin (5-1), ce mardi, lors de son deuxi\xc3\xa8me match amical de la fen\xc3\xaatre fifa de juin.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">men\xc3\xa9s d\xc3\xa8s les premi\xc3\xa8res minutes de la rencontre, les \xc3\x89perviers ont renvers\xc3\xa9 la situation gr\xc3\xa2ce \xc3\xa0 un but contre son camp de mohammed tijani avant la pause. au retour des vestiaires, arnaud komlavi, djen\xc3\xa9 dakonam, k\xc3\xa9vin denkey et laba fo-doh ont tour \xc3\xa0 tour trouv\xc3\xa9 le chemin des filets pour offrir une victoire \xc3\xa9clatante aux hommes de patrice neveu.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ce succ\xc3\xa8s permet au togo de conclure son rassemblement sur une note positive avant les \xc3\xa9liminatoires de la can 2027.</span>||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-09 23:12:44 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
country_id: 1835841
description:
Jun  9 23:13:58 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:23:13:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262165&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcamion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046838 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:23:13:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988501&pdata=http%253A%252F%252Fletabloid.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046832 HTTP/1.1" 302 0 letabloid.tg "http://letabloid.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:23:14:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938605&pdata=https%253A%252F%252Fwww.letabloid.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046847 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [09/Jun/2026:23:14:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880936&pdata=http%253A%252F%252Fletabloid.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046840 HTTP/1.1" 302 0 letabloid.tg "http://letabloid.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:23:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471364&pdata=http%253A%252F%252Fletabloid.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046892 HTTP/1.1" 302 0 letabloid.tg "http://letabloid.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-09 23:15:03 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.73
country_id: 1269750
description:
Jun  9 23:15:05 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.73 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:23:14:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313302&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046876 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:23:14:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725543&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046883 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:23:14:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660054&pdata=http%253A%252F%252Fletabloid.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046882 HTTP/1.1" 302 0 letabloid.tg "http://letabloid.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [09/Jun/2026:23:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129237&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046889 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:23:15:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528725&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foif-recrute-pour-des-postes-bases-a-paris%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781046945 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/oif-recrute-pour-des-postes-bases-a-paris/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 133.204.17.224
country_id: 1861060
description:
[2026-06-09 23:16:17 +0000] info [whostmgrd] 133.204.17.224 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.43.180.196
country_id: 614540
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-16.94.43.180.196||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.219
country_id: 3469034
description:
Jun  9 23:17:31 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.219
country_id: 3469034
description:
Jun  9 23:17:39 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.219 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [09/Jun/2026:23:18:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805257&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-de-jules-tete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047078 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-de-jules-tete/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:23:18:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7049676&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-egypte-une-cooperation-renforcee-a-seoul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047103 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-egypte-une-cooperation-renforcee-a-seoul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.146.139.130
country_id: 6252001
description:
[2026-06-09 23:20:11 +0000] info [cpaneld] 75.146.139.130 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [09/Jun/2026:23:21:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12873058&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F03%252F13%252Ftogo-les-confrontations-de-la-coupe-de-lindependance-connues%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047270 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/03/13/togo-les-confrontations-de-la-coupe-de-lindependance-connues/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 23:23:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57508: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 23:23:22 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.208.125
country_id: 660013
description:
Jun  9 23:23:37 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.13.208.125
country_id: 660013
description:
2026-06-09 23:23:39 dovecot_plain authenticator failed for H=(fzqst0ncw1tmpcucwgt7m5k36oo) [31.13.208.125]:43662: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:23:23:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919321&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047430 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.62
country_id: 2921044
description:
[2026-06-09 23:24:02 +0000] info [whostmgrd] 65.111.24.62 - Turblote "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-09 23:24:34 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "POST /cpsess1750460007/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.58.124] != Current IP Address [196.170.1.77]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.12.182.123
country_id: 6252001
description:
Jun  9 23:24:55 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.12.182.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.246.128.35
country_id: 2921044
domain: davetechno.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:davetkoo||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.191.73.3
country_id: 1694008
description:
[2026-06-09 23:26:28 +0000] info [whostmgrd] 180.191.73.3 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.246.128.35
country_id: 2921044
domain: davetechno.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:davetkoo||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:23:27:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843239&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperiode-derogatoire-de-paiement-des-frais-dinscription%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047636 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/periode-derogatoire-de-paiement-des-frais-dinscription/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.211
country_id: 3865483
description:
Jun  9 23:26:49 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.211 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [09/Jun/2026:23:27:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194259&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcanal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047661 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/canal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.175.226.56
country_id: 1643084
description:
[2026-06-09 23:28:18 +0000] info [cpaneld] 103.175.226.56 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [09/Jun/2026:23:28:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936555&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-petroliere-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047726 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-petroliere-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.214.95.248
country_id: 6252001
description:
[2026-06-09 23:29:39 +0000] info [whostmgrd] 44.214.95.248 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:23:29:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040618&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047789 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [09/Jun/2026:23:32:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854240&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dun-petard%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047945 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dun-petard/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.226.135.35
country_id: 1819730
description:
129.226.135.35 - - [09/Jun/2026:23:32:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776935&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2025%252F06%252F24%252Fle-cacit-renforce-les-capacites-des-acteurs-de-la-societe-civile-sur-la-gouvernance-locale-et-la-participation-citoyenne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781047929 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2025/06/24/le-cacit-renforce-les-capacites-des-acteurs-de-la-societe-civile-sur-la-gouvernance-locale-et-la-participation-citoyenne/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.226.135.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.107.110
country_id: 3175395
description:
Jun  9 23:32:18 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.107.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:23:33:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777707&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dun-petard%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048020 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dun-petard/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:23:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724510&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048027 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 23:34:43 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 23:34:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57652: 535 Incorrect authentication data (set_id=sales1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [09/Jun/2026:23:37:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659803&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048231 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun  9 23:37:19 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.251.197
country_id: 1643084
description:
[2026-06-09 23:38:00 +0000] info [cpaneld] 182.253.251.197 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.74.151.151
country_id: 6252001
description:
[2026-06-09 23:38:59 +0000] info [whostmgrd] 208.74.151.151 - masfloy "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:23:39:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317677&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-echanges-entre-faure-gnassingbe-et-lambassadrice-du-royaume-uni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048348 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-echanges-entre-faure-gnassingbe-et-lambassadrice-du-royaume-uni/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [09/Jun/2026:23:38:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7522665&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournaliste-jacob-ahama%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048334 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journaliste-jacob-ahama/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [09/Jun/2026:23:39:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407336&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpresident-de-la-commission-de-lutte-contre-la-corruption-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048385 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/president-de-la-commission-de-lutte-contre-la-corruption-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.251.197
country_id: 1643084
description:
[2026-06-09 23:40:00 +0000] info [cpaneld] 182.253.251.197 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:23:41:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936072&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-lome-nouvelle-licence-professionnelle-rentree-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048487 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-lome-nouvelle-licence-professionnelle-rentree-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.63.190.43
country_id: 458258
description:
[2026-06-09 23:41:02 +0000] info [whostmgrd] 86.63.190.43 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:23:41:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855899&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprogramme-de-bourse-mandela-washington-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048507 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/programme-de-bourse-mandela-washington-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:23:43:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133207&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprogramme-de-bourse-mandela-washington-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048597 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/programme-de-bourse-mandela-washington-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [09/Jun/2026:23:44:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659797&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048673 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 23:45:20 +0000] info [cpaneld] 103.65.237.227 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:23:44:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247978&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048683 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [09/Jun/2026:23:44:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934999&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048681 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:23:44:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131818&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-reouverture-de-roc-hotel-datakpame-annoncee-pour-le-1er-octobre-prochain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048687 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-reouverture-de-roc-hotel-datakpame-annoncee-pour-le-1er-octobre-prochain/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.160.136.28
country_id: 2017370
description:
Jun  9 23:46:31 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.160.136.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.160.136.28
country_id: 2017370
description:
2026-06-09 23:46:33 dovecot_plain authenticator failed for H=(17f0qzoah2wwgbe07ffyrb0) [158.160.136.28]:49928: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:23:45:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448231&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048738 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.253.80.42
country_id: 3932488
description:
38.253.80.42 - - [09/Jun/2026:23:46:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6648465&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-fecafoot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048759 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-fecafoot/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.4905.1209 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.253.80.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.251.197
country_id: 1643084
description:
