# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:02:43:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196374&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freprise-des-cours-en-presentiel-dans-les-universites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059413 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reprise-des-cours-en-presentiel-dans-les-universites/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:02:42:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012053&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059356 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:02:43:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793222&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059433 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [10/Jun/2026:02:44:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591690&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flycee-francais-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059478 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lycee-francais-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:02:46:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595496&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059586 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:02:47:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934702&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconseiller-special-du-chef-de-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059630 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conseiller-special-du-chef-de-letat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:02:47:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070278&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059636 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:02:46:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130886&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Froch-marc-christian-kabore%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059606 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/roch-marc-christian-kabore/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [10/Jun/2026:02:47:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063406&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdouane-adidogome-sous-leau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059638 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/douane-adidogome-sous-leau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.227.144
country_id: 2245662
domain: chatmerce.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chatmerce.free.netmaster.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:02:46:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132078&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059617 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.223.32.71
country_id: 3996063
description:
189.223.32.71 - - [10/Jun/2026:02:48:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014635&pdata=https%253A%252F%252Ftogodailynews.tg%252Fune-economie-mondiale-fragilisee-dans-un-contexte-de-taux-dinteret-eleves%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059687 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/une-economie-mondiale-fragilisee-dans-un-contexte-de-taux-dinteret-eleves/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.6358.1225 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.223.32.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.110
country_id: 2921044
description:
Jun 10 02:48:05 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.110
country_id: 2921044
description:
2026-06-10 02:48:07 dovecot_plain authenticator failed for H=tor-exit-110.digitalcourage.de (kf3jbiyjklxp5ng5ry2oow2f2) [185.220.101.110]:64407: 535 Incorrect authentication data (set_id=nwani@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:02:48:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738954&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmusique-chorale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059694 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/musique-chorale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:02:48:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777961&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-fecafoot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059725 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-fecafoot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:02:49:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778267&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhushpuppi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059739 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hushpuppi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:02:49:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853525&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcan-2021-reportee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059746 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/can-2021-reportee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:02:50:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050697&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frio%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059828 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rio/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:02:49:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528169&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059783 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:02:49:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070437&pdata=https%253A%252F%252Fcfpj.tg%252Fcfpj-rapport-dactivite-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059791 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/cfpj-rapport-dactivite-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [10/Jun/2026:02:49:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578836&pdata=http%253A%252F%252Fnew.istm.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059792 HTTP/1.1" 302 0 new.istm.tg "http://new.istm.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:02:51:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456153&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaureats-emergence-gospel-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laureats-emergence-gospel-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:02:52:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9751138&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcooperation-tete-a-tete-entre-victoire-tomegah-dogbe-et-han-duck-soo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059934 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cooperation-tete-a-tete-entre-victoire-tomegah-dogbe-et-han-duck-soo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:02:51:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790766&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059912 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:02:52:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791178&pdata=https%253A%252F%252Ftdn.tg%252Fcategory%252Fa-la-une%252Fpage%252F262%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059931 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/category/a-la-une/page/262/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:02:52:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608340&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepp-agokpo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059958 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epp-agokpo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:02:53:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788965&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059982 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:02:53:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853228&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgeorge-floyd%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781059989 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/george-floyd/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:02:54:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119529&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-a-lecole-primaire-evangelique-de-nyekonakpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060053 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-a-lecole-primaire-evangelique-de-nyekonakpoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:02:53:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660824&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060014 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.235.176
country_id: 4566966
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/ca7f935f-ec9c-4293-afbd-9cf97aa969de-300x169.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.142
country_id: 2750405
description:
Jun 10 02:54:43 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.142
country_id: 2750405
description:
2026-06-10 02:54:45 dovecot_login authenticator failed for H=(emt.tg) [192.42.116.142]:31699: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.110.139
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/20260603043954331c-300x166.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 180.164.74.195
country_id: 1814991
description:
2026-06-10 02:56:26 H=([180.164.74.195]) [180.164.74.195]:33934 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:02:55:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170708&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060136 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:02:55:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803672&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060149 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:02:56:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658243&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060189 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.242.161.36
country_id: 953987
description:
41.242.161.36 - - [10/Jun/2026:02:56:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116951&pdata=https%253A%252F%252Ftogodailynews.tg%252Felections-municipales-2025-la-cndh-lance-une-campagne-nationale-de-sensibilisation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060163 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/elections-municipales-2025-la-cndh-lance-une-campagne-nationale-de-sensibilisation/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.5457.1933 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.242.161.36


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:02:56:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985620&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060168 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-10 02:57:16 +0000] info [cpaneld] 5.230.133.135 NEW cinemafreenetmas:h07ZhZt6j4dsS0ME address=5.230.133.135,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 23.27.234.62
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Sokod\xc3\xa9 : Evaluation de la progression des travaux de construction du march\xc3\xa9 local||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.173.158.107
country_id: 3017382
description:
Jun 10 02:58:34 ns5 pure-ftpd[284887]: (?@158.173.158.107) [INFO] New connection from 158.173.158.107


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:02:57:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10260936&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060269 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:02:58:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867978&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprogramme-de-bourse-mandela-washington-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060288 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/programme-de-bourse-mandela-washington-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.88.133
country_id: 1668284
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/flags/svg/fr.svg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.24.122
country_id: 1880251
description:
47.128.24.122 - - [10/Jun/2026:02:59:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934280&pdata=https%253A%252F%252Fbelali.tg%252Fwp-content%252Fuploads%252F2020%252F04%252FG%2525C3%2525A9o.doc&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060354 HTTP/2.0" 302 0 belali.tg "https://belali.tg/wp-content/uploads/2020/04/G%C3%A9o.doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.24.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 94.205.147.223
country_id: 290557
description:
94.205.147.223 - - [10/Jun/2026:03:00:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853531&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F02%252F16%252Ftogo-unir-consolide-son-pouvoir-et-simpose-en-maitre-absolu-aux-elections-senatoriales-du-15-fevrier-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060415 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/02/16/togo-unir-consolide-son-pouvoir-et-simpose-en-maitre-absolu-aux-elections-senatoriales-du-15-fevrier-2025/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.3619.1607 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.205.147.223


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [10/Jun/2026:03:00:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987478&pdata=http%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-faure-gnassingbe-sest-entretenu-avec-ilham-aliyev%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060445 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/diplomatie-faure-gnassingbe-sest-entretenu-avec-ilham-aliyev/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:03:02:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133466&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060526 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.58
country_id: 1880251
description:
47.128.121.58 - - [10/Jun/2026:03:01:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924199&pdata=https%253A%252F%252Ftogodailynews.tg%252Fuemoa-le-taux-dinflation-est-ressorti-a-23-en-glissement-annuel-au-quatrieme-trimestre-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060498 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/uemoa-le-taux-dinflation-est-ressorti-a-23-en-glissement-annuel-au-quatrieme-trimestre-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:03:02:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859231&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060520 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.116.249.144
country_id: 3895114
description:
191.116.249.144 - - [10/Jun/2026:03:03:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211239&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-42637letidm5.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060617 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-42637letidm5.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.116.249.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.60.65.36
country_id: 3895114
description:
179.60.65.36 - - [10/Jun/2026:03:06:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264790&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060791 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.5636.1339 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.60.65.36


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:03:06:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934275&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060800 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:03:07:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001311&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-a-lecole-primaire-evangelique-de-nyekonakpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060876 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-a-lecole-primaire-evangelique-de-nyekonakpoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:03:09:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9948263&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781060947 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 03:09:26 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:03:12:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9945700&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fun-pretre-demissionne-par-amour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061121 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/un-pretre-demissionne-par-amour/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:03:12:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249578&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-journee-du-02-mai-declaree-feriee-chomee-et-payee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061138 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-journee-du-02-mai-declaree-feriee-chomee-et-payee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [10/Jun/2026:03:14:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934434&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061263 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:03:15:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726104&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fboston-university%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061307 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/boston-university/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 10 03:15:14 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.125.234
country_id: 1269750
description:
Jun 10 03:14:39 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.125.234 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:03:15:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065814&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061321 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: cl_dos
name: DOS detection
abuser: 34.154.142.146
country_id: 3175395
description:
2026-06-10 03:16:06.6733311 +0000 GMT m=+23670.832797022 Denial of Service attack was discovered from 34.154.142.146, on port 443. Open connections: 269


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:03:16:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803927&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061373 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [10/Jun/2026:03:16:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841704&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061415 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: cl_dos
name: DOS detection
abuser: 34.154.142.146
country_id: 3175395
description:
2026-06-10 03:17:07.151347299 +0000 GMT m=+23731.310813121 Denial of Service attack was discovered from 34.154.142.146, on port 443. Open connections: 269


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:17:07.151437601 +0000 GMT m=+23731.310903323 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.250.211.165
country_id: 2542007
description:
41.250.211.165 - - [10/Jun/2026:03:17:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012781&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061432 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.4450.1674 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.250.211.165


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:17:37.46737568 +0000 GMT m=+23761.626841502 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: cl_dos
name: DOS detection
abuser: 34.154.142.146
country_id: 3175395
description:
2026-06-10 03:17:37.467255577 +0000 GMT m=+23761.626721399 Denial of Service attack was discovered from 34.154.142.146, on port 443. Open connections: 269


plugin: cl_dos
name: DOS detection
abuser: 34.154.142.146
country_id: 3175395
description:
2026-06-10 03:18:38.101238789 +0000 GMT m=+23822.260704611 Denial of Service attack was discovered from 34.154.142.146, on port 443. Open connections: 269


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:18:38.101173087 +0000 GMT m=+23822.260638909 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.42.141.148
country_id: 3895114
description:
181.42.141.148 - - [10/Jun/2026:03:19:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948637&pdata=https%253A%252F%252Ftogodailynews.tg%252Fseminaire-gouvernemental-le-budget-programme-au-coeur-des-discussions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061569 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/seminaire-gouvernemental-le-budget-programme-au-coeur-des-discussions/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4125.1945 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.42.141.148


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:19:38.611112328 +0000 GMT m=+23882.770578050 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: cl_dos
name: DOS detection
abuser: 34.154.142.146
country_id: 3175395
description:
2026-06-10 03:19:38.611042226 +0000 GMT m=+23882.770508148 Denial of Service attack was discovered from 34.154.142.146, on port 443. Open connections: 269


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.139
country_id: 6252001
description:
2026-06-10 03:20:37 dovecot_plain authenticator failed for H=(wvc86wpqfnqayzfn) [23.129.64.139]:55333: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:20:39.053789995 +0000 GMT m=+23943.213255817 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.139
country_id: 6252001
description:
Jun 10 03:20:35 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.139 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 34.154.142.146
country_id: 3175395
description:
2026-06-10 03:20:39.053825096 +0000 GMT m=+23943.213290818 Denial of Service attack was discovered from 34.154.142.146, on port 443. Open connections: 269


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.147.200.62
country_id: 1210997
description:
27.147.200.62 - - [10/Jun/2026:03:22:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7509913&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftests-covid-1-de-nouvelles-dispositions-prises-a-laeroport-international-gnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061724 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/tests-covid-1-de-nouvelles-dispositions-prises-a-laeroport-international-gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.4132.1386 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.147.200.62