[2026-06-09 23:46:24 +0000] info [cpaneld] 182.253.251.197 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 23:47:01 +0000] info [cpaneld] 102.54.238.57 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 23:48:05 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:59618: 535 Incorrect authentication data (set_id=sales1)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-09 23:48:18 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET /cpsess1750460007/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1781048897732&_=1781038542053 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.142
country_id: 2635167
description:
[2026-06-09 23:48:28 +0000] info [whostmgrd] 217.181.94.142 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 23:48:03 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-09 23:48:37 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET /cpsess1750460007/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.132.148.159
country_id: 1522867
description:
[2026-06-09 23:49:05 +0000] info [whostmgrd] 91.132.148.159 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:23:49:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198937&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781048980 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.127.181.103
country_id: 390903
description:
79.127.181.103 - - [09/Jun/2026:23:51:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985368&pdata=https%253A%252F%252Fzephyr.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049081 HTTP/2.0" 302 0 zephyr.tg.154-70-82-246.cpanel.site "https://zephyr.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.127.181.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.73.137.146
country_id: 6252001
description:
[2026-06-09 23:51:25 +0000] info [cpaneld] 96.73.137.146 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.107.27.139
country_id: 2921044
description:
[2026-06-09 23:51:59 +0000] info [whostmgrd] 212.107.27.139 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [09/Jun/2026:23:53:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737876&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchanteuse-togolaise-kezita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049212 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chanteuse-togolaise-kezita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [09/Jun/2026:23:52:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606597&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-volontaires-pour-la-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049156 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-volontaires-pour-la-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.166.38
country_id: 6252001
description:
[2026-06-09 23:54:12 +0000] info [whostmgrd] 209.50.166.38 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:23:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934492&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremboursement-de-la-dot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049296 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remboursement-de-la-dot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.211.164.142
country_id: 1880251
description:
[2026-06-09 23:55:35 +0000] info [whostmgrd] 154.211.164.142 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.115.40.156
country_id: 1814991
description:
[2026-06-09 23:54:37 +0000] info [whostmgrd] 103.115.40.156 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:23:56:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591082&pdata=https%253A%252F%252Ftogodailynews.tg%252Felections-en-cote-divoire-johaness-makouvia-nomme-chef-de-la-mission-dobservation-electorale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049380 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/elections-en-cote-divoire-johaness-makouvia-nomme-chef-de-la-mission-dobservation-electorale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.193.167.42
country_id: 298795
description:
185.193.167.42 - - [09/Jun/2026:23:56:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384281&pdata=https%253A%252F%252Fzephyr.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049384 HTTP/2.0" 302 0 zephyr.tg.154-70-82-246.cpanel.site "https://zephyr.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.193.167.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 23:56:35 +0000] info [cpaneld] 103.253.27.219 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 23:56:36 +0000] info [cpaneld] 103.253.27.219 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:23:56:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13136327&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmise-en-oeuvre-du-projet-coso-le-gouvernement-fait-le-point%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049405 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/mise-en-oeuvre-du-projet-coso-le-gouvernement-fait-le-point/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.12
country_id: 2635167
description:
[2026-06-09 23:56:51 +0000] info [whostmgrd] 195.63.24.12 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:23:56:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727849&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049416 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F/page/2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.96.32
country_id: 2542007
description:
2026-06-09 23:57:33 dovecot_plain authenticator failed for H=([198.23.185.222]) [41.140.96.32]:44824: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.96.32
country_id: 2542007
description:
2026-06-09 23:57:40 dovecot_login authenticator failed for H=([198.23.185.222]) [41.140.96.32]:44824: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.32.37
country_id: 2017370
description:
2026-06-09 23:57:47 dovecot_plain authenticator failed for H=([198.23.185.222]) [93.171.32.37]:60081: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.61.144.149
country_id: 2017370
description:
2026-06-09 23:58:09 dovecot_plain authenticator failed for H=([198.23.185.222]) [2.61.144.149]:52924: 535 Incorrect authentication data (set_id=marketing@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.251.211
country_id: 3625428
description:
2026-06-09 23:58:24 dovecot_plain authenticator failed for H=([198.23.185.222]) [38.43.251.211]:64727: 535 Incorrect authentication data (set_id=contact@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:23:59:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604699&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-danalyses-de-biologie-medicale-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049539 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-danalyses-de-biologie-medicale-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.119.22.79
country_id: 2542007
description:
2026-06-09 23:59:09 dovecot_plain authenticator failed for H=([198.23.185.222]) [196.119.22.79]:46466: 535 Incorrect authentication data (set_id=financeiro@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.207.77.10
country_id: 1861060
description:
[2026-06-09 23:59:19 +0000] info [whostmgrd] 43.207.77.10 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.244.68.152
country_id: 3190538
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:pse-2020-2030-un-plan-de-2-000-milliards-de-francs-cfa-pour-developper-le-systeme-educatif-au-togo/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.234.86.140
country_id: 3686110
description:
2026-06-09 23:59:30 dovecot_plain authenticator failed for H=([198.23.185.222]) [181.234.86.140]:41712: 535 Incorrect authentication data (set_id=it@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.244.152.76
country_id: 99237
description:
2026-06-09 23:58:38 dovecot_plain authenticator failed for H=([198.23.185.222]) [185.244.152.76]:41984: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.46.69.6
country_id: 1512440
description:
2026-06-09 23:58:54 dovecot_plain authenticator failed for H=([198.23.185.222]) [95.46.69.6]:50096: 535 Incorrect authentication data (set_id=contacto@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.234.86.140
country_id: 3686110
description:
2026-06-09 23:59:37 dovecot_login authenticator failed for H=([198.23.185.222]) [181.234.86.140]:41712: 535 Incorrect authentication data (set_id=it@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:23:59:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131606&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049590 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.134.107.129
country_id: 2921044
description:
[2026-06-09 23:59:55 +0000] info [whostmgrd] 94.134.107.129 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.145.240.63
country_id: 3686110
description:
2026-06-10 00:00:01 dovecot_plain authenticator failed for H=([198.23.185.222]) [190.145.240.63]:42200: 535 Incorrect authentication data (set_id=suporte@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:00:00:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673073&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnaana-jane-opoku-agyemang%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049609 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/naana-jane-opoku-agyemang/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.62.44.194
country_id: 3469034
description:
2026-06-09 23:59:46 dovecot_plain authenticator failed for H=([198.23.185.222]) [189.62.44.194]:10505: 535 Incorrect authentication data (set_id=accounts@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.80.20.86
country_id: 3595528
description:
2026-06-10 00:00:16 dovecot_plain authenticator failed for H=([198.23.185.222]) [170.80.20.86]:56594: 535 Incorrect authentication data (set_id=hr@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.75.224.189
country_id: 99237
description:
2026-06-10 00:00:32 dovecot_plain authenticator failed for H=([198.23.185.222]) [185.75.224.189]:36203: 535 Incorrect authentication data (set_id=office@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [10/Jun/2026:00:00:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805162&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049635 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.75.224.189
country_id: 99237
description:
2026-06-10 00:00:40 dovecot_login authenticator failed for H=([198.23.185.222]) [185.75.224.189]:36203: 535 Incorrect authentication data (set_id=office@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.191.122.172
country_id: 1210997
description:
2026-06-10 00:01:03 dovecot_plain authenticator failed for H=([198.23.185.222]) [202.191.122.172]:45340: 535 Incorrect authentication data (set_id=ventas@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-10 00:01:08 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:54336: 535 Incorrect authentication data (set_id=tester1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-10 00:01:10 dovecot_plain authenticator failed for H=(89txydivp1nh5fh93i92whd) [117.1.213.160]:53821: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.122.223
country_id: 1694008
description:
2026-06-10 00:00:46 dovecot_plain authenticator failed for H=([198.23.185.222]) [202.137.122.223]:49854: 535 Incorrect authentication data (set_id=soporte@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:00:00:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199719&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-de-minamata%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049654 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-de-minamata/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 10 00:01:06 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun 10 00:01:08 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.132.20.105
country_id: 2017370
description:
2026-06-10 00:01:20 dovecot_plain authenticator failed for H=([198.23.185.222]) [91.132.20.105]:3843: 535 Incorrect authentication data (set_id=clients@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.84.245.87
country_id: 3469034
description:
2026-06-10 00:01:37 dovecot_plain authenticator failed for H=177-84-245-87.4inet.net.br ([198.23.185.222]) [177.84.245.87]:12838: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.183.92
country_id: 2921044
description:
[2026-06-10 00:03:00 +0000] info [whostmgrd] 209.50.183.92 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:00:04:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119372&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049880 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:00:06:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6582429&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fflamingo-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049964 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/flamingo-club/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:00:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237786&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frisques-dinondation-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781049947 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/risques-dinondation-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.230.10
country_id: 1668284
description:
2026-06-10 00:07:08 dovecot_plain authenticator failed for H=(3h9k58v27qjhfkcgn4z) [104.28.230.10]:56813: 535 Incorrect authentication data (set_id=alfred.aguim@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-10 00:07:41 dovecot_plain authenticator failed for H=(vtfgv82r6era8xhv8v8r9qqum1cf5) [27.73.209.71]:38167: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun 10 00:08:01 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-10 00:08:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:25053: 535 Incorrect authentication data (set_id=birmingham)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
country_id: 1814991
description:
Jun 10 00:08:02 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun 10 00:08:12 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 10 00:08:27 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:00:07:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396866&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finstitution-francaise-de-formation-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050069 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/institution-francaise-de-formation-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 10 00:08:00 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.176
country_id: 1269750
description:
Jun 10 00:08:19 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.86.66.40
country_id: 6252001
description:
[2026-06-10 00:08:31 +0000] info [whostmgrd] 71.86.66.40 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 00:08:35 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.68.178
country_id: 3469034
description:
Jun 10 00:08:44 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.68.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.220.10.60
country_id: 1269750
description:
Jun 10 00:09:15 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.220.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-10 00:09:15 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 10 00:09:17 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 10 00:09:20 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jun 10 00:09:24 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
country_id: 1814991
description:
Jun 10 00:09:25 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:00:09:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104414&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finstitution-francaise-de-formation-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050174 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/institution-francaise-de-formation-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.86.52.211
country_id: 1168579
description:
Jun 10 00:08:44 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.86.52.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 10 00:09:08 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 10 00:08:40 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 00:10:27 +0000] info [cpaneld] 103.65.237.227 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
country_id: 1814991
description:
Jun 10 00:09:41 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.152.215
country_id: 2363686
description:
102.64.152.215 - - [10/Jun/2026:00:09:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158763&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-fourniture-moto-tricycle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050184 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-fourniture-moto-tricycle/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.152.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 10 00:09:53 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 10 00:09:38 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jun 10 00:09:38 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.215.235.84
country_id: 1831722
description:
[2026-06-10 00:10:06 +0000] info [cpaneld] 188.215.235.84 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [10/Jun/2026:00:10:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608808&pdata=https%253A%252F%252Ftdn.tg%252Facheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050201 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/acheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
country_id: 290557
description:
Jun 10 00:10:08 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [10/Jun/2026:00:12:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858504&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050335 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [10/Jun/2026:00:12:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525805&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050342 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [10/Jun/2026:00:12:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339478&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050350 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [10/Jun/2026:00:12:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197905&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050374 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:00:13:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328725&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmalfrats-a-legbassito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050397 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/malfrats-a-legbassito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:00:14:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858409&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050445 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:00:14:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946519&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050451 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.33.74
country_id: 226074
description:
Jun 10 00:14:21 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.33.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.251.229.144
country_id: 1668284
description:
Jun 10 00:14:21 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.251.229.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-10 00:14:48 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:56925: 535 Incorrect authentication data (set_id=cpl1)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-10 00:15:10 +0000] info [cpaneld] 5.230.153.13 NEW togorer:7GVVvATEdN32_1dS address=5.230.153.13,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.75.89.78
country_id: 617790
description:
Jun 10 00:15:31 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.75.89.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.251.229.144
country_id: 1668284
description:
Jun 10 00:14:37 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.251.229.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.56
country_id: 3469034
description:
Jun 10 00:14:41 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.82
country_id: 6252001
description:
[2026-06-10 00:15:45 +0000] info [whostmgrd] 95.164.195.82 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.113.214
country_id: 6252001
description:
[2026-06-10 00:16:02 +0000] info [cpaneld] 76.136.113.214 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.68.176
country_id: 2017370
description:
[2026-06-10 00:16:10 +0000] info [cpaneld] 95.26.68.176 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.199.61.249
country_id: 2510769
description:
[2026-06-10 00:16:12 +0000] info [cpaneld] 82.199.61.249 - tchambainves "GET /login/?login_only=1&user=tchambainves&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainves (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:00:15:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974820&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvacances-numeriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050535 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vacances-numeriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.75.89.78
country_id: 617790
description:
Jun 10 00:15:39 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.75.89.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.64.60
country_id: 3996063
description:
[2026-06-10 00:16:45 +0000] info [cpaneld] 187.188.64.60 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.98.130.171
country_id: 1282988
description:
[2026-06-10 00:16:56 +0000] info [cpaneld] 103.98.130.171 - tchamba1 "GET /login/?login_only=1&user=tchamba1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.242.208.0
country_id: 3469034
description:
Jun 10 00:17:18 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.242.208.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.242.208.0
country_id: 3469034
description:
2026-06-10 00:17:20 dovecot_login authenticator failed for H=(iONzRP) [191.242.208.0]:50979: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.253.4.90
country_id: 1880251
description:
Jun 10 00:17:43 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.253.4.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.253.4.90
country_id: 1880251
description:
2026-06-10 00:17:45 dovecot_plain authenticator failed for H=(gjmetu3407ie1rx9oibpm16osgpz) [188.253.4.90]:12521: 535 Incorrect authentication data (set_id=bnandja@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:00:18:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054037&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-fecafoot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050683 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-fecafoot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.59.226.91
country_id: 290557
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/certificat-de-nationalite-dementi-officiel-sur-la-delivrance-gratuite/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.59.226.91
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/certificat-de-nationalite-dementi-officiel-sur-la-delivrance-gratuite/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:00:20:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657690&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050803 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [10/Jun/2026:00:20:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870485&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050805 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 190.232.29.150
country_id: 3932488
description:
Jun 10 00:20:12 ns5 pure-ftpd[170870]: (?@190.232.29.150) [WARNING] Authentication failed for user [cloudetracks@cloud-et-racks.tg]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 190.232.29.150
country_id: 3932488
description:
Jun 10 00:21:24 ns5 pure-ftpd[171925]: (?@190.232.29.150) [WARNING] Authentication failed for user [cloudetracks]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-10 00:21:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:28507: 535 Incorrect authentication data (set_id=elrond)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 190.232.29.150
country_id: 3932488
description:
Jun 10 00:20:41 ns5 pure-ftpd[171185]: (?@190.232.29.150) [WARNING] Authentication failed for user [cloud-et-racks]


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.241.251.80
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-et-le-systeme-des-nations-unies-signent-un-nouveau-cadre-de-cooperation-2023-2026/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.129
country_id: 690791
description:
Jun 10 00:21:42 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 190.232.29.150
country_id: 3932488
description:
Jun 10 00:21:45 ns5 pure-ftpd[172131]: (?@190.232.29.150) [WARNING] Authentication failed for user [cloud-et-racks]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:00:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855018&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremboursement-de-la-dot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050939 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remboursement-de-la-dot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-10 00:22:40 +0000] info [cpaneld] 134.195.83.78 NEW sahamtg:VyAP5ajSpsO7ekgp address=134.195.83.78,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.232.29.150
country_id: 3932488
description:
2026-06-10 00:22:44 dovecot_plain authenticator failed for H=(DESKTOP-1RCS3EH) [190.232.29.150]:28366: 535 Incorrect authentication data (set_id=cloudetracks@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:00:23:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984556&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftechniques-pour-fideliser-ses-clients%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781050999 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/techniques-pour-fideliser-ses-clients/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:00:23:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9597289&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051036 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-10 00:24:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64422: 535 Incorrect authentication data (set_id=sales1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 10 00:23:59 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.131.165.56
country_id: 357994
description:
[2026-06-10 00:24:54 +0000] info [webmaild] 196.131.165.56 - itra@cafe.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:00:24:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301063&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftechniques-pour-fideliser-ses-clients%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051094 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/techniques-pour-fideliser-ses-clients/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:00:25:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869972&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freprise-des-cours-en-presentiel-dans-les-universites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051127 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reprise-des-cours-en-presentiel-dans-les-universites/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:00:25:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788754&pdata=http%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-fructueux-echanges-entre-faure-gnassingbe-et-vladimir-poutine-au-kremlin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051140 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/diplomatie-fructueux-echanges-entre-faure-gnassingbe-et-vladimir-poutine-au-kremlin/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.54.73.72
country_id: 1512440
description:
84.54.73.72 - - [10/Jun/2026:00:25:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381512&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-port-de-peche-de-gbetsogbe-une-bequille-pour-les-pecheurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051145 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-port-de-peche-de-gbetsogbe-une-bequille-pour-les-pecheurs/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.3901.1972 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.54.73.72


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [10/Jun/2026:00:25:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581396&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051154 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [10/Jun/2026:00:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120545&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051158 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:00:26:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038569&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051170 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.8.179
country_id: 3077311
description:
Jun 10 00:26:17 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.8.179 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [10/Jun/2026:00:26:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789993&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051178 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.32.248.156
country_id: 2921044
description:
193.32.248.156 - - [10/Jun/2026:00:27:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314645&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051251 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.32.248.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 00:26:45 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49656: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 00:27:42 +0000] info [cpaneld] 102.54.238.57 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.48.244
country_id: 6252001
description:
[2026-06-10 00:27:46 +0000] info [whostmgrd] 45.3.48.244 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:00:27:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13355159&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051272 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 00:27:42 +0000] info [cpaneld] 103.65.237.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:00:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169693&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051259 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.35
country_id: 6252001
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.476155850010982.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.251.197
country_id: 1643084
description:
[2026-06-10 00:29:20 +0000] info [cpaneld] 182.253.251.197 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.123.190
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-300x225.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:00:29:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119835&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051371 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 00:28:53 +0000] info [cpaneld] 103.65.237.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:00:29:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13159364&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeeper-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051342 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deeper-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.128.105.139
country_id: 1880251
description:
43.128.105.139 - - [10/Jun/2026:00:29:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817302&pdata=https%253A%252F%252Flaunetogo.tg%252Fau-togo-la-pia-setend-deux-nouvelles-usines-boostent-lindustrie-pharmaceutique-et-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051377 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/au-togo-la-pia-setend-deux-nouvelles-usines-boostent-lindustrie-pharmaceutique-et-agricole/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.128.105.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [10/Jun/2026:00:29:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329241&pdata=http%253A%252F%252Ftogodailynews.tg%252Fle-togo-un-poids-lourd-dans-la-redynamisation-des-relations-de-cooperation-entre-oeacp-ue%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051382 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/le-togo-un-poids-lourd-dans-la-redynamisation-des-relations-de-cooperation-entre-oeacp-ue/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [10/Jun/2026:00:29:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806247&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051393 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.117.46.138