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:21:39.694238878 +0000 GMT m=+24003.853704800 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:03:21:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985620&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-emploi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061701 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-emploi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:03:23:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262935&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-volontaires-pour-la-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061779 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-volontaires-pour-la-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.135.34.92
country_id: 953987
description:
41.135.34.92 - - [10/Jun/2026:03:23:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277551&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bts-les-frais-dinscription-desormais-gratuits%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061795 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bts-les-frais-dinscription-desormais-gratuits/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7638.1084 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.135.34.92


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [10/Jun/2026:03:23:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368298&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fceinture-wako-pro%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061795 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ceinture-wako-pro/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:22:40.3551384 +0000 GMT m=+24064.514604422 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:23:41.015310903 +0000 GMT m=+24125.174776725 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:03:25:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9531036&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061911 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 186.82.102.53
country_id: 3686110
description:
186.82.102.53 - - [10/Jun/2026:03:25:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391643&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F07%252F13%252Ffoot-feminin-le-tournoi-qualificatif-de-lufoa-b-reporte-dune-semaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061916 HTTP/2.0" 404 561 togomedia24.tg "https://togomedia24.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.82.102.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.112.103.121
country_id: 3865483
description:
190.112.103.121 - - [10/Jun/2026:03:24:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803929&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-martine-moreau-renforce-les-liens-diplomatiques-et-commerciaux-entre-le-togo-et-le-canada%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781061873 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-martine-moreau-renforce-les-liens-diplomatiques-et-commerciaux-entre-le-togo-et-le-canada/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.8337.1683 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.112.103.121


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:24:41.602977819 +0000 GMT m=+24185.762443741 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.202.186.161
country_id: 6252001
description:
[2026-06-10 03:24:47 +0000] info [cpaneld] 64.202.186.161 - conseiln "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiln (has_cpuser_file failed)


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:25:42.190679535 +0000 GMT m=+24246.350145457 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:26:42.813302772 +0000 GMT m=+24306.972768594 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.112.107.133
country_id: 130758
description:
2026-06-10 03:27:17 H=([5.112.107.133]) [5.112.107.133]:49806 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: cl_dos
name: DOS detection
abuser: 34.159.165.126
country_id: 2921044
description:
2026-06-10 03:27:43.429770347 +0000 GMT m=+24367.589236169 Denial of Service attack was discovered from 34.159.165.126, on port 443. Open connections: 254


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.228.164
country_id: 2589581
description:
Jun 10 03:29:35 ns5 pure-ftpd[305670]: (?@176.125.228.164) [INFO] New connection from 176.125.228.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.254.53.229
country_id: 2215636
description:
41.254.53.229 - - [10/Jun/2026:03:31:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921387&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvers-la-validation-du-plan-damelioration-de-la-performance-du-portefeuille-pays-de-la-bad-au-togo-pour-lannee-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062257 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/vers-la-validation-du-plan-damelioration-de-la-performance-du-portefeuille-pays-de-la-bad-au-togo-pour-lannee-2022/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.1093.1454 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.254.53.229


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.12.187
country_id: 1527747
description:
2026-06-10 03:31:28 H=([212.241.12.187]) [212.241.12.187]:30193 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:03:32:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7392101&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsecteur-immobilier-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/secteur-immobilier-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [10/Jun/2026:03:32:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182955&pdata=https%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062359 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [10/Jun/2026:03:32:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713240&pdata=https%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062364 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:03:33:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266022&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-grandes-decisions-du-conseil-des-ministres-du-27-octobre-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062394 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-grandes-decisions-du-conseil-des-ministres-du-27-octobre-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.81
country_id: 3469034
description:
2026-06-10 03:33:20 dovecot_plain authenticator failed for H=(davf8samg1hdqmri9iliafo7d9w) [200.174.198.81]:12745: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [10/Jun/2026:03:33:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858150&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fle-journal-de-ferdinand-ayite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062413 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/le-journal-de-ferdinand-ayite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:03:33:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986393&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062390 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.12.187
country_id: 1527747
description:
2026-06-10 03:33:17 H=([212.241.12.187]) [212.241.12.187]:30170 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.81
country_id: 3469034
description:
Jun 10 03:33:18 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.81 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [10/Jun/2026:03:33:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999816&pdata=https%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062437 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:03:33:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949399&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-asky-recrute-2-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062430 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-asky-recrute-2-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:03:34:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842981&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fle-journal-de-ferdinand-ayite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062441 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/le-journal-de-ferdinand-ayite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:03:35:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804393&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-mondiale-de-lingenierie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062516 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-mondiale-de-lingenierie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.132
country_id: 1880251
description:
47.128.121.132 - - [10/Jun/2026:03:36:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121320&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Fassemblee-nationale-du-togo-le-bureau-desormais-au-complet-klassou-selom-president%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062565 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/assemblee-nationale-du-togo-le-bureau-desormais-au-complet-klassou-selom-president/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 03:36:31 +0000] info [cpaneld] 103.65.237.227 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.133.218.51
country_id: 3686110
description:
[2026-06-10 03:37:33 +0000] info [cpaneld] 181.133.218.51 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.138.165.182
country_id: 3996063
description:
[2026-06-10 03:37:20 +0000] info [cpaneld] 187.138.165.182 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.20.178.78
country_id: 3469034
description:
160.20.178.78 - - [10/Jun/2026:03:36:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368554&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmessi-quitte-le-fc-barcelone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062610 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/messi-quitte-le-fc-barcelone/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.9464.1863 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.20.178.78


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.68.208
country_id: 99237
description:
[2026-06-10 03:37:53 +0000] info [cpaneld] 169.224.68.208 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.231.237.76
country_id: 3469034
description:
[2026-06-10 03:37:37 +0000] info [cpaneld] 45.231.237.76 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.100.246.35
country_id: 3658394
description:
[2026-06-10 03:37:50 +0000] info [cpaneld] 191.100.246.35 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.100.23.220
country_id: 3469034
description:
[2026-06-10 03:38:01 +0000] info [cpaneld] 179.100.23.220 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.12.187
country_id: 1527747
description:
2026-06-10 03:38:57 H=([212.241.12.187]) [212.241.12.187]:30016 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.54.17
country_id: 3469034
description:
Jun 10 03:40:11 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.54.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.231
country_id: 1269750
description:
Jun 10 03:40:45 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:03:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579301&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftamea%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062912 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tamea/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 10 03:42:19 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:03:43:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6409156&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062990 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:03:43:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950637&pdata=https%253A%252F%252Ftdn.tg%252Feperviers-du-togo-qui-etait-kossi-koudagba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062989 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/eperviers-du-togo-qui-etait-kossi-koudagba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:03:42:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432351&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-emploi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781062968 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-emploi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [10/Jun/2026:03:43:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607627&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063038 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [10/Jun/2026:03:44:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646374&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcovid-19-le-gouvernement-en-concertation-avec-les-acteurs-du-secteur-prive%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063056 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/covid-19-le-gouvernement-en-concertation-avec-les-acteurs-du-secteur-prive/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.186.122.97
country_id: 6252001
domain: test2.haplucia-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:phoicdxb||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:03:44:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116435&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063090 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.234.3.67
country_id: 1668284
domain: auditeccandco.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:pjwfvzan||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:03:47:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934994&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmessi-quitte-le-fc-barcelone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063248 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/messi-quitte-le-fc-barcelone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.60.65.132
country_id: 3895114
description:
179.60.65.132 - - [10/Jun/2026:03:47:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644585&pdata=https%253A%252F%252Ftogodailynews.tg%252Flimportance-de-la-politique-nationale-de-decentralisation-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063242 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/limportance-de-la-politique-nationale-de-decentralisation-au-togo/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.5704.1080 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.60.65.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [10/Jun/2026:03:45:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817311&pdata=https%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063157 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:03:47:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657939&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftamea%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063261 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tamea/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.28.119
country_id: 1880251
description:
47.128.28.119 - - [10/Jun/2026:03:47:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050644&pdata=https%253A%252F%252Fcinema.free.netmaster.tg%252Fwatch-video%252Fla-dot-3009025857x6hqm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063265 HTTP/2.0" 302 0 cinema.free.netmaster.tg "https://cinema.free.netmaster.tg/watch-video/la-dot-3009025857x6hqm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.28.119


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:03:50:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016165&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063413 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:03:50:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935816&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063432 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:03:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646627&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkodjo-fo-doh-laba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063395 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kodjo-fo-doh-laba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:03:51:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538952&pdata=https%253A%252F%252Ftogodailynews.tg%252F64eme-anniversaire-de-lindependance-le-chef-de-letat-ranime-la-flamme-de-lindependance-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063475 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/64eme-anniversaire-de-lindependance-le-chef-de-letat-ranime-la-flamme-de-lindependance-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.106.126.183
country_id: 6290252
description:
Jun 10 03:51:17 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.106.126.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 178.95.106.118
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:premier-seminaire-gouvernemental-lexecutif-en-conclave-pour-definir-ses-orientations/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:03:52:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264792&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-volontaires-pour-la-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063520 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-volontaires-pour-la-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:03:51:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999975&pdata=https%253A%252F%252Ftdn.tg%252Fmadame-monsieur-saison-3-serie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063498 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/madame-monsieur-saison-3-serie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:03:53:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168870&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063609 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:03:54:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460824&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063664 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [10/Jun/2026:03:54:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053226&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063669 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:03:54:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183526&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsunu-bank-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063683 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sunu-bank-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:03:54:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936293&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063689 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.199.65.113
country_id: 3686110
description:
38.199.65.113 - - [10/Jun/2026:03:55:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396566&pdata=https%253A%252F%252Ftdn.tg%252Fboad-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063715 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/boad-recrute/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.8694.1981 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.199.65.113


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:03:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515050&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063735 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:03:56:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078823&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063789 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.106.155.212
country_id: 6252001
domain: tensai.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:ulduzncs||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:03:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7184070&pdata=https%253A%252F%252Ftogointerim.net%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063760 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/contact" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.159.96
country_id: 2363686
description:
102.64.159.96 - - [10/Jun/2026:03:57:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134953&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Fpage%252F26%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063825 HTTP/2.0" 404 159 24heureinfo.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/123.0.6312.52 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.159.96


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:03:57:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776985&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bts-les-frais-dinscription-desormais-gratuits%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063856 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bts-les-frais-dinscription-desormais-gratuits/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.159.96
country_id: 2363686
description:
102.64.159.96 - - [10/Jun/2026:03:59:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816218&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Fpage%252F26%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063807 HTTP/2.0" 404 159 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/123.0.6312.52 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.159.96


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [10/Jun/2026:04:00:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7522708&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrute-comptable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063997 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrute-comptable/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.159.96
country_id: 2363686
description:
102.64.159.96 - - [10/Jun/2026:04:00:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328990&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Fpage%252F26%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063858 HTTP/2.0" 404 561 24heureinfo.tg "https://www.google.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5382.59 Safari/537.36 OPR/85.0.3987.50" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.159.96


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:04:00:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920852&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprojet-dappui-a-lamelioration-de-la-competitivite-de-la-filiere-ananas-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064002 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/projet-dappui-a-lamelioration-de-la-competitivite-de-la-filiere-ananas-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:04:00:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118558&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781063403 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-10 04:00:30 +0000] info [cpaneld] 103.164.183.114 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.91.31.222
country_id: 1522867
description:
2026-06-10 03:59:37 H=([178.91.31.222]) [178.91.31.222]:58195 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:04:01:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjournee-mondiale-de-lingenierie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064085 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/journee-mondiale-de-lingenierie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.229.10.91
country_id: 3624060
description:
200.229.10.91 - - [10/Jun/2026:04:00:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998680&pdata=https%253A%252F%252Ftogodailynews.tg%252Fkeran-1-les-populations-profitent-des-bienfaits-de-la-decentralisation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064055 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/keran-1-les-populations-profitent-des-bienfaits-de-la-decentralisation/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.8297.1737 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.229.10.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:04:00:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10391956&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvacances-numeriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064047 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vacances-numeriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 10 04:03:19 ns5 pure-ftpd[330326]: (buto@butodra.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/vefzejhd/public_html/index.php uploaded  (0 bytes, 0.00KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.255.199.99
country_id: 6252001
domain: 54.244.185.141
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.244.185.141/azenv3.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.71.17
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/remise-de-don-au-canton-dadetikope HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.25.186.194
country_id: 1694008
description:
160.25.186.194 - - [10/Jun/2026:04:03:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739109&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-larcop-outille-la-cndh-sur-le-nouveau-cadre-de-gestion-des-marches-publics%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064202 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-larcop-outille-la-cndh-sur-le-nouveau-cadre-de-gestion-des-marches-publics/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.9183.1079 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.25.186.194


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 10 04:03:52 ns5 pure-ftpd[330608]: (buto@butodra.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/vefzejhd/public_html/index.php: Not a directory


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:04:04:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250143&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprogramme-de-bourse-mandela-washington-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064250 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/programme-de-bourse-mandela-washington-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.110.106
country_id: 1168579
description:
2026-06-10 04:04:44 H=([116.71.110.106]) [116.71.110.106]:55020 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:04:05:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816216&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconstruction-duniversite-a-kpalime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064346 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/construction-duniversite-a-kpalime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:04:06:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910411&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprof-ayewouadan-akodah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064394 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prof-ayewouadan-akodah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 190.92.206.5
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-accelere-son-ecosysteme-dinnovations-avec-des-initiatives-cles/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.173.207.172
country_id: 831053
description:
[2026-06-10 04:08:09 +0000] info [cpaneld] 185.173.207.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.110.106
country_id: 1168579
description:
2026-06-10 04:07:35 H=([116.71.110.106]) [116.71.110.106]:3980 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.195.37.191
country_id: 1733045
description:
[2026-06-10 04:08:15 +0000] info [cpaneld] 210.195.37.191 - relanceinfo "GET /login/?login_only=1&user=relanceinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.228.251
country_id: 3996063
description:
[2026-06-10 04:08:25 +0000] info [cpaneld] 189.203.228.251 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.198.53.2
country_id: 1733045
description:
[2026-06-10 04:08:07 +0000] info [cpaneld] 103.198.53.2 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.2.100.206
country_id: 3865483
description:
[2026-06-10 04:08:38 +0000] info [cpaneld] 190.2.100.206 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.73.107.103
country_id: 1210997
description:
[2026-06-10 04:08:45 +0000] info [cpaneld] 103.73.107.103 - rel "GET /login/?login_only=1&user=rel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.120.55
country_id: 3895114
description:
[2026-06-10 04:08:42 +0000] info [cpaneld] 181.43.120.55 - rela "GET /login/?login_only=1&user=rela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rela (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:04:08:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116744&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprof-ayewouadan-akodah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064532 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prof-ayewouadan-akodah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:04:08:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739926&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064534 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.47.76.152
country_id: 1835841
domain: tde.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Web Downloader/6.9||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 10 04:10:37 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 10 04:11:49 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:04:11:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726102&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-danalyses-de-biologie-medicale-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064716 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-danalyses-de-biologie-medicale-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:04:12:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116953&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finseed-recrutement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064722 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inseed-recrutement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.231
country_id: 1269750
description:
Jun 10 04:12:32 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: sodigaz.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"__fe1be3cd\":false,\"status\":\"resolved_model\",\"reason\":-1,\"ns_70c1b605\":false,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var qwjws=arguments['\\\\x31'];var aqxw=qwjws;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"u\\\",\\\"ff\\\",\\\"er\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:04:13:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738135&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064782 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.33
country_id: 6252001
description:
[2026-06-10 04:14:32 +0000] info [cpaneld] 64.44.59.33 NEW lhqeyybr:s1VT0g7zHb_Npljw address=64.44.59.33,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.211
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.734106033772169.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-10 04:14:24 +0000] info [cpaneld] 216.189.152.23 NEW sotragonet:v8WQmg50m0VwMR9K address=216.189.152.23,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-10 04:14:24 +0000] info [cpaneld] 5.231.255.50 NEW frtwilql:cBRRKLMDPouqSKvm address=5.231.255.50,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-10 04:14:27 +0000] info [cpaneld] 5.230.153.48 NEW wgqhqbem:CtnoEJBDT350Da_G address=5.230.153.48,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:04:15:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791135&pdata=https%253A%252F%252Ftdn.tg%252Fmadame-monsieur-saison-3-serie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781064932 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/madame-monsieur-saison-3-serie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: soroubat.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_2d90f0c5\":\"9a14\",\"_236671d7\":[],\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var kmlx=arguments['\\\\x31'];var fr=kmlx;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.185.16.146
country_id: 1522867
description:
2026-06-10 04:14:42 H=([91.185.16.146]) [91.185.16.146]:27445 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: sotranetogo.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"$e3ff3d82\":\"859fcd504012cb19\",\"$a6daa69a\":\"3f5c\",\"_response\":{\"_prefix\":\"var jz=[].slice.call(arguments,1)[0];var ye=jz;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:04:17:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246191&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065044 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-10 04:16:55 +0000] info [cpaneld] 5.230.133.225 NEW aopsacai:2C3l1_Yim0g8Kgo4 address=5.230.133.225,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [10/Jun/2026:04:17:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262987&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffespaco-2025-une-participation-active-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065061 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/fespaco-2025-une-participation-active-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-06-10 04:19:40 dovecot_login authenticator failed for H=([81.13.62.77]) [31.171.125.179]:60992: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.171.125.179
country_id: 587116
description:
Jun 10 04:19:38 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.171.125.179 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:04:19:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209224&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065181 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:04:20:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012008&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-ligue-de-football-professionnelle-du-togo-creee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065258 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-ligue-de-football-professionnelle-du-togo-creee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:04:22:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816218&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-de-rdc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065321 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-de-rdc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:04:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856458&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnomegnon-agbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065399 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nomegnon-agbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:04:24:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737112&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065475 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [10/Jun/2026:04:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594222&pdata=http%253A%252F%252Ftogodailynews.tg%252Fwezou-plus-de-400-000-femmes-enceintes-beneficiaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065495 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/wezou-plus-de-400-000-femmes-enceintes-beneficiaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.217.24.130
country_id: 6252001
description:
185.217.24.130 - - [10/Jun/2026:04:26:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800994&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccination-dans-les-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065602 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccination-dans-les-eglises/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.6647.1731 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.217.24.130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.138.16.178
country_id: 798544
description:
[2026-06-10 04:27:34 +0000] info [whostmgrd] 45.138.16.178 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID 8du7s3) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [10/Jun/2026:04:28:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805413&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065704 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.138.16.178
country_id: 798544
description:
[2026-06-10 04:27:36 +0000] info [whostmgrd] 45.138.16.178 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.138.16.178
country_id: 798544
description:
[2026-06-10 04:27:37 +0000] info [whostmgrd] 45.138.16.178 - root "GET /cpsess9169288767/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:04:28:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974613&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781065729 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.115
country_id: 690791
description:
Jun 10 04:30:04 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.113.86
country_id: 1269750
description:
Jun 10 04:30:56 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.113.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-06-10 04:30:58 dovecot_login authenticator failed for H=([61.160.68.38]) [27.123.113.86]:37974: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.110.138
country_id: 1269750
description:
Jun 10 04:31:09 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.110.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.138
country_id: 1269750
description:
2026-06-10 04:31:11 dovecot_login authenticator failed for H=([220.180.107.193]) [182.95.110.138]:56150: 535 Incorrect authentication data (set_id=olivier.gadawouye)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 04:34:33 +0000] info [cpaneld] 103.65.237.227 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.70.72.9
country_id: 3469034
description:
177.70.72.9 - - [10/Jun/2026:04:34:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066073&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-pradeb-colle-a-la-peau-du-developpement-a-la-base%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066096 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-pradeb-colle-a-la-peau-du-developpement-a-la-base/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.8643.1078 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.70.72.9


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:04:37:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856557&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwomen-business-and-the-law-le-togo-classe-1er-en-afrique-avec-97-5-de-score%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066228 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/women-business-and-the-law-le-togo-classe-1er-en-afrique-avec-97-5-de-score/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 10 04:39:30 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [10/Jun/2026:04:38:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235998&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-grandes-decisions-du-conseil-des-ministres-de-ce-mercredi-7-juillet-2021-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066334 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-grandes-decisions-du-conseil-des-ministres-de-ce-mercredi-7-juillet-2021-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun 10 04:39:11 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jun 10 04:39:30 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
country_id: 290557
description:
Jun 10 04:39:29 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 10 04:39:29 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.124.64
country_id: 798544
description:
Jun 10 04:39:34 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.124.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 10 04:39:06 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jun 10 04:39:12 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.122.83
country_id: 1269750
description:
Jun 10 04:39:22 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.122.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 04:40:33 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.124.64
country_id: 798544
description:
Jun 10 04:39:41 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.124.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 10 04:39:56 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 10 04:40:19 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.122.83
country_id: 1269750
description:
Jun 10 04:40:08 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.122.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 10 04:40:37 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.180.249.7
country_id: 1835841
description:
Jun 10 04:40:47 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.180.249.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 10 04:41:27 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.125.183
country_id: 3469034
description:
Jun 10 04:41:02 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.125.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.128.225
country_id: 2017370
description:
Jun 10 04:41:10 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.128.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.125.183
country_id: 3469034
description:
Jun 10 04:41:39 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.125.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:04:41:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606762&pdata=https%253A%252F%252Ftogodailynews.tg%252Fclassements-internationaux-le-togo-encense-pour-sa-gouvernance-economique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066512 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/classements-internationaux-le-togo-encense-pour-sa-gouvernance-economique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.5.68.124
country_id: 1562822
description:
Jun 10 04:42:04 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.5.68.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.68.124
country_id: 1562822
description:
2026-06-10 04:42:06 dovecot_plain authenticator failed for H=(yb6vth1pw2hdlp3b0mral9qmagt7u) [117.5.68.124]:36683: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jun 10 04:42:43 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:04:43:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724461&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066631 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
country_id: 1269750
description:
Jun 10 04:44:08 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:04:44:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803882&pdata=https%253A%252F%252Ftdn.tg%252Ftogoexplosion-port-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066678 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togoexplosion-port-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.159.250
country_id: 1522867
description:
2026-06-10 04:45:26 H=([89.218.159.250]) [89.218.159.250]:14098 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.73
country_id: 1512440
description:
2026-06-10 04:45:33 H=([213.230.86.73]) [213.230.86.73]:24419 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jun 10 04:46:32 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:04:46:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657384&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066776 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:04:46:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10248596&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fboston-university%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/boston-university/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jun 10 04:46:40 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [10/Jun/2026:04:47:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986924&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066834 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.10.4.53
country_id: 2510769
description:
2026-06-10 04:47:37 dovecot_plain authenticator failed for H=(ascolung) [45.10.4.53]:44726: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:04:48:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857130&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066898 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:04:49:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197605&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feau-potable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066945 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eau-potable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:04:48:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326640&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781066937 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 04:49:25 +0000] info [cpaneld] 103.65.237.227 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:04:50:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592916&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpape-benoit-xvi-en-deuil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067034 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pape-benoit-xvi-en-deuil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.215.47
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-39-prefectures-mobilisees-pour-la-campagne-de-reboisement-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.215.47
country_id: 2245662
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-39-prefectures-mobilisees-pour-la-campagne-de-reboisement-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:04:52:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13026967&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdomaines-porteurs-en-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067144 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/domaines-porteurs-en-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:04:53:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443606&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067202 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [10/Jun/2026:04:53:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987689&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdomaines-porteurs-en-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067222 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/domaines-porteurs-en-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.168.94.205
country_id: 6252001
domain: yanacom.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/admin/.env.backup||User:gsvoeixl||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.159.250
country_id: 1522867
description:
2026-06-10 04:53:48 H=([89.218.159.250]) [89.218.159.250]:38242 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-10 04:56:01 +0000] info [cpaneld] 78.135.61.227 NEW ifxmoxbf:A9rYnLk_ue_30ZNh address=78.135.61.227,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-10 04:56:08 +0000] info [cpaneld] 78.135.61.227 - ifxmoxbf "GET /assets/brand/favicon.ico HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.73
country_id: 1512440
description:
2026-06-10 04:55:51 H=([213.230.86.73]) [213.230.86.73]:59610 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.134.106.169
country_id: 1733045
description:
115.134.106.169 - - [10/Jun/2026:04:57:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919059&pdata=https%253A%252F%252Ftogodailynews.tg%252Fumoa-titres-le-togo-leve-33-milliards%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067472 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/umoa-titres-le-togo-leve-33-milliards/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5924.1867 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.134.106.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:04:59:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581611&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprojet-dappui-a-lamelioration-de-la-competitivite-de-la-filiere-ananas-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067582 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/projet-dappui-a-lamelioration-de-la-competitivite-de-la-filiere-ananas-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.151.213.39
country_id: 1210997
description:
103.151.213.39 - - [10/Jun/2026:04:59:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392988&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcovid-19-la-cnss-suspend-le-controle-de-vie-du-premier-semestre-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067577 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/covid-19-la-cnss-suspend-le-controle-de-vie-du-premier-semestre-2020/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.8766.1972 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.151.213.39