country_id: 3469034
description:
[2026-06-10 00:30:16 +0000] info [cpaneld] 138.117.46.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.54.57.235
country_id: 3469034
description:
[2026-06-10 00:30:25 +0000] info [cpaneld] 177.54.57.235 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 00:30:09 +0000] info [cpaneld] 103.65.237.227 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.186.199.59
country_id: 3017382
description:
[2026-06-10 00:30:18 +0000] info [cpaneld] 88.186.199.59 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.83.124.105
country_id: 1210997
description:
[2026-06-10 00:30:22 +0000] info [cpaneld] 202.83.124.105 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:00:31:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855012&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fael-95-05%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051485 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ael-95-05/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [10/Jun/2026:00:31:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806551&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-la-securite-aeroportuaire-jamais-perdue-de-vue%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051487 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-la-securite-aeroportuaire-jamais-perdue-de-vue/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:00:30:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184806&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-universite-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051439 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-universite-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [10/Jun/2026:00:32:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065307&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-premier-ministre-hamed-bakayoko%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051523 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-premier-ministre-hamed-bakayoko/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:00:33:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997398&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fael-95-05%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051590 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ael-95-05/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.156.189.132
country_id: 1814991
description:
82.156.189.132 - - [10/Jun/2026:00:33:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932579&pdata=https%253A%252F%252Ftdn.tg%252Ffc-barcelone-presque-tout-leffectif-est-a-vendre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051596 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/fc-barcelone-presque-tout-leffectif-est-a-vendre/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.156.189.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:00:32:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051877&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foperateurs-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051553 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/operateurs-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [10/Jun/2026:00:34:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711704&pdata=https%253A%252F%252F154.70.82.244&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051638 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:00:34:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081711&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foperateurs-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051652 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/operateurs-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 10 00:34:47 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-10 00:34:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:65432: 535 Incorrect authentication data (set_id=adminstrator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-10 00:35:05 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:56059: 535 Incorrect authentication data (set_id=extranet2)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [10/Jun/2026:00:35:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919623&pdata=https%253A%252F%252Feducplusmedia.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051739 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.5.68.112
country_id: 1562822
description:
Jun 10 00:37:24 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.5.68.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.68.112
country_id: 1562822
description:
2026-06-10 00:37:26 dovecot_plain authenticator failed for H=(6ck57yqk3vo9r4i15xjwoew4tk) [117.5.68.112]:45059: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.215.235.84
country_id: 1831722
description:
[2026-06-10 00:37:32 +0000] info [cpaneld] 188.215.235.84 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.130
country_id: 690791
description:
Jun 10 00:36:54 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:00:37:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919012&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoups-de-feu-entendus-a-cotonou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coups-de-feu-entendus-a-cotonou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:00:38:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6709603&pdata=https%253A%252F%252Fbutodra.tg%252Fservice%252Fstrategic-planning%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051905 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/service/strategic-planning/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.18
country_id: 1880251
description:
47.128.121.18 - - [10/Jun/2026:00:38:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132581&pdata=https%253A%252F%252F24heureinfo.tg%252Ftechweb%252Fvisite-dechanges-et-de-partage-dexperience-entre-larcep-du-togo-et-lartp-du-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051891 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/techweb/visite-dechanges-et-de-partage-dexperience-entre-larcep-du-togo-et-lartp-du-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:00:39:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931605&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.215.235.84
country_id: 1831722
description:
[2026-06-10 00:42:23 +0000] info [cpaneld] 188.215.235.84 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 10 00:41:55 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-10 00:41:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:53402: 535 Incorrect authentication data (set_id=acces)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:00:42:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249836&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052148 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-10 00:42:44 dovecot_plain authenticator failed for H=(j9l4gtj6t5lahdwba) [27.73.209.71]:47395: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:00:44:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805155&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052239 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:00:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842054&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052277 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.247.25.151
country_id: 1835841
description:
2026-06-10 00:45:04 dovecot_login authenticator failed for H=(localhost) [49.247.25.151]:57846: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.251.197
country_id: 1643084
description:
[2026-06-10 00:45:20 +0000] info [cpaneld] 182.253.251.197 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.25.151
country_id: 1835841
description:
Jun 10 00:45:27 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.247.25.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-10 00:45:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49356: 535 Incorrect authentication data (set_id=adminstrator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.31.178.18
country_id: 1210997
description:
[2026-06-10 00:46:09 +0000] info [cpaneld] 103.31.178.18 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.24.65.217
country_id: 3469034
description:
[2026-06-10 00:46:30 +0000] info [cpaneld] 200.24.65.217 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 10 00:45:43 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.104.184.110
country_id: 3686110
description:
[2026-06-10 00:46:14 +0000] info [cpaneld] 191.104.184.110 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.135.173.42
country_id: 3686110
description:
[2026-06-10 00:46:20 +0000] info [cpaneld] 181.135.173.42 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.65.24.66
country_id: 3469034
description:
[2026-06-10 00:46:24 +0000] info [cpaneld] 177.65.24.66 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [10/Jun/2026:00:47:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313350&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-4eme-edition-du-mois-du-consommer-local-arrive-a-grand-pas%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052419 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-4eme-edition-du-mois-du-consommer-local-arrive-a-grand-pas/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.53.113.249
country_id: 2782113
description:
[2026-06-10 00:48:08 +0000] info [whostmgrd] 152.53.113.249 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:00:49:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932324&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052548 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:00:48:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801255&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeneral-felix-kadanga-arrete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052534 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/general-felix-kadanga-arrete/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:00:49:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842735&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flycee-francais-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052574 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lycee-francais-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 00:50:05 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.16.226.15
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-51.154.16.226.15||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.245.196.13
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-51.172.245.196.13||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.237.177.43
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-51.151.237.177.43||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.213.93.75
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-51.173.213.93.75||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.245.62.241
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-51.172.245.62.241||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.90.197.87
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-51.168.90.197.87||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [10/Jun/2026:00:52:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210983&pdata=https%253A%252F%252Ftogodailynews.tg%252Foperationnalisation-du-guichet-unique-au-togo-des-avancees-epatantes-enregistrees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052751 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/operationnalisation-du-guichet-unique-au-togo-des-avancees-epatantes-enregistrees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.40.79
country_id: 6252001
domain: www.net.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:netfreenet||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:00:52:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7315142&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052772 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:00:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012266&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftayc-concert-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052783 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tayc-concert-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:00:53:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880475&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsam-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052797 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sam-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.40.79
country_id: 6252001
domain: www.net.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.backup||User:netfreenet||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 34.122.16.212
country_id: 6252001
domain: daula.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:00:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792878&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052826 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: daula.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var cheg=arguments['\\\\x31'];var wwcem=cheg;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"er\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:00:56:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592360&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781052988 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:00:56:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932426&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnaana-jane-opoku-agyemang%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053013 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/naana-jane-opoku-agyemang/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.176.194.22
country_id: 3895114
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/backend/.env.production||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.194.22
country_id: 3895114
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:moodlefreenetmas||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:00:58:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907283&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-premier-ministre-hamed-bakayoko%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053085 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-premier-ministre-hamed-bakayoko/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.143.230.215
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/opportunites-et-commerce-comment-postuler-au-forum-biashara-afrika-2026-prevu-a-lome/<script async src=||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:00:59:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210516&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053169 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:01:00:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858456&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-premier-ministre-hamed-bakayoko%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053212 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-premier-ministre-hamed-bakayoko/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:01:00:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923172&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-collective-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053231 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-collective-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:01:01:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260100&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053282 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togodailynews.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:75388.togodailynews.tg||ServerName:togodailynews.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad2660881f22261cce2537ff53d5c5132a6ec2ae||Title:0x42a48d2d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:01:02:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262682&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftayc-concert-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053345 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tayc-concert-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [10/Jun/2026:01:01:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169136&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053317 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15268.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:678e04aaa35e94e5d7e39ac740e9dd0cda7dd761||Title:0x0165d4db||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togointerim.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56463.togointerim.net||ServerName:togointerim.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:64ae22a4164208a805a503d1c45dbf69d41922ec||Title:0xb567c06c||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.211.30.169
country_id: 2921044
description:
[2026-06-10 01:03:26 +0000] info [cpaneld] 92.211.30.169 - caissederetra "GET /login/?login_only=1&user=caissederetra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.130.23.45
country_id: 3469034
description:
[2026-06-10 01:03:03 +0000] info [cpaneld] 201.130.23.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.78.185.62
country_id: 174982
description:
[2026-06-10 01:03:23 +0000] info [cpaneld] 178.78.185.62 - caissederetrai "GET /login/?login_only=1&user=caissederetrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.122.91.111
country_id: 1210997
description:
[2026-06-10 01:03:31 +0000] info [cpaneld] 103.122.91.111 - caissederetr "GET /login/?login_only=1&user=caissederetr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:01:02:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067604&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frio%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053358 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rio/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.208.124.167
country_id: 3996063
description:
[2026-06-10 01:03:11 +0000] info [cpaneld] 187.208.124.167 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.225.60.73
country_id: 3996063
description:
[2026-06-10 01:03:18 +0000] info [cpaneld] 200.225.60.73 - caissederetraite "GET /login/?login_only=1&user=caissederetraite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraite (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [10/Jun/2026:01:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104878&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053427 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:01:04:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869677&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-danalyses-de-biologie-medicale-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053446 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-danalyses-de-biologie-medicale-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:01:04:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201049&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmalfrats-a-legbassito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053458 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/malfrats-a-legbassito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.184.18.119
country_id: 1643084
description:
[2026-06-10 01:03:45 +0000] info [cpaneld] 103.184.18.119 - caisseder "GET /login/?login_only=1&user=caisseder&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisseder (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.59.155
country_id: 3865483
description:
[2026-06-10 01:03:59 +0000] info [cpaneld] 170.247.59.155 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togofeed.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23806.togofeed.com||ServerName:togofeed.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b67244a091c2845494c7414b564f8d7456d84a5||Title:0xf2f267ae||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [10/Jun/2026:01:05:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909296&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053527 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [10/Jun/2026:01:04:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051206&pdata=http%253A%252F%252Fmail.cndh-togo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053475 HTTP/1.1" 302 0 mail.cndh-togo.org "http://mail.cndh-togo.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f184f1e9103eb357a847247a0151762fa21b7f06||Title:0xe2587b99||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [10/Jun/2026:01:06:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934701&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-faiej-cree-une-jeunesse-responsable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053567 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-faiej-cree-une-jeunesse-responsable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b526e8aca7e52652ee47f0d616dc6c21d8b67179||Title:0x22e9eb1e||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.29
country_id: 1269750
description:
Jun 10 01:06:52 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.113
country_id: 3469034
description:
Jun 10 01:07:12 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:01:07:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251374&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnaana-jane-opoku-agyemang%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053640 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/naana-jane-opoku-agyemang/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [10/Jun/2026:01:06:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262116&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-tenue-vestimentaire-du-personnel-de-sante-codifiee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053616 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-tenue-vestimentaire-du-personnel-de-sante-codifiee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83846d31cf8178557160903713073d680b13c72f||Title:0xb33ec850||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:01:07:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790251&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053621 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3f979d8b9c90d1bb305f0567270fb00a1d7d1efc||Title:0xd98ebfa3||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:67fd49368c64d2773e31bd0f098fcfe389bf335c||Title:0xf6c49695||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e9e6ce27c0deb693893dbfd1a5beaa6e3476528||Title:0x53d59465||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:01:10:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262682&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-petroliere-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053817 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-petroliere-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43a0a9491317d034f06470ac1bf06bc1ea321d09||Title:0xff15d5ec||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:01:11:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448794&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdirection-prefectorale-de-la-sante-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053887 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/direction-prefectorale-de-la-sante-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.0.127.137
country_id: 3469034
description:
143.0.127.137 - - [10/Jun/2026:01:12:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078616&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdouble-scrutin-du-29-avril-2024-les-pretes-traditionnels-accordent-leur-voix-a-unir-golfe-5%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053918 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/double-scrutin-du-29-avril-2024-les-pretes-traditionnels-accordent-leur-voix-a-unir-golfe-5/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2049.1330 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.0.127.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [10/Jun/2026:01:12:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856107&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-le-transport-des-produits-agricoles-un-point-cle-de-leconomie-ameliore%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053951 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-le-transport-des-produits-agricoles-un-point-cle-de-leconomie-ameliore/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:01:12:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909329&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkokou-agbleta%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053931 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kokou-agbleta/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7986235be7e471b63788d0d03067a04b5de43d4||Title:0x40aa689a||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:01:12:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867307&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkokou-agbleta%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053969 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kokou-agbleta/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:01:13:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789789&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781053986 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ab8e83611f956f69d70e4302534f90ff9efc127||Title:0xa4381175||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.42.159.219
country_id: 3469034
description:
[2026-06-10 01:14:30 +0000] info [cpaneld] 179.42.159.219 - educplusmed "GET /login/?login_only=1&user=educplusmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmed (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:01:14:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739459&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054038 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.9.225.172
country_id: 3865483
description:
[2026-06-10 01:14:22 +0000] info [cpaneld] 181.9.225.172 - educplusmediatg "GET /login/?login_only=1&user=educplusmediatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmediatg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a54c4bf2672b62e15d57cd64065a3eadd808d37e||Title:0x2d577a1d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.55.227.216
country_id: 3469034
description:
[2026-06-10 01:15:02 +0000] info [cpaneld] 177.55.227.216 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.205.16
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/blocks/paragraph/style.min.css?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.249.81.220
country_id: 248816
description:
[2026-06-10 01:14:37 +0000] info [cpaneld] 94.249.81.220 - educplusm "GET /login/?login_only=1&user=educplusm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.66.166.163
country_id: 3017382
description:
[2026-06-10 01:14:41 +0000] info [cpaneld] 37.66.166.163 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b999f1172dc4dc0177a4f53f9fa84aa400839a1f||Title:0x82e7bdc7||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.68.35
country_id: 3190538
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/js/autoptimize_single_99ccce287ae5c8a10f58ecae9e5f5747.js?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.249.53
country_id: 732800
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/wp-cloudflare-page-cache/assets/js/lazysizes.min.js?ver=5.3.2 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.227.10.36
country_id: 3865483
description:
[2026-06-10 01:15:07 +0000] info [cpaneld] 45.227.10.36 - educplu1 "GET /login/?login_only=1&user=educplu1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.116
country_id: 690791
description:
Jun 10 01:15:14 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.225.184.138
country_id: 3895114
description:
[2026-06-10 01:14:44 +0000] info [cpaneld] 45.225.184.138 - educpl "GET /login/?login_only=1&user=educpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educpl (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:01:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106150&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrl-yali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054088 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crl-yali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.164.186.26
country_id: 2017370
description:
[2026-06-10 01:14:55 +0000] info [cpaneld] 188.164.186.26 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:66626bdcc2e58cbba21189cdc7c62501e4159210||Title:0x15d98280||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:01:16:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462151&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdimas-dzikodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054165 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dimas-dzikodo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:01:17:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260257&pdata=http%253A%252F%252Ftogodailynews.tg%252Frecensement-biometrique-le-zio-entre-en-phase-denregistrement-des-le-19-janvier%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054222 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/recensement-biometrique-le-zio-entre-en-phase-denregistrement-des-le-19-janvier/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:01:17:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803720&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054220 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:01:17:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13093219&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmort-de-samuel-etoo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054254 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mort-de-samuel-etoo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:01:16:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461082&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054215 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd24bda29ea8c5c89ab976a4bd3e4fb8170a4ed6||Title:0xca989408||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:01:17:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869977&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdimas-dzikodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054261 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dimas-dzikodo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c0a77030e4166e9f86b36c61e69c73c0b1fb7a2||Title:0x812a24c5||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.108.23
country_id: 3175395
description:
Jun 10 01:18:19 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.108.23 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [10/Jun/2026:01:19:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987267&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmort-de-samuel-etoo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054360 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mort-de-samuel-etoo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ab1ade4f37f6e478d3878d5c753df75b0f9f0a1||Title:0x0a458383||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:01:19:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183059&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054348 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [10/Jun/2026:01:19:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938397&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054387 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b74983abfad83ce2aee8a9d3370493a45074aece||Title:0x4d536d57||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 01:19:36 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:01:19:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867144&pdata=https%253A%252F%252Ftogodailynews.tg%252Fant-internationals-worldfirst-sassocie-a-ecobank-pour-simplifier-les-paiements-transfrontaliers-des-pme-africaines%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054394 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ant-internationals-worldfirst-sassocie-a-ecobank-pour-simplifier-les-paiements-transfrontaliers-des-pme-africaines/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1910de629abbdc1a8d5479ff216dd04df007e2fe||Title:0xede47084||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:01:20:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068139&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054443 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 10 01:21:09 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-10 01:21:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:56944: 535 Incorrect authentication data (set_id=adminstrator)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.57