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:05:01:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793684&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fceinture-wako-pro%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067664 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ceinture-wako-pro/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:05:02:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920903&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067723 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:05:02:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815962&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdelato-kokou-agbokpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067768 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/delato-kokou-agbokpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:05:03:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131145&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkoffi-akpagana%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067781 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/koffi-akpagana/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 10 05:03:30 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:05:03:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920600&pdata=https%253A%252F%252Ftdn.tg%252Freseau-criminel-qnet-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067813 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-criminel-qnet-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:05:04:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816178&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067845 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:05:04:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973289&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F12%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067843 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/12/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.125.222.48
country_id: 6252001
domain: webdisk.test.free.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/config/.env.production||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:05:04:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145237&pdata=https%253A%252F%252Ftdn.tg%252Ftogoexplosion-port-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067897 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togoexplosion-port-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:05:05:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078314&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781067936 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.163.115.163
country_id: 3017382
domain: www.cameg-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:camaegdtomgo||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58d1d245f0d2fe5a19f8bfa44e22ac7e791aec0c||Title:gm4or0jje3wcdtnqdo||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f93f2394fe8dae53fb9b448a37648c34241cd36||Title:ttcjrlpgligfy3n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:05:07:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856551&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-du-celebre-prophete-sena-le-roi-des-adomenou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068059 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-du-celebre-prophete-sena-le-roi-des-adomenou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:05:08:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7366547&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068092 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-10 05:08:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:49880: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03a9e8b25eeb1e7d0f31dcbb6298075cfa4a5b86||Title:1us1eet3554qujb||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:05:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985061&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068143 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fceb7c0fc476c500e329dc7220fec104fabc7945||Title:muqfritrdkops0uu0||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.200.86.95
country_id: 1861060
domain: www.afriquerevelation.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:glfmqhlj||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:35c51e004dbd955b21a78b31087b5d367eddf0dd||Title:ns3hiiv4xz8e94xr1b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:05:11:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530310&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068287 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:05:10:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737064&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcamion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068248 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bcd2d7852c40eb63981ae47c4cbefcf11fe64df||Title:ejwjrwc7ymj54gf69||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47a7d7f3255f7dda69ebe399cbeb4ea1282945b2||Title:yby16xt9vou4f3tfm8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:05:13:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067864&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feau-potable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068399 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eau-potable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f42951434db9870fae165bd2b0f932de8b53ae8||Title:mpbxsc6umrwv3kcldr||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:05:15:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146729&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasteur-awanyoh-mawuli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068507 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pasteur-awanyoh-mawuli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [10/Jun/2026:05:14:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199814&pdata=http%253A%252F%252Ftogodailynews.tg%252Fbonne-gouvernance-economique-et-sociale-le-togo-consolide-ses-reformes-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068475 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/bonne-gouvernance-economique-et-sociale-le-togo-consolide-ses-reformes-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b42b32d14206cbf5333d277ab1e52f57a3cc0ba||Title:6ocwfb9cz0cfg73z||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.180.16.151
country_id: 3469034
description:
45.180.16.151 - - [10/Jun/2026:05:18:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300551&pdata=https%253A%252F%252Ftogodailynews.tg%252Fa-namon-la-sante-des-populations-reste-une-priorite&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068703 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/a-namon-la-sante-des-populations-reste-une-priorite" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.180.16.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.163.90.59
country_id: 3469034
description:
45.163.90.59 - - [10/Jun/2026:05:19:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13197764&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-groupe-excellence-forme-les-leaders-de-jeunes-le-15-aout-prochain-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781068789 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-groupe-excellence-forme-les-leaders-de-jeunes-le-15-aout-prochain-a-lome/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.8748.1874 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.163.90.59


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.36.52
country_id: 3895114
domain: www.ucm-afrique.com.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:tcdiejwsder||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:22:57 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:22:58 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 117.199.80.202
country_id: 1269750
description:
117.199.80.202 - - [10/Jun/2026:05:24:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328985&pdata=https%253A%252F%252Fcfpj.tg%252Fhdvc-371017letidm16xdl.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781069054 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/hdvc-371017letidm16xdl.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:117.199.80.202


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:99801df1566a3caf33de0269114fc8e6ad497a3b||Title:q6bg28ln0ndebq3||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96d57e6ebc03e3d5a63e3fa0b5bfcbc7ad6a4e3c||Title:qgm89rv9dnrzkvxpl||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4aabcc14bdccf01cc876e6b18c292c8579c5d75||Title:l9hdp1mqschoh5kz||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:db7938dd9249216964994813729533f2c20c6226||Title:x6uc0ksakmauwzpt3||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.58
country_id: 1880251
description:
47.128.121.58 - - [10/Jun/2026:05:29:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392687&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbientot-le-5e-recensement-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781069353 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/bientot-le-5e-recensement-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.58