country_id: 1512440
description:
2026-06-10 01:21:28 H=([0.0.0.0]) [84.54.71.57]:4360 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:01:20:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13013862&pdata=https%253A%252F%252Ftdn.tg%252Fosinachi-nwachukwu-mari-mort-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054455 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/osinachi-nwachukwu-mari-mort-pendaison/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:01:22:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327447&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054531 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.163.115.163
country_id: 3017382
domain: www.la-snb.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:bighostingsnbd||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd65593a616a36a05d169a7bc1798d8ba150a462||Title:0x359b1186||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba929eae96516aba49907a25697f60433d65688a||Title:0xa881fa49||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 134.209.160.165
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:admlnlx||MVN:ARGS:log||WPU:admlnlx||User:tgmisefred||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun 10 01:24:33 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f10507ab7e88d2ea1f80a438a40dc30592185340||Title:0x3b43b304||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:01:24:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367786&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054659 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.130
country_id: 1880251
description:
47.128.121.130 - - [10/Jun/2026:01:24:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185371&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F11%252F11%252Ftogo-lassemblee-vote-quatre-lois-pour-le-renforcement-des-droits-de-la-femme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054665 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/11/11/togo-lassemblee-vote-quatre-lois-pour-le-renforcement-des-droits-de-la-femme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.130


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.57
country_id: 1512440
description:
2026-06-10 01:23:54 H=([0.0.0.0]) [84.54.71.57]:37857 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:01:24:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803467&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmali-tunisie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054683 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mali-tunisie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1283fb5722e9296c681ad7cdc698ecd00e00f75a||Title:0xba9f9cd2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-10 01:24:35 dovecot_plain authenticator failed for H=(zn4xwbe8gu48fyy4804guioqqimlfr) [27.73.209.71]:38741: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [10/Jun/2026:01:26:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7522454&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F06%252F01%252Fles-mecanismes-traditionnels-de-gestion-de-conflits-valorises-par-wanep-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054781 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2021/06/01/les-mecanismes-traditionnels-de-gestion-de-conflits-valorises-par-wanep-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:01:26:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908314&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fao-alliance-foundation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054792 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ao-alliance-foundation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6432843672fada13092e9b7a9a0c8e498adb53aa||Title:0x3ce74a5a||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:01:26:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869255&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054766 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:01:26:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528663&pdata=https%253A%252F%252Ftdn.tg%252Feperviers-du-togo-qui-etait-kossi-koudagba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054780 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/eperviers-du-togo-qui-etait-kossi-koudagba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:01:27:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6999145&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fanalyste-business-performance%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054829 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/analyste-business-performance/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:01:27:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595488&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feau-potable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054849 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eau-potable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:01:26:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788035&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054810 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df008caf0a13f908e27444f7eeaa854b2f11364f||Title:0x1f16b095||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:01:28:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724712&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpremiere-femme-capitaine-au-long-cours%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054907 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/premiere-femme-capitaine-au-long-cours/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.255.101.107
country_id: 2589581
description:
154.255.101.107 - - [10/Jun/2026:01:27:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066281&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpremiere-femme-capitaine-au-long-cours%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054859 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/premiere-femme-capitaine-au-long-cours/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.5410.1141 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.255.101.107


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c94ae96f8ef146a2b093ecc0fcdfc0ac7cb13b1||Title:0xcf37f8d0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:01:28:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528196&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fao-alliance-foundation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054887 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ao-alliance-foundation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:01:29:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933468&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpremiere-femme-capitaine-au-long-cours%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054969 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/premiere-femme-capitaine-au-long-cours/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:01:28:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6408088&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054925 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80feee5117b50c96363bfeebc8a4bafa6a200372||Title:0xfd1fbc1b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.148.99.162
country_id: 2017370
description:
46.148.99.162 - - [10/Jun/2026:01:29:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211803&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-326344gitems%252Fetidm29se.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054969 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-326344gitems/etidm29se.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.148.99.162


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e1540267f895b083142af4652592146cc0145be||Title:0x44b88a5a||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:01:29:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7102567&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-universite-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054984 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-universite-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: modsec
rule: 77350365
abuser: 134.209.160.165
country_id: 6252001
domain: misstogo.tg
name:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)

description:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)||MVN:TX:1||MV:d3AtY29udGVudA||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 134.209.160.165
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.15||T:APACHE||SC:/home/tgmisefred/public_html/wp-admin/admin-ajax.php||User:tgmisefred||WPU:admlnlx||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:01:29:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924206&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781054977 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 10 01:30:51 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77789665
abuser: 134.209.160.165
country_id: 6252001
domain: misstogo.tg
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:edit_content||MV:911292\r\n/usr/local/cpanel/bin/autossl_check\r\n||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e0f9d011c8a8bcbe01542f4570214db26383be5c||Title:0x010e3739||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-10 01:30:53 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53187: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jun 10 01:32:25 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun 10 01:31:45 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2a0517ab3639000722c39b220bf135e5f21b3aa||Title:0xeeeca056||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2a481dc4d622bfc7b2810da9c8d10a2921570eb||Title:0x67fdc6fb||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 01:33:00 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:01:33:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659799&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055181 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.138
country_id: 3686110
description:
Jun 10 01:33:12 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:01:33:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328984&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftayc-concert-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055188 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tayc-concert-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:01:34:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196378&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055252 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b2b9ed9503eaa9dab76a70a0a8ce01472f2ca05||Title:0x65fb738f||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dde1ef19eaac2e0f24e05a89b43046f53328a1a8||Title:0x9eefe962||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.57
country_id: 1512440
description:
2026-06-10 01:36:23 H=([0.0.0.0]) [84.54.71.57]:44128 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:togosem.com.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:725da9e208dadb43d5d1da14834e3f5d8702515e||Title:0x94da6624||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:01:35:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184603&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055340 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.13.130.254
country_id: 2750405
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ce774a8d070333cf8b1a7f463c83796e17644ec||Title:0xe839e727||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.121.2.68
country_id: 630336
description:
[2026-06-10 01:37:48 +0000] info [cpaneld] 178.121.2.68 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.121.141.108
country_id: 3932488
description:
[2026-06-10 01:37:52 +0000] info [cpaneld] 200.121.141.108 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.115.88.199
country_id: 3686110
description:
186.115.88.199 - - [10/Jun/2026:01:38:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946263&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdeces-du-president-eyadema-en-2005-offices-du-souvenir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055487 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/deces-du-president-eyadema-en-2005-offices-du-souvenir/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.6414.1608 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.115.88.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:01:37:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326885&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055455 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2a369b811c83b13b247f645a5936e027d2b7857||Title:0x6f39d67e||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.31.252.237
country_id: 290557
description:
5.31.252.237 - - [10/Jun/2026:01:39:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738437&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F09%252F12%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055556 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/09/12/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.4458.1386 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.31.252.237


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a47f2ed01c29ae9ed32bc1f8b35119cefabb89fd||Title:0xbd415936||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [10/Jun/2026:01:38:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856625&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsaisie-de-drogue-en-cote-divoire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055530 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/saisie-de-drogue-en-cote-divoire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:01:38:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870190&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdirection-prefectorale-de-la-sante-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055518 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/direction-prefectorale-de-la-sante-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eae3b040ad50f9f0d5a0c6187595c95cea7b53a8||Title:0x2fe74417||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:01:40:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444639&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsaisie-de-drogue-en-cote-divoire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055638 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/saisie-de-drogue-en-cote-divoire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48c4d4e06185cb0a3e74fe9ba98c7eacf4efa70a||Title:0x5f8e51b6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 10 01:41:14 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 10 01:40:53 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.57.131.129
country_id: 2510769
description:
[2026-06-10 01:41:06 +0000] info [whostmgrd] 2.57.131.129 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-10 01:41:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49674: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:01:42:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724763&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055747 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ec986875cddad96425b1061508867fdc8dabf23||Title:0x8317bf7b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.8.10.60
country_id: 2017370
description:
2026-06-10 01:41:42 dovecot_plain authenticator failed for H=(ng355v523gr2ww93qs7jzv) [5.8.10.60]:60053: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.176
country_id: 1269750
description:
Jun 10 01:41:48 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:01:43:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778219&pdata=https%253A%252F%252Ftdn.tg%252Fosinachi-nwachukwu-mari-mort-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055811 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/osinachi-nwachukwu-mari-mort-pendaison/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0add1e1a56957c05cdfc9d57b02bf117a9dbb22||Title:0x29e76fee||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:01:43:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313297&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055804 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d6652a9ad2794190439cd31ce8a22f94a217e002||Title:0xf0ec7fab||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:01:43:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120341&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnawda-et-non-losso%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055830 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nawda-et-non-losso/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:01:45:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196421&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnawda-et-non-losso%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055912 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nawda-et-non-losso/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:01:45:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314397&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffinancement-le-groupe-orabank-mobilise-25-milliards-fcfa-en-faveur-de-free-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781055928 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/financement-le-groupe-orabank-mobilise-25-milliards-fcfa-en-faveur-de-free-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6a317497a6a4ac21b92d745d20616e070a39599||Title:0x30ff5499||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 216.234.215.192
country_id: 878675
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b46f6462e27edb20b42261ec5795075768fe46d||Title:0xa8c2ee0e||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dashboard/postman.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dashboard/certs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.114.17
country_id: 6252001
domain: www.bierehofbrau.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:bighostingsnbd||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/full_backup.sql||User:antasadmin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 01:47:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44362: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.222.48
country_id: 6252001
domain: davakconsulting.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:mvfxewjz||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:01:48:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579602&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056103 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/old.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:01:49:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923176&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcanal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056141 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/canal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:01:49:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866801&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056173 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:01:49:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6734742&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056192 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/source.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/dist.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:01:50:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145800&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcertificat-de-nationalite-togo-une-operation-foraine-en-cours-jusquau-9-juillet%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056246 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/certificat-de-nationalite-togo-une-operation-foraine-en-cours-jusquau-9-juillet/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [10/Jun/2026:01:51:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146311&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056315 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:01:52:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377815&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-a-agoe-cacaveli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056346 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-a-agoe-cacaveli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/deployment.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/frontend.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/services.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [10/Jun/2026:01:53:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777452&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-a-agoe-cacaveli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056423 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-a-agoe-cacaveli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.122.4
country_id: 6252001
description:
[2026-06-10 01:55:12 +0000] info [cpaneld] 82.40.122.4 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/sites.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/vhost.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:01:55:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001261&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056551 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.20.206.205
country_id: 6252001
description:
34.20.206.205 - - [10/Jun/2026:01:56:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201307&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056601 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.20.206.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 01:57:09 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58946: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.20.206.205
country_id: 6252001
description:
34.20.206.205 - - [10/Jun/2026:01:58:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725844&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056715 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.20.206.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:01:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723015&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056724 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:01:58:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261860&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056737 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:02:00:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591683&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056840 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:02:02:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014426&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconseiller-special-du-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056924 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conseiller-special-du-chef-de-letat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:02:03:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12816795&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-directeur-de-cabinet-de-la-primature-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781056989 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-directeur-de-cabinet-de-la-primature-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 02:04:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:47360: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:02:04:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065564&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-directeur-de-cabinet-de-la-primature-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057071 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-directeur-de-cabinet-de-la-primature-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.154
country_id: 3077311
description:
Jun 10 02:03:37 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.88
country_id: 2635167
description:
[2026-06-10 02:04:46 +0000] info [cpaneld] 217.181.94.88 - himcuijv "GET / HTTP/1.1" FAILED LOGIN cpaneld: User himcuijv has their account suspended. Login blocked.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.17.115.186
country_id: 3175395
domain: mail.horizonmedical.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:rdlizssu||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:02:05:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671830&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057106 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.245.180.60
country_id: 6251999
description:
[2026-06-10 02:06:35 +0000] info [cpaneld] 99.245.180.60 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.224.92.124
country_id: 3686110
description:
[2026-06-10 02:05:43 +0000] info [cpaneld] 181.224.92.124 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.128.229.182
country_id: 3017382
description:
[2026-06-10 02:05:52 +0000] info [cpaneld] 176.128.229.182 - auditeccandc "GET /login/?login_only=1&user=auditeccandc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandc (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:02:05:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645104&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmusique-chorale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057155 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/musique-chorale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.60.40.36
country_id: 3686110
description:
[2026-06-10 02:06:05 +0000] info [cpaneld] 190.60.40.36 - auditecca "GET /login/?login_only=1&user=auditecca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecca (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:02:06:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016682&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-anpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057168 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-anpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.62.32
country_id: 6252001
description:
[2026-06-10 02:06:14 +0000] info [cpaneld] 172.117.62.32 - auditecc "GET /login/?login_only=1&user=auditecc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecc (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [10/Jun/2026:02:06:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198372&pdata=http%253A%252F%252Ftogodailynews.tg%252Fuemoa-le-togo-joue-sa-partition-economique-et-financiere%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057178 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/uemoa-le-togo-joue-sa-partition-economique-et-financiere/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.76.183.175
country_id: 2542007
description:
[2026-06-10 02:06:25 +0000] info [cpaneld] 105.76.183.175 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.214.117.135
country_id: 953987
description:
[2026-06-10 02:06:43 +0000] info [cpaneld] 102.214.117.135 - auditec1 "GET /login/?login_only=1&user=auditec1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditec1 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 147.235.217.132
country_id: 294640
description:
147.235.217.132 - - [10/Jun/2026:02:07:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526817&pdata=http%253A%252F%252Ftogodailynews.tg%252Fmicrofinance-un-portefeuille-degrade-des-solutions-innovantes-au-coeur-du-debat-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057219 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/92.0.4515.90 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.235.217.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:02:07:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105740&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Froch-marc-christian-kabore%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057219 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/roch-marc-christian-kabore/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:02:07:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788250&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsam-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057264 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sam-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.64.7.101
country_id: 6252001
description:
[2026-06-10 02:09:12 +0000] info [whostmgrd] 64.64.7.101 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 64.64.7.101
country_id: 6252001
description:
[2026-06-10 02:09:15 +0000] info [whostmgrd] 64.64.7.101 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.6.177
country_id: 3932488
description:
179.6.6.177 - - [10/Jun/2026:02:09:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394310&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-298264gitems%252Fetidm52se.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057387 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-298264gitems/etidm52se.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.6.177


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/aspnet.sql||User:antasadmin||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-10 02:11:51 +0000] info [cpaneld] 5.231.255.112 NEW gemwjxuz:82HoZKc8vunkgaMd address=5.231.255.112,app=cpaneld,creator=gemwjxuz,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/codeigniter.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:02:12:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394984&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057536 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:02:12:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606764&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057567 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/opencart.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jun 10 02:13:57 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/joomla.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:02:14:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13136026&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057677 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [10/Jun/2026:02:15:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379095&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftaux-de-couverture-en-electricite-ou-en-est-le-togo-par-rapport-a-son-ambition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057727 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/taux-de-couverture-en-electricite-ou-en-est-le-togo-par-rapport-a-son-ambition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cms/strapi.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:02:16:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448327&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057791 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:02:15:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146515&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhushpuppi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057746 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hushpuppi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.197
country_id: 2635167
description:
[2026-06-10 02:15:59 +0000] info [cpaneld] 5.230.153.197 NEW zauwogvk:z4KnBs9lrSPG9Dne address=5.230.153.197,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.238
country_id: 6252001
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.353132232482867.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [10/Jun/2026:02:16:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870792&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057812 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.99.241
country_id: 1210997
description:
114.130.99.241 - - [10/Jun/2026:02:17:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051208&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffaure-gnassingbe-trace-la-voie-dun-togo-souverain-et-resilient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057833 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/faure-gnassingbe-trace-la-voie-dun-togo-souverain-et-resilient/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.8818.1215 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.99.241