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30b4b73b0736c2ca74ce8a30395ba61ae29793e7||Title:v6z96vj8gdilks||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:30:57 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:30:58 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ddfa9dad608d001795abfc275f282563dc71669||Title:o8g3chjq9915vy6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [10/Jun/2026:05:32:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379347&pdata=https%253A%252F%252Ftogodailynews.tg%252Frespect-des-normes-environnementales-kodjo-adedze-et-foli-bazi-katari-en-visite-de-terrain-a-scantogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781069538 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/respect-des-normes-environnementales-kodjo-adedze-et-foli-bazi-katari-en-visite-de-terrain-a-scantogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [10/Jun/2026:05:32:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998701&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781069540 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb26d36d1416f3b260c6308b5322597c71d14242||Title:btseu1m3achobq3||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [10/Jun/2026:05:33:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266079&pdata=https%253A%252F%252Fpnls.tg%252FPNLS01%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781069594 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/PNLS01/index.php" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.104.45
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:859bf3c436a0b91f37c9576897e8ed94a5408e18||Title:4wg9sszo9ulvcqa7zo||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:32:51 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:32:50 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.214.1.130
country_id: 1282988
description:
103.214.1.130 - - [10/Jun/2026:05:35:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13223273&pdata=https%253A%252F%252Ftogodailynews.tg%252F2e-promotion-du-egdp-15-diplomes-selectionnes-sur-1-060-candidatures%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781069754 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/2e-promotion-du-egdp-15-diplomes-selectionnes-sur-1-060-candidatures/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9962.1068 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.214.1.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.101.248
country_id: 6252001
description:
2026-06-10 05:39:34 dovecot_plain authenticator failed for H=(i5t1bkut1otbvgof) [162.243.101.248]:40162: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.243.101.248
country_id: 6252001
description:
Jun 10 05:39:32 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.243.101.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-10 05:40:10 +0000] info [cpaneld] 5.230.153.52 NEW zauwogvk:uvntL9adQCork5BD address=5.230.153.52,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.192
country_id: 2921044
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.354715118797525.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.78
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.949379906229618.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-10 05:40:27 +0000] info [cpaneld] 5.230.153.46 NEW hnefmnqz:8oZAvF6izhglCBxb address=5.230.153.46,app=cpaneld,creator=hnefmnqz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-10 05:40:06 +0000] info [cpaneld] 5.230.133.110 NEW wgqhqbem:Y7LonOpOenMGos1h address=5.230.133.110,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [10/Jun/2026:05:40:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788762&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070011 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.195
country_id: 6252001
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.106741081597693.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.51.243
country_id: 1149361
description:
2026-06-10 05:41:43 H=([149.54.51.243]) [149.54.51.243]:11223 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:05:42:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724509&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finterdiction-de-la-diffusion-de-la-publicite-des-traditherapeutes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070128 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/interdiction-de-la-diffusion-de-la-publicite-des-traditherapeutes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [10/Jun/2026:05:42:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052742&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-nouveau-calendrier-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070134 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-nouveau-calendrier-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.176
country_id: 2300660
description:
Jun 10 05:42:52 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:05:44:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789532&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070249 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:05:43:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854297&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-nouveau-calendrier-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070216 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-nouveau-calendrier-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:05:45:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315159&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-collective-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070299 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-collective-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:05:44:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065816&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070281 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:05:46:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936277&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070380 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.202.26.9
country_id: 130758
description:
2026-06-10 05:47:17 H=([5.202.26.9]) [5.202.26.9]:50155 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77093094
abuser: 178.128.211.16
country_id: 1880251
domain: academie.besteva1.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=(function(){var _r=typeof require!=='undefined'?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!=='undefined'?globalThis.require:null));return 128 993 391 481 10000;})();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`NEXT_REDIRECT;push;/x?d=${encodeURIComponent(String(res))};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:05:47:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050387&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070456 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:05:48:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065045&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070534 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.50
country_id: 3469034
description:
Jun 10 05:48:49 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:05:50:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264024&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoups-de-feu-entendus-a-cotonou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070624 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coups-de-feu-entendus-a-cotonou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.241.5
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Togo : Le test PCR Covid-19 est d\xc3\xa9sormais \xc3\xa0 25 000 FCFA | TOGODAILYNEWS&siteId=1&rec=1&rand=977358&h=13&m=51&s=9&url=http:/togodailynews.tg/togo-le-test-prc-covid-19-est-desormais-fixe-a-25-000-fcfa/&uid=0&pid=5230&visitorId=e0652258eb7cf886&fvts=1781070670&vc=1&idn=0&refts=0&lvts=1781070670&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=2004&pvId=L0gGoy&browser=Chrome_58&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [10/Jun/2026:05:51:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145968&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070681 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:05:52:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934701&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070729 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:05:51:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184042&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070714 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:05:53:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9814984&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprof-ayewouadan-akodah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070805 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prof-ayewouadan-akodah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:05:52:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999214&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070754 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:05:55:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133937&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprof-ayewouadan-akodah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070922 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prof-ayewouadan-akodah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:05:56:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528678&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070372 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:05:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066538&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781070935 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.242.205
country_id: 3865483
description:
Jun 10 05:55:42 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.242.205 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:05:56:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6648005&pdata=https%253A%252F%252Ftogodailynews.tg%252Fblue-invest-africa-2025-lome-au-coeur-de-la-mise-en-lumiere-du-potentiel-de-leconomie-bleue-en-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071009 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/blue-invest-africa-2025-lome-au-coeur-de-la-mise-en-lumiere-du-potentiel-de-leconomie-bleue-en-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:05:56:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012263&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fserge-akakpo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071012 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/serge-akakpo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:05:58:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000024&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-collective-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071084 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-collective-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:05:58:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053482&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclicks-pharmacy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071092 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clicks-pharmacy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [10/Jun/2026:05:58:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866792&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071106 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:05:58:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920856&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071099 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:05:58:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144101&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoups-de-feu-entendus-a-cotonou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071128 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coups-de-feu-entendus-a-cotonou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-10 06:00:08 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [10/Jun/2026:06:01:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000488&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071278 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.73.164.228
country_id: 1269750
description:
Jun 10 06:01:31 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.73.164.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.73.164.228
country_id: 1269750
description:
Jun 10 06:01:40 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.73.164.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.47
country_id: 1512440
description:
2026-06-10 06:01:43 H=([213.230.87.47]) [213.230.87.47]:44460 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 154.7.240.99
country_id: 3469034
domain: sncom.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 205.188.192.17
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:736-de-taux-dexecution-physique-a-fin-decembre-2023/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:06:04:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606505&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdelato-kokou-agbokpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071493 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/delato-kokou-agbokpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: www.collation.ucao-uut.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.122
country_id: 1880251
description:
47.128.121.122 - - [10/Jun/2026:06:05:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985163&pdata=https%253A%252F%252F24heureinfo.tg%252Fcedeao%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071523 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/cedeao/page/6/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [10/Jun/2026:06:06:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12873071&pdata=https%253A%252F%252Ftogodailynews.tg%252Fifad-aquaculture-un-mecanisme-innovant-pour-accelerer-lentrepreneuriat-des-jeunes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071562 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ifad-aquaculture-un-mecanisme-innovant-pour-accelerer-lentrepreneuriat-des-jeunes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.58.80.196
country_id: 3923057
description:
200.58.80.196 - - [10/Jun/2026:06:07:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079498&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-faure-gnassingbe-nomme-de-nouveaux-magistrats%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071647 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-faure-gnassingbe-nomme-de-nouveaux-magistrats/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2539.1190 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.58.80.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:06:08:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661896&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071689 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.207.133
country_id: 3469034
description:
Jun 10 06:09:42 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.207.133 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [10/Jun/2026:06:10:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580324&pdata=http%253A%252F%252Fwww.afriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071840 HTTP/1.1" 302 0 www.afriquerevelation.tg "http://www.afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.73.215
country_id: 6252001
domain: www.sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sp-eau.tg/robots.txt HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.123.215.237
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.123.215.237) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.84.30
country_id: 2921044
domain: www.sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sp-eau.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.241.84.100
country_id: 99237
description:
176.241.84.100 - - [10/Jun/2026:06:13:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077589&pdata=http%253A%252F%252Ftogodailynews.tg%252Fvolontariat-au-togo-omar-agbangba-a-recu-la-visite-de-messier%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781071995 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/volontariat-au-togo-omar-agbangba-a-recu-la-visite-de-messier/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.8141.1543 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.241.84.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-10 06:13:51 +0000] info [cpaneld] 5.230.153.242 - ebbmnmtd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.231
country_id: 1269750
description:
Jun 10 06:15:41 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 171.236.51.171
country_id: 1562822
description:
2026-06-10 06:16:22 H=([0.0.0.0]) [171.236.51.171]:20894 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.18.91
country_id: 1814991
domain: tdn.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:06:19:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870812&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781072385 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.190.132.43
country_id: 1210997
description:
103.190.132.43 - - [10/Jun/2026:06:19:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972561&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmsc-robert-dussey-invite-les-etats-a-travailler-davantage-sur-les-inegalites-socio-economiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781072384 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/msc-robert-dussey-invite-les-etats-a-travailler-davantage-sur-les-inegalites-socio-economiques/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.3630.1877 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.190.132.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.153.12.174
country_id: 6252001
description:
2026-06-10 06:19:39 dovecot_plain authenticator failed for H=(6so9b3yol0jzhmd78) [43.153.12.174]:37328: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.224.146
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc-300x180.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.207
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-300x200.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [10/Jun/2026:06:23:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379558&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781072583 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"205.169.39.0" CAPTCHA:"0" PEER:162.159.104.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.238.122
country_id: 2542007
description:
Jun 10 06:25:51 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.238.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-06-10 06:25:53 dovecot_login authenticator failed for H=([95.165.182.238]) [154.146.238.122]:47350: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-10 06:28:14 dovecot_plain authenticator failed for H=(c1haqs0ijf5pylb0) [27.73.209.71]:45205: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:06:27:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725341&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781072871 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun 10 06:28:12 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:06:29:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870952&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftechniques-pour-fideliser-ses-clients%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781072952 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/techniques-pour-fideliser-ses-clients/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:06:33:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261351&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finterdiction-de-la-diffusion-de-la-publicite-des-traditherapeutes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073225 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/interdiction-de-la-diffusion-de-la-publicite-des-traditherapeutes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:06:35:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854001&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fserge-akakpo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073332 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/serge-akakpo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:06:34:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989013&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073289 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:06:35:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278060&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073353 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:06:35:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473837&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073346 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:06:37:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065051&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-du-celebre-prophete-sena-le-roi-des-adomenou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073453 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-du-celebre-prophete-sena-le-roi-des-adomenou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:06:36:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855639&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073396 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:06:38:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936906&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-du-celebre-prophete-sena-le-roi-des-adomenou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073535 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-du-celebre-prophete-sena-le-roi-des-adomenou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.118.86.165
country_id: 6252001
description:
136.118.86.165 - - [10/Jun/2026:06:39:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672603&pdata=https%253A%252F%252Fave2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073568 HTTP/2.0" 302 0 ave2.mairie.tg "https://ave2.mairie.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.118.86.165


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.228.176
country_id: 357994
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=\xc3\x89lections l\xc3\xa9gislatives et r\xc3\xa9gionales au Togo : D\xc3\xa9marrage effectif de la campagne ce 13 avril 2024 | TOGODAILYNEWS&siteId=1&rec=1&rand=797729&h=14&m=39&s=42&url=http:/togodailynews.tg/elections-legislatives-et-regionales-au-togo-demarrage-effectif-de-la-campagne-ce-13-avril-2024/&uid=0&pid=14081&visitorId=0610bca78a7ba419&fvts=1781073582&vc=1&idn=0&refts=0&lvts=1781073582&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3561&pvId=n003uT&browser=Chrome_48&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.20
country_id: 298795
description:
Jun 10 06:40:05 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.20 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 163.47.122.185
country_id: 2077456
description:
163.47.122.185 - - [10/Jun/2026:06:42:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050435&pdata=https%253A%252F%252Ftogofarm.tg%252Fglfjd.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073740 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/glfjd.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:163.47.122.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.118.86.165
country_id: 6252001
description:
136.118.86.165 - - [10/Jun/2026:06:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789223&pdata=https%253A%252F%252Fave2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073700 HTTP/2.0" 302 0 ave2.mairie.tg "https://ave2.mairie.tg/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.118.86.165


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:06:43:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186088&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073813 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.172.142.89
country_id: 3865483
description:
45.172.142.89 - - [10/Jun/2026:06:42:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800785&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-kadanga-walla-ancien-dg-cnss%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073758 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-kadanga-walla-ancien-dg-cnss/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.9518.1629 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.172.142.89


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.187.192.4
country_id: 1814991
description:
2026-06-10 06:43:18 H=([0.0.0.0]) [39.187.192.4]:1115 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:06:44:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934955&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073840 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:06:45:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133723&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-kadanga-walla-ancien-dg-cnss%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073909 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-kadanga-walla-ancien-dg-cnss/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:06:45:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776258&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F15-ans-cmda-concert-chantre-dodo-brigitte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073921 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/15-ans-cmda-concert-chantre-dodo-brigitte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:06:46:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883609&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073971 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.111.225.94
country_id: 1210997
description:
103.111.225.94 - - [10/Jun/2026:06:46:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9736902&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781073963 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.9461.1020 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.111.225.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:06:46:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710941&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074009 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:06:47:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857643&pdata=https%253A%252F%252Ftogodailynews.tg%252Fatidi-soutient-un-projet-solaire-de-20-mw-en-ouganda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074035 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/atidi-soutient-un-projet-solaire-de-20-mw-en-ouganda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:06:48:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274197&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074079 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 135.129.178.148
country_id: 6252001
description:
135.129.178.148 - - [10/Jun/2026:06:47:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068187&pdata=http%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074070 HTTP/1.1" 302 0 afriquerevelation.tg "http://afriquerevelation.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:135.129.178.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:06:48:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116180&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074079 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.40.71.103
country_id: 2921044
domain: www.marketplace.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:marketplacenetma||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.58
country_id: 1880251
description:
47.128.121.58 - - [10/Jun/2026:06:50:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815702&pdata=https%253A%252F%252Ftogodailynews.tg%252Fenfpe-7-314-enseignants-formes-pour-mieux-soccuper-des-ecoliers%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074210 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/enfpe-7-314-enseignants-formes-pour-mieux-soccuper-des-ecoliers/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:06:52:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804135&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F15-ans-cmda-concert-chantre-dodo-brigitte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074362 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/15-ans-cmda-concert-chantre-dodo-brigitte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:06:53:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378372&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074399 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 06:54:13 +0000] info [cpaneld] 103.65.237.227 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:06:53:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196327&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074437 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:06:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13408917&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074540 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:06:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842518&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074546 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:06:56:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052436&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074560 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:06:56:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275269&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074617 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.159.130.152
country_id: 1210997
description:
2026-06-10 06:57:33 H=([103.159.130.162]) [103.159.130.152]:49465 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:06:57:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326055&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074624 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [10/Jun/2026:06:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069935&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-cno-fthb-rencontre-auguste-dogbo-deladem-akpaki%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074706 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-cno-fthb-rencontre-auguste-dogbo-deladem-akpaki/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:06:58:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251112&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074719 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:07:00:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722408&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074806 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:07:01:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128986&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074881 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.18
country_id: 1880251
description:
47.128.121.18 - - [10/Jun/2026:07:01:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896666&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Ffulbert-attiso%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074858 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/fulbert-attiso/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.18


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.122.161
country_id: 2363686
description:
[2026-06-10 07:00:43 +0000] info [webmaild] 196.170.122.161 - controleur.interne@ucao-uut.tg "POST /cpsess4175548919/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.212.21] != Current IP Address [196.170.122.161]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.31.148.93
country_id: 798544
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40eaa95bb82e53f815648771ff9161eb970d0039||Title:86cbqxz9qorxmz4n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:07:03:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001002&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781074989 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:07:04:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528869&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075067 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.23.94.21
country_id: 6252001
description:
[2026-06-10 07:04:16 +0000] info [whostmgrd] 100.23.94.21 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.235.31.47
country_id: 6252001
description:
Jun 10 07:03:50 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.235.31.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.19
country_id: 6252001
description:
[2026-06-10 07:04:13 +0000] info [whostmgrd] 217.181.72.19 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 10 07:04:19 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.199.119.25
country_id: 3469034
domain: davetechno.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/src/.env.backup||User:davetkoo||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
country_id: 1814991
description:
Jun 10 07:04:56 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.173.95.73
country_id: 6252001
description:
[2026-06-10 07:04:59 +0000] info [whostmgrd] 142.173.95.73 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 10 07:05:32 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.91.64.60
country_id: 6252001
description:
[2026-06-10 07:05:09 +0000] info [whostmgrd] 3.91.64.60 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.116.132
country_id: 6252001
description:
[2026-06-10 07:06:30 +0000] info [whostmgrd] 82.40.116.132 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [10/Jun/2026:07:08:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378283&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075323 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.214.90.211
country_id: 6252001
description:
[2026-06-10 07:09:52 +0000] info [whostmgrd] 44.214.90.211 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.36.224
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-10.104.207.36.224||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:07:10:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804144&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnomegnon-agbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075452 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nomegnon-agbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [10/Jun/2026:07:10:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857938&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F06%252F17%252Ftogo-pres-de-65-de-cas-gueris-de-la-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075449 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/06/17/togo-pres-de-65-de-cas-gueris-de-la-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2108||QS:add-to-cart=2108||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 10 07:12:50 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
country_id: 1814991
description:
Jun 10 07:12:59 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:07:13:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934794&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcanal-togo-recrute-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075579 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/canal-togo-recrute-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-10 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:53700: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.81.14
country_id: 6252001
description:
[2026-06-10 07:14:10 +0000] info [whostmgrd] 23.104.81.14 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:07:13:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278062&pdata=https%253A%252F%252Ftdn.tg%252Ftombes-profanees-cranes-ossements-voles-reseau-trafic-restes-humains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075623 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tombes-profanees-cranes-ossements-voles-reseau-trafic-restes-humains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:07:13:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723220&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075630 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2154||QS:add-to-cart=2154||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:07:15:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647649&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyvan-castanou-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075719 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yvan-castanou-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.155.143.156
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/sante-publique-une-annee-de-consolidation-et-de-progres-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2144||QS:add-to-cart=2144||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.155.143.156
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sante-publique-une-annee-de-consolidation-et-de-progres-au-togo/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [10/Jun/2026:07:17:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923942&pdata=http%253A%252F%252Fywxmm6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075819 HTTP/1.1" 302 0 ywxmm6.mediatopnews.tg "http://ywxmm6.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:07:16:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525540&pdata=https%253A%252F%252Ftdn.tg%252Fmega-le-kedeeee-recuperer-data-expire-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075801 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mega-le-kedeeee-recuperer-data-expire-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.116
country_id: 1880251
description:
47.128.122.116 - - [10/Jun/2026:07:18:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972524&pdata=https%253A%252F%252Ftogodailynews.tg%252Flome-capitale-de-la-promotion-des-investissements-dans-les-infrastructures-en-afrique-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075898 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lome-capitale-de-la-promotion-des-investissements-dans-les-infrastructures-en-afrique-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.116


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2095||QS:add-to-cart=2095||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:07:18:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131864&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075910 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:07:19:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788500&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075981 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:07:19:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198642&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781075988 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:07:20:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856153&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076057 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:07:21:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053741&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076070 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.64.8.251
country_id: 1522867
description:
2026-06-10 07:21:27 H=([0.0.0.0]) [176.64.8.251]:14173 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.231.120.186
country_id: 798544
description:
2026-06-10 07:22:50 dovecot_login authenticator failed for H=(91.231.120.186) [91.231.120.186]:40836: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.236
country_id: 6252001
description:
[2026-06-10 07:23:08 +0000] info [cpaneld] 82.40.126.236 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:07:22:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132372&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076160 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 84.247.173.80
country_id: 3017382
description:
[2026-06-10 07:23:52 +0000] info [cpaneld] 84.247.173.80 NEW he24djure:zaBxnZlkgHO_HHLs address=84.247.173.80,app=cpaneld,creator=he24djure,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.240.131.221
country_id: 1880251
domain: afriquerevelation.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/api/.env.backup||User:glfmqhlj||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:07:24:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6799979&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076248 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.240.131.221
country_id: 1880251
domain: afriquerevelation.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/server/.env.backup||User:glfmqhlj||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2150||QS:add-to-cart=2150||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.4.47.199
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/42.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [10/Jun/2026:07:26:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252189&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F01%252F27%252Fdiplomatie-lambassadrice-rokhaya-ba-presente-ses-lettres-de-creances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076384 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2021/01/27/diplomatie-lambassadrice-rokhaya-ba-presente-ses-lettres-de-creances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:07:26:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907035&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-cno-fthb-rencontre-auguste-dogbo-deladem-akpaki%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076364 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-cno-fthb-rencontre-auguste-dogbo-deladem-akpaki/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:07:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946476&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F15-ans-cmda-concert-chantre-dodo-brigitte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076478 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/15-ans-cmda-concert-chantre-dodo-brigitte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:07:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382229&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Favant-le-premier-cri-de-mawulolo-roger-lasmothey%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076466 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/avant-le-premier-cri-de-mawulolo-roger-lasmothey/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:07:28:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658407&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076485 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:07:27:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657941&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076459 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2046||QS:add-to-cart=2046||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:07:29:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937107&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076542 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.237.200.210
country_id: 1527747
description:
2026-06-10 07:29:15 H=([89.237.200.210]) [89.237.200.210]:28820 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:07:28:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988505&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flome-city%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076529 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lome-city/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:07:29:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378335&pdata=https%253A%252F%252Ftdn.tg%252Ftabaski-2023-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076592 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tabaski-2023-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: modsec
rule: 77142120
name: IM360 WAF: Unauthenticated Arbitrary File Upload in the WordPress Plugin Simple File List < 4.2.3
abuser: 137.175.93.126
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Unauthenticated Arbitrary File Upload in the WordPress Plugin Simple File List < 4.2.3||WPU:||RSV:8.15||T:APACHE||MVN:ARGS:eeSFL_FileUploadDir||MV:/wp-content/uploads/simple-file-list/||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2053||QS:add-to-cart=2053||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 137.175.93.126
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:152020||Sizes:882||Combined size:882||User:qfaclpeg||WPU:||Filename:oqrqlzygs0.png||Scanned:/tmp//20260610-073013-aikShUbWwLwmTH9IngHLNAAAAAo-file-QJnE8n||SC:/home/qfaclpeg/public_html/wp-content/plugins/simple-file-list||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:07:30:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974822&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgrave-accident-de-la-circulation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076612 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/grave-accident-de-la-circulation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:07:30:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921320&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-concours-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076619 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-concours-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:07:31:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432041&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnomegnon-agbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076684 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nomegnon-agbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:07:31:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329499&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076676 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-de-lome-lexamen-de-la-faseg-programme-voici-le-calendrier-du-deroulement-des-epreuves/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2116||QS:add-to-cart=2116||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.115.200
country_id: 6252001
description:
[2026-06-10 07:31:14 +0000] info [whostmgrd] 82.40.115.200 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:07:32:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130788&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076721 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [10/Jun/2026:07:31:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210058&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-nouveau-calendrier-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076695 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-nouveau-calendrier-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:07:34:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791896&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:07:36:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171178&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781076961 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:07:38:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920132&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077086 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-10 07:39:00 +0000] info [cpaneld] 134.195.83.78 NEW hnefmnqz:lWtj8I0jGFO9WXLf address=134.195.83.78,app=cpaneld,creator=hnefmnqz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [10/Jun/2026:07:40:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7315144&pdata=http%253A%252F%252Ftogodailynews.tg%252Fdeveloppement-humain-le-togo-premier-dans-lespace-uemoa-pour-la-cinquieme-fois-consecutive%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077235 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/developpement-humain-le-togo-premier-dans-lespace-uemoa-pour-la-cinquieme-fois-consecutive/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.221
country_id: 3175395
description:
Jun 10 07:41:17 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.221 has been locked due to Imunify RBL