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.97.6.214
country_id: 1527747
description:
2026-06-10 02:17:25 H=([212.97.6.214]) [212.97.6.214]:16185 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [10/Jun/2026:02:18:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181671&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclinique-a-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057907 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clinique-a-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:02:17:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052505&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Floi-sur-les-pme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057868 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/loi-sur-les-pme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:02:19:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265042&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781057984 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 10 02:20:59 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 02:23:27 +0000] info [cpaneld] 102.54.238.57 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-06-10 02:23:55 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se (dynamic-ip-adsl.viettel.vn) [79.136.8.69]:35778: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:02:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103588&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.136.8.69
country_id: 2661886
description:
Jun 10 02:23:53 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.136.8.69 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:02:24:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988969&pdata=https%253A%252F%252Ftdn.tg%252Facheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058280 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/acheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:02:25:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972571&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsecteur-immobilier-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058337 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/secteur-immobilier-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:02:25:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726570&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058344 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:02:25:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592915&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsecteur-immobilier-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058351 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/secteur-immobilier-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:02:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987175&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmalfrats-a-legbassito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058359 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/malfrats-a-legbassito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:02:26:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853987&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeeper-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058375 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deeper-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [10/Jun/2026:02:26:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6791107&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058369 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:02:26:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119318&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058395 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.147
country_id: 3175395
description:
Jun 10 02:26:54 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:02:27:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000792&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058427 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.37.101
country_id: 3469034
description:
2026-06-10 02:29:01 dovecot_plain authenticator failed for H=(DESKTOP-OKG88J5.home) [177.200.37.101]:9306: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:02:29:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646426&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058562 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.129.184.168
country_id: 2077456
domain: www.snbt-tg.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/sql/backup.sql||User:bighostingsnbd||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.48.76.27
country_id: 1210997
description:
182.48.76.27 - - [10/Jun/2026:02:30:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974102&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftrafic-en-hausse-au-port-de-lome-un-flux-logistique-qui-profite-a-tout-le-pays%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058612 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/trafic-en-hausse-au-port-de-lome-un-flux-logistique-qui-profite-a-tout-le-pays/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2933.1353 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.48.76.27


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:02:30:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790572&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feau-potable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058633 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eau-potable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun 10 02:29:55 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 34.129.184.168
country_id: 2077456
description:
2026-06-10 02:30:16.852515054 +0000 GMT m=+20921.011980876 Denial of Service attack was discovered from 34.129.184.168, on port 80. Open connections: 254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 02:30:53 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.129.184.168
country_id: 2077456
domain: www.snbt-tg.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.ini||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 10 02:31:33 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:02:31:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10406339&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Floi-sur-les-pme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058710 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/loi-sur-les-pme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:02:32:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843285&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-55-milliards-fcfa-pour-moderniser-106-km-de-routes-en-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058772 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-55-milliards-fcfa-pour-moderniser-106-km-de-routes-en-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:02:33:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974567&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058806 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.141.79
country_id: 294640
description:
[2026-06-10 02:34:06 +0000] info [cpaneld] 79.177.141.79 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [10/Jun/2026:02:34:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935305&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058853 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.164.33.187
country_id: 1733045
description:
115.164.33.187 - - [10/Jun/2026:02:33:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394518&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-le-president-nigerien-issoufou-mahamadou-en-visite-de-travail-et-damitie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058816 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-le-president-nigerien-issoufou-mahamadou-en-visite-de-travail-et-damitie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2260.1002 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.164.33.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [10/Jun/2026:02:33:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529238&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058832 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.58.187
country_id: 3658394
description:
[2026-06-10 02:34:15 +0000] info [cpaneld] 191.99.58.187 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.52.103
country_id: 3658394
description:
[2026-06-10 02:33:59 +0000] info [cpaneld] 45.228.52.103 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.236.93.198
country_id: 3996063
description:
[2026-06-10 02:34:01 +0000] info [cpaneld] 187.236.93.198 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:02:35:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725339&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagbanga-karite-alaffia-sarl-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058910 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agbanga-karite-alaffia-sarl-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:02:36:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143686&pdata=https%253A%252F%252Ftdn.tg%252Frepartition-centres-ecrit-ministere-economie-finances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058968 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/repartition-centres-ecrit-ministere-economie-finances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:02:35:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069973&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-des-test-pcr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058942 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-des-test-pcr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:02:36:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919621&pdata=https%253A%252F%252Fcfpj.tg%252Fcfpj-rapport-dactivite-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781058962 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/cfpj-rapport-dactivite-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:02:36:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015408&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagbanga-karite-alaffia-sarl-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059007 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agbanga-karite-alaffia-sarl-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [10/Jun/2026:02:36:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803622&pdata=http%253A%252F%252Ftogodailynews.tg%252F29-ans-de-luemoa-lunion-a-accompli-des-pas-de-geants-dixit-abdoulaye-diop%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059015 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/29-ans-de-luemoa-lunion-a-accompli-des-pas-de-geants-dixit-abdoulaye-diop/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:02:37:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001306&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjo-tokyo-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059038 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jo-tokyo-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [10/Jun/2026:02:37:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920088&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059076 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:02:38:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170456&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-anpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059102 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-anpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:02:38:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987271&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeorge-floyd%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059109 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/george-floyd/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:02:39:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684075&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-mondiale-de-lingenierie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059140 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-mondiale-de-lingenierie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:02:39:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251167&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fle-journal-de-ferdinand-ayite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059147 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/le-journal-de-ferdinand-ayite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:02:39:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382490&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fanalyste-business-performance%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059154 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/analyste-business-performance/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:02:39:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329452&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafiquante-de-drogue%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059172 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafiquante-de-drogue/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 02:39:43 +0000] info [cpaneld] 102.54.238.57 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:02:40:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923435&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059203 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:02:40:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6517140&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-volontaires-pour-la-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059210 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-volontaires-pour-la-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:02:40:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619609&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059244 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.54.78.210
country_id: 1512440
description:
84.54.78.210 - - [10/Jun/2026:02:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460827&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-333505retidm73der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059257 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-333505retidm73der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.54.78.210


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:02:41:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456714&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Floi-sur-les-pme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059280 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/loi-sur-les-pme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:02:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593707&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059260 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:02:41:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130324&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059312 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-10 02:42:23 +0000] info [cpaneld] 5.230.133.115 NEW zauwogvk:gHWR7ArL7O7kfweD address=5.230.133.115,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.226
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.643632103580246.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [10/Jun/2026:02:42:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9751190&pdata=https%253A%252F%252Ftogodailynews.tg%252Frecettes-fiscales-lotr-a-mobilise-258-milliards-fcfa-au-premier-trimestre-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059372 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/recettes-fiscales-lotr-a-mobilise-258-milliards-fcfa-au-premier-trimestre-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:02:43:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197141&pdata=https%253A%252F%252Ftogodailynews.tg%252Fagriculture-le-pasa-pour-soutenir-le-secteur-agricole-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059399 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/agriculture-le-pasa-pour-soutenir-le-secteur-agricole-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