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 137.175.93.126
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:162813||Sizes:882||Combined size:882||User:qfaclpeg||WPU:||Filename:p679f2xzt2.png||Scanned:/tmp//20260610-074319-aikVl8HLSr1UqeaimkRg0wAAAF0-file-XANgon||SC:/home/qfaclpeg/public_html/wp-content/plugins/simple-file-list||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:07:44:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516123&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcamion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077465 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.251.40
country_id: 3624060
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Togo: Les forces vives de la Pr\xc3\xa9fecture d\xe2\x80\x99Ani\xc3\xa9 la Ve R\xc3\xa9publique | TOGODAILYNEWS&siteId=1&rec=1&rand=521855&h=15&m=44&s=46&url=http:/togodailynews.tg/togo-les-forces-vives-de-la-prefecture-danie-la-ve-republique/&uid=0&pid=18027&visitorId=b4030b770243b393&fvts=1781077486&vc=1&idn=0&refts=0&lvts=1781077486&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=5252&pvId=pqf6nC&browser=Chrome_42&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.73.174.113
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.73.174.113) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.250.68
country_id: 6290252
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/js/swiper-bundle.min.js?ver=1.0.0 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:07:45:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804999&pdata=http%253A%252F%252Ftogodailynews.tg%252Fumoa-titres-le-togo-leve-33-milliards-fcfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077557 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/umoa-titres-le-togo-leve-33-milliards-fcfa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.254
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.77
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_474f2da06b2a20a3d78b023b42995487.css?ver=1.2 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [10/Jun/2026:07:46:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313556&pdata=https%253A%252F%252Ftogodailynews.tg%252Fumoa-titres-le-togo-a-la-recherche-de-25-milliards-fcfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077603 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/umoa-titres-le-togo-a-la-recherche-de-25-milliards-fcfa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.132.75
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [10/Jun/2026:07:47:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6721940&pdata=https%253A%252F%252Ftogodailynews.tg%252Flutte-contre-lerosion-cotiere-au-togo-lafd-investit-23-milliards-de-fcfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077638 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lutte-contre-lerosion-cotiere-au-togo-lafd-investit-23-milliards-de-fcfa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 07:48:38 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.62.186.244
country_id: 3175395
description:
Jun 10 07:49:19 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.62.186.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.129.227
country_id: 660013
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/js/float.js?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:07:50:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080221&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsmic-en-suisse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/smic-en-suisse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:07:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844052&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077830 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.66.28
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/wp-stats-manager/js/wsm_new.js HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:07:51:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920347&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077880 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.140.206
country_id: 2363686
description:
[2026-06-10 07:53:34 +0000] info [webmaild] 196.168.140.206 - kakue@togointerim.net "POST /cpsess4500016729/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.207.189.253] != Current IP Address [196.168.140.206]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [10/Jun/2026:07:53:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645146&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781077995 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.130
country_id: 933860
description:
Jun 10 07:53:52 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:07:54:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906982&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078040 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [10/Jun/2026:07:54:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13148058&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078085 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:07:56:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394052&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078174 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:07:56:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383253&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078194 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.193.228
country_id: 1512440
description:
2026-06-10 07:55:57 H=([198.163.193.228]) [198.163.193.228]:53898 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:07:57:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9618284&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-du-celebre-prophete-sena-le-roi-des-adomenou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078237 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-du-celebre-prophete-sena-le-roi-des-adomenou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.123.19
country_id: 6252001
description:
[2026-06-10 07:57:25 +0000] info [cpaneld] 82.40.123.19 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.251.140.227
country_id: 798549
description:
[2026-06-10 07:58:28 +0000] info [cpaneld] 37.251.140.227 - atms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atms (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: www.messagerie.pnls.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:08:00:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274669&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078434 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.93.45.33
country_id: 2017370
description:
2026-06-10 08:00:46 dovecot_login authenticator failed for H=([162.217.227.37]) [85.93.45.33]:56756: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:08:01:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120343&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078460 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.101
country_id: 2921044
description:
Jun 10 08:01:12 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.101
country_id: 2921044
description:
2026-06-10 08:01:14 dovecot_plain authenticator failed for H=tor-exit-101.digitalcourage.de (1cqyambmd9n5fpiargp8) [185.220.101.101]:59297: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.199.13
country_id: 1562822
description:
2026-06-10 08:02:50 dovecot_plain authenticator failed for H=(oj6iqjhtve7qn278kiit5o0y7) [115.77.199.13]:38123: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.159.38.161
country_id: 6252001
description:
[2026-06-10 08:04:46 +0000] info [cpaneld] 129.159.38.161 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.246.203
country_id: 1733045
description:
180.75.246.203 - - [10/Jun/2026:08:05:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461037&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-secteur-prive-confirme-son-adhesion-a-la-politique-de-developpement-de-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078722 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-secteur-prive-confirme-son-adhesion-a-la-politique-de-developpement-de-faure-gnassingbe/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.3239.1177 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.246.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.149.25
country_id: 2921044
description:
Jun 10 08:05:37 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.108.200.58
country_id: 6252001
description:
[2026-06-10 08:08:33 +0000] info [whostmgrd] 174.108.200.58 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:08:09:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120134&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmort-de-samuel-etoo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781078941 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mort-de-samuel-etoo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.248
country_id: 690791
description:
Jun 10 08:09:31 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:08:10:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997652&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-de-minamata%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079000 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-de-minamata/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.248
country_id: 690791
description:
Jun 10 08:09:37 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.91.91.96
country_id: 6252001
description:
[2026-06-10 08:11:31 +0000] info [cpaneld] 54.91.91.96 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.6
country_id: 1814991
description:
27.115.124.6 - - [10/Jun/2026:08:11:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856618&pdata=https%253A%252F%252Fhaplucia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079103 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:08:11:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884081&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgrand-chelem%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079108 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/grand-chelem/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:08:12:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817509&pdata=https%253A%252F%252Ftdn.tg%252Fcategory%252Fa-la-une%252Fpage%252F262%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079140 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/category/a-la-une/page/262/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:08:12:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855014&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcan-2021-reportee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079147 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/can-2021-reportee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [10/Jun/2026:08:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063706&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079153 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [10/Jun/2026:08:12:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606811&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasteur-awanyoh-mawuli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079166 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pasteur-awanyoh-mawuli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:08:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989221&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079203 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:08:12:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882003&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079159 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.188.121.55
country_id: 1562822
description:
2026-06-10 08:14:21 H=([113.164.90.231]) [14.188.121.55]:59760 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.12.27
country_id: 6252001
description:
[2026-06-10 08:14:59 +0000] info [cpaneld] 195.63.12.27 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:08:15:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9751497&pdata=https%253A%252F%252Ftdn.tg%252Ftombes-profanees-cranes-ossements-voles-reseau-trafic-restes-humains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079339 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tombes-profanees-cranes-ossements-voles-reseau-trafic-restes-humains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun 10 08:16:00 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-10 08:16:02 dovecot_plain authenticator failed for H=(4gqfgwqfswovkng6l6j3) [27.73.209.71]:32933: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-10 08:16:47 +0000] info [cpaneld] 5.230.133.217 NEW wgqhqbem:pmcI8IJIBby7zokb address=5.230.133.217,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.17.170.104
country_id: 3175395
domain: www.lasnbt.snb.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.252.117
country_id: 6252001
description:
Jun 10 08:16:59 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.252.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.58.128.110
country_id: 6252001
description:
[2026-06-10 08:18:05 +0000] info [whostmgrd] 207.58.128.110 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 207.58.128.110
country_id: 6252001
description:
[2026-06-10 08:18:08 +0000] info [whostmgrd] 207.58.128.110 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-10 08:18:14 +0000] info [cpaneld] 103.65.237.227 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.121.67
country_id: 6252001
description:
[2026-06-10 08:18:56 +0000] info [cpaneld] 82.40.121.67 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.173.93.96
country_id: 6252001
description:
[2026-06-10 08:19:02 +0000] info [cpaneld] 142.173.93.96 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:08:19:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119828&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Favant-le-premier-cri-de-mawulolo-roger-lasmothey%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079550 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/avant-le-premier-cri-de-mawulolo-roger-lasmothey/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.125.123
country_id: 6252001
description:
[2026-06-10 08:20:05 +0000] info [cpaneld] 82.40.125.123 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jun 10 08:19:54 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:08:21:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181771&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079685 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:08:22:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409897&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecensement-electoral-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079725 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recensement-electoral-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.149.125.245
country_id: 3469034
description:
201.149.125.245 - - [10/Jun/2026:08:22:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012573&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprof-dodzi-kokoroko-rappelle-les-procedures-de-creation-detablissements-scolaires-publics%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781079729 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/prof-dodzi-kokoroko-rappelle-les-procedures-de-creation-detablissements-scolaires-publics/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.7343.1816 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.149.125.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.225.97.89
country_id: 6252001
description:
[2026-06-10 08:23:47 +0000] info [cpaneld] 34.225.97.89 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.188.121.55
country_id: 1562822
description:
2026-06-10 08:24:02 H=([113.164.90.231]) [14.188.121.55]:65419 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.152
country_id: 6252001
description:
Jun 10 08:26:05 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.152
country_id: 6252001
description:
2026-06-10 08:26:07 dovecot_plain authenticator failed for H=(ivxh5c0xeehrodb5wxb7o4ebc) [23.129.64.152]:35881: 535 Incorrect authentication data (set_id=sotrane@sotranetogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.204.53.196
country_id: 6252001
description:
[2026-06-10 08:27:31 +0000] info [cpaneld] 34.204.53.196 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 212.143.94.254
country_id: 294640
domain: togofarm.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.4.87
country_id: 6252001
description:
[2026-06-10 08:28:14 +0000] info [cpaneld] 65.111.4.87 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:08:29:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302035&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080166 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:08:29:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015198&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flome-city%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080145 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lome-city/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kekeli.alemawo@togointerim.net [06/10/2026:08:31:08 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kekeli.alemawo@togointerim.net


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.124.110.184
country_id: 6252001
description:
[2026-06-10 08:30:59 +0000] info [cpaneld] 170.124.110.184 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.91.123
country_id: 2017370
description:
[2026-06-10 08:32:15 +0000] info [whostmgrd] 109.252.91.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:08:32:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793432&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fijnet%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080349 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ijnet/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:08:32:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909848&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080348 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.141.242.21
country_id: 6252001
description:
[2026-06-10 08:33:11 +0000] info [cpaneld] 204.141.242.21 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.115.98
country_id: 3865483
description:
[2026-06-10 08:34:16 +0000] info [whostmgrd] 181.209.115.98 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.232.165.128
country_id: 6252001
description:
[2026-06-10 08:33:40 +0000] info [cpaneld] 18.232.165.128 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 31.186.39.146
country_id: 2921044
domain: togofarm.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.112.228
country_id: 6252001
description:
[2026-06-10 08:34:37 +0000] info [cpaneld] 82.40.112.228 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.128.68.92
country_id: 2017370
description:
[2026-06-10 08:34:48 +0000] info [whostmgrd] 188.128.68.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.101.171.209
country_id: 2635167
description:
[2026-06-10 08:34:41 +0000] info [whostmgrd] 81.101.171.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:08:36:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314091&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080588 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.81.251.250
country_id: 6252001
description:
[2026-06-10 08:35:48 +0000] info [cpaneld] 50.81.251.250 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.207.233
country_id: 3895114
domain: mail.fetching-peach-whale.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:mgvybwur||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [10/Jun/2026:08:38:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593130&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080685 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.136.241.141
country_id: 6252001
description:
[2026-06-10 08:38:13 +0000] info [cpaneld] 150.136.241.141 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:08:38:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6317720&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-legalisation-documents-bac-2-supprimee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080711 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-legalisation-documents-bac-2-supprimee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 08:39:34 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.120.222
country_id: 6252001
description:
[2026-06-10 08:38:53 +0000] info [cpaneld] 82.40.120.222 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 08:39:43 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:08:39:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789222&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeeper-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080782 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deeper-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:08:40:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922924&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080855 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.112.217
country_id: 6252001
description:
[2026-06-10 08:42:01 +0000] info [cpaneld] 82.40.112.217 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.150.33.197
country_id: 1643084
domain: flp-tg.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:103.150.33.197||TA:103.150.33.197||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.184.41.202
country_id: 6254930
description:
[2026-06-10 08:43:32 +0000] info [whostmgrd] 85.184.41.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:08:43:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145749&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fde-souza-abel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781080989 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/de-souza-abel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.200.206.130
country_id: 1522867
description:
2026-06-10 08:44:19 H=([82.200.206.130]) [82.200.206.130]:53340 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-10 08:45:16 +0000] info [cpaneld] 5.230.153.13 NEW wwayrzpl:LwoskOlu32AhX1hh address=5.230.153.13,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun 10 08:44:43 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
country_id: 1814991
description:
Jun 10 08:44:47 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 10 08:45:17 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
country_id: 1814991
description:
Jun 10 08:44:45 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.82
country_id: 1269750
description:
Jun 10 08:45:12 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
country_id: 1814991
description:
Jun 10 08:45:21 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.214.34
country_id: 1269750
description:
Jun 10 08:45:26 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.214.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 10 08:44:45 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 08:44:44 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
country_id: 1814991
description:
Jun 10 08:45:07 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jun 10 08:44:44 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 10 08:45:08 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 10 08:45:29 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.43
country_id: 3865483
description:
[2026-06-10 08:45:02 +0000] info [whostmgrd] 181.46.164.43 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 10 08:45:52 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.200.206.130
country_id: 1522867
description:
2026-06-10 08:46:01 H=([82.200.206.130]) [82.200.206.130]:38761 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 08:45:40 +0000] info [webmaild] 196.171.46.177 - victoire.kablais@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 10 08:45:47 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:08:46:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737625&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081178 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
country_id: 1814991
description:
Jun 10 08:45:37 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jun 10 08:45:42 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jun 10 08:47:11 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.45.57
country_id: 6252001
description:
[2026-06-10 08:47:15 +0000] info [cpaneld] 104.207.45.57 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun 10 08:46:44 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:08:47:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106402&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081258 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.96.233
country_id: 1733045
description:
[2026-06-10 08:48:21 +0000] info [whostmgrd] 42.191.96.233 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:08:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027226&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081290 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - y.agbavon@butodra.tg [06/10/2026:08:48:47 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: y.agbavon@butodra.tg


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 178.254.11.38
country_id: 2921044
description:
[2026-06-10 08:49:25 +0000] info [whostmgrd] 178.254.11.38 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.11.38
country_id: 2921044
description:
[2026-06-10 08:49:24 +0000] info [whostmgrd] 178.254.11.38 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:08:49:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128262&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081382 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 08:51:02 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:08:51:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907800&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbraqueurs-interpelles-par-la-police-a-avedzi-limousine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081513 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/braqueurs-interpelles-par-la-police-a-avedzi-limousine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.41.212
country_id: 3996063
description:
[2026-06-10 08:53:26 +0000] info [whostmgrd] 187.189.41.212 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-10 08:52:44 +0000] info [webmaild] 196.170.45.140 - a.ajavon@wages.tg "GET /cpsess5956323471/3rdparty/roundcube/program/js/tinymce/icons/default/icons.min.js?s=5080200 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.194.251.154
country_id: 1668284
domain: www.immo.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:jmtctoni||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.61
country_id: 2300660
description:
Jun 10 08:54:27 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
country_id: 1814991
description:
Jun 10 08:54:02 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.139
country_id: 3469034
description:
Jun 10 08:54:14 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.61
country_id: 2300660
description:
Jun 10 08:54:41 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.108.177.52
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-54.91.108.177.52||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [10/Jun/2026:08:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711395&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-du-cortege-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081721 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-du-cortege-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: afriquerevelation.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/images/cache.php||SC:/home/glfmqhlj/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: afriquerevelation.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/images/images/cache.php||SC:/home/glfmqhlj/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [10/Jun/2026:08:56:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934703&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecensement-electoral-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081803 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recensement-electoral-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 10 08:57:17 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:08:57:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276817&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fde-souza-abel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081842 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/de-souza-abel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:08:58:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117680&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvente-en-tas-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081913 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vente-en-tas-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:08:58:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepp-agokpo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081887 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epp-agokpo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:08:57:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078615&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeeper-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081869 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deeper-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 10 08:59:28 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 10 08:59:32 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 10 08:59:33 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.82
country_id: 1269750
description:
Jun 10 08:59:06 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.82 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [10/Jun/2026:08:59:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247716&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmesures-fiscales-prises-en-faveur-du-secteur-prive-lotr-donne-des-precisions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081952 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/mesures-fiscales-prises-en-faveur-du-secteur-prive-lotr-donne-des-precisions/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:08:59:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726407&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbraqueurs-interpelles-par-la-police-a-avedzi-limousine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781081960 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/braqueurs-interpelles-par-la-police-a-avedzi-limousine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 08:59:55 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 10 08:59:44 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 08:59:49 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Jun 10 09:00:24 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:09:00:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134231&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082022 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun 10 09:00:30 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 10 08:59:38 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 10 08:59:37 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 10 09:01:17 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 09:01:27 +0000] info [cpaneld] 185.213.83.243 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 09:00:36 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 09:00:43 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
country_id: 1814991
description:
Jun 10 09:01:11 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 10 09:00:38 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Jun 10 09:00:40 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 10 09:00:39 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
country_id: 1835841
description:
Jun 10 09:00:37 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:09:02:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961431&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F15-ans-cmda-concert-chantre-dodo-brigitte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082146 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/15-ans-cmda-concert-chantre-dodo-brigitte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.241.146
country_id: 3658394
description:
[2026-06-10 09:02:31 +0000] info [whostmgrd] 181.78.241.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 13.204.2.226
country_id: 1269750
domain: 127.0.0.1
description:
IM360 WAF: Special shell symbol in request||MV:encodeURIComponent(String(res)||MVN:ARGS:0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:09:01:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9920917&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082114 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.134.43
country_id: 3865483
description:
[2026-06-10 09:03:26 +0000] info [whostmgrd] 98.97.134.43 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.150.244
country_id: 690791
description:
Jun 10 09:02:52 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.150.244 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [10/Jun/2026:09:03:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117481&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082236 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [10/Jun/2026:09:04:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448282&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082239 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.101.157.121
country_id: 2921044
description:
191.101.157.121 - - [10/Jun/2026:09:04:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841753&pdata=http%253A%252F%252Fwww.la-snb-togo.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082245 HTTP/1.1" 302 0 www.la-snb-togo.snb.tg "http://www.la-snb-togo.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.101.157.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:09:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081242&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082349 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 09:06:15 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:09:05:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985110&pdata=https%253A%252F%252Ftdn.tg%252Ftabaski-2023-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082357 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tabaski-2023-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 115.98.234.69
country_id: 1269750
domain: sproca.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:73244.sproca.tg||ServerName:sproca.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c5990b1768fbff931b911569527e7da3b5fb53c||Title:2kolue842xaagf8j||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.95.253.243
country_id: 3469034
domain: www.clinique-ccl.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:udxjqqmt||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.191.185.185
country_id: 1694008
description:
[2026-06-10 09:06:40 +0000] info [whostmgrd] 180.191.185.185 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 09:07:06 +0000] info [cpaneld] 185.213.83.243 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 10 09:06:49 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.106
country_id: 2363686
description:
2026-06-10 09:06:53 dovecot_login authenticator failed for H=(DESKTOP443LMB4) [160.242.192.106]:42253: 535 Incorrect authentication data (set_id=y.aglebe@cfmi.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.209.217.34
country_id: 2287781
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:102.209.217.34||TA:102.209.217.34||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:09:07:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106147&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082440 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [10/Jun/2026:09:07:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237530&pdata=http%253A%252F%252Fxqr2qh.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082424 HTTP/1.1" 302 0 xqr2qh.mediatopnews.tg "http://xqr2qh.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.106
country_id: 2363686
description:
2026-06-10 09:07:49 dovecot_login authenticator failed for H=(DESKTOP443LMB4) [160.242.192.106]:42257: 535 Incorrect authentication data (set_id=y.aglebe@cfmi.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.250.148.73
country_id: 3932488
description:
[2026-06-10 09:07:57 +0000] info [whostmgrd] 38.250.148.73 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.196.53.5
country_id: 458258
description:
196.196.53.5 - - [10/Jun/2026:09:09:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300718&pdata=https%253A%252F%252Fwww.la-snb-togo.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082556 HTTP/2.0" 302 0 www.la-snb-togo.snb.tg "https://www.la-snb-togo.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.196.53.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.106
country_id: 2363686
description:
2026-06-10 09:08:37 dovecot_login authenticator failed for H=(DESKTOP443LMB4) [160.242.192.106]:42265: 535 Incorrect authentication data (set_id=y.aglebe@cfmi.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 160.242.192.106
country_id: 2363686
description:
2026-06-10 09:08:41 dovecot_login authenticator failed for H=(DESKTOP443LMB4) [160.242.192.106]:42266: 535 Incorrect authentication data (set_id=y.aglebe@cfmi.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.53.107.25
country_id: 1605651
description:
[2026-06-10 09:09:01 +0000] info [whostmgrd] 182.53.107.25 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 09:09:42 +0000] info [webmaild] 196.171.46.177 - vincent.sodjehoun@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:09:11:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144933&pdata=https%253A%252F%252Ftogodailynews.tg%252Fuemoa-une-activite-economique-vigoureuse-avec-une-croissance-estimee-a-53-au-deuxieme-trimestre-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082691 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/uemoa-une-activite-economique-vigoureuse-avec-une-croissance-estimee-a-53-au-deuxieme-trimestre-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.181.122.46
country_id: 3895114
description:
45.181.122.46 - - [10/Jun/2026:09:12:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103337&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-banque-mondiale-en-journee-porte-ouverte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781082728 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-banque-mondiale-en-journee-porte-ouverte/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9928.1151 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.181.122.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 10 09:14:24 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 10 09:14:41 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.125.158
country_id: 6252001
description:
[2026-06-10 09:15:32 +0000] info [cpaneld] 82.40.125.158 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.249.31.78
country_id: 3895114
description:
[2026-06-10 09:16:17 +0000] info [whostmgrd] 167.249.31.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.156.183.37
country_id: 3469034
description:
[2026-06-10 09:16:31 +0000] info [whostmgrd] 177.156.183.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:09:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12951237&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-projet-ephyto-ferme-ses-portes-que-retenir-des-acquis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083017 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-projet-ephyto-ferme-ses-portes-que-retenir-des-acquis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.149.25
country_id: 2921044
description:
Jun 10 09:17:19 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.149.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.248.130
country_id: 2658434
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_ba4cc2135d79faefe28d070ad9d25a43.css?ver=3.3.79 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.27.68.213
country_id: 2017370
description:
[2026-06-10 09:19:13 +0000] info [whostmgrd] 95.27.68.213 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.188
country_id: 1512440
description:
2026-06-10 09:19:51 H=([213.230.92.188]) [213.230.92.188]:20988 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.232.254
country_id: 3865483
description:
[2026-06-10 09:19:39 +0000] info [whostmgrd] 38.44.232.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:09:19:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277338&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpiraterie-maritime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083185 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/piraterie-maritime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 09:20:38 +0000] info [cpaneld] 102.54.238.57 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.157.232.236
country_id: 3686110
description:
[2026-06-10 09:21:10 +0000] info [whostmgrd] 204.157.232.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:09:20:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185579&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083236 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.107.144.141
country_id: 6251999
description:
2026-06-10 09:22:30 dovecot_login authenticator failed for H=(ADMIN) [130.107.144.141]:51702: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.97.170.204
country_id: 2542007
description:
[2026-06-10 09:21:44 +0000] info [whostmgrd] 102.97.170.204 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.124.142
country_id: 1880251
description:
43.163.124.142 - - [10/Jun/2026:09:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383974&pdata=https%253A%252F%252Flaunetogo.tg%252Fconcertation-etat-secteur-prive-victoire-tomegah-dogbe-lance-une-invitation-pour-permettre-au-tpme-de-participer-pleinement-a-la-transformation-economique-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083402 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/concertation-etat-secteur-prive-victoire-tomegah-dogbe-lance-une-invitation-pour-permettre-au-tpme-de-participer-pleinement-a-la-transformation-economique-du-togo/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.124.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:09:24:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011243&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F15-ans-cmda-concert-chantre-dodo-brigitte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083474 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/15-ans-cmda-concert-chantre-dodo-brigitte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.58
country_id: 1880251
description:
47.128.121.58 - - [10/Jun/2026:09:23:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710421&pdata=https%253A%252F%252Ftogodailynews.tg%252Feco-ccp-un-portemonnaie-bancaire-tres-utile-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083422 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/eco-ccp-un-portemonnaie-bancaire-tres-utile-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [10/Jun/2026:09:24:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867602&pdata=https%253A%252F%252Ftogodailynews.tg%252F4eme-edition-du-salon-ferrin-lassociation-terreau-fertile-lance-levenement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781083492 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/4eme-edition-du-salon-ferrin-lassociation-terreau-fertile-lance-levenement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.141.113.108
country_id: 3469034
description:
[2026-06-10 09:25:17 +0000] info [whostmgrd] 192.141.113.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


