# incident

plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 27.115.124.6
country_id: 1814991
description:
27.115.124.6 - - [09/Jun/2026:09:33:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246490&pdata=http%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997578 HTTP/1.1" 404 561 togomedia24.tg "http://togomedia24.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:09:33:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118755&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagba-adzowa-annita-jfl-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997585 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agba-adzowa-annita-jfl-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [09/Jun/2026:09:32:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367268&pdata=http%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997568 HTTP/1.1" 302 0 afriquerevelation.tg "http://afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [09/Jun/2026:09:32:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13148008&pdata=https%253A%252F%252Ftogomedia24.tg%252F2025%252F10%252F02%252Ftogo-pourquoi-laugmentation-du-prix-de-la-biere-passe-presque-inapercue%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997576 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2025/10/02/togo-pourquoi-laugmentation-du-prix-de-la-biere-passe-presque-inapercue/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jun  9 09:33:35 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.152.121.4
country_id: 2921044
description:
2026-06-09 09:34:22 dovecot_plain authenticator failed for H=ip-088-152-121-004.um26.pools.vodafone-ip.de (localhost) [88.152.121.4]:40029: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.143.14
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">au togo, le minist\xc3\xa8re de la fonction publique, du travail et du dialogue social a annonc\xc3\xa9 le lundi 8 juin 2026, l\xe2\x80\x99ouverture d\xe2\x80\x99un concours interne et externe d\xe2\x80\x99entr\xc3\xa9e <strong>\xc3\xa0 l\xe2\x80\x99\xc3\x89cole nationale d\xe2\x80\x99administration (ena) pour les cycles ii et iii.</strong></span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">d\xe2\x80\x99apr\xc3\xa8s l\xe2\x80\x99arr\xc3\xaat\xc3\xa9 ce concours vise \xc3\xa0 recruter 110 postes et concerne l<strong>es togolais des deux sexes.</strong></span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">pour les candidats int\xc3\xa9ress\xc3\xa9s par ce concours, le d\xc3\xa9p\xc3\xb4t des dossiers sera fera <strong>du lundi 15 juin 2026 \xc3\xa0 partir de 7 h 00 au vendredi 17 juillet 2026 \xc3\xa0 17 heures 00.</strong> les d\xc3\xa9p\xc3\xb4ts se feront \xc3\xa0 l\xe2\x80\x99ena de lom\xc3\xa9 ainsi qu\xe2\x80\x99aux directions r\xc3\xa9gionales du travail et des lois sociales de kara et dapaong.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">par ailleurs pour les d\xc3\xa9tails compl\xc3\xa9mentaires sur les modalit\xc3\xa9s compl\xc3\xa8tes, les candidats sont invit\xc3\xa9s \xc3\xa0 consulter le quotidien national togo presse ou le site officiel du minist\xc3\xa8re : <a href=\"http://www.fonctionpublique.gouv.tg\">www.fonctionpublique.gouv.tg</a></span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">vous pouvez \xc3\xa9galement t\xc3\xa9l\xc3\xa9charger le communiqu\xc3\xa9 int\xc3\xa9gral via ce lien sur <a href=\"http://www.togomedia24.tg\">www.togomedia24.tg</a> <a href=\"http://togomedia24.tg/wp-content/uploads/2026/06/communique-et-arrete-douverture-dun-concours-dentree-a-lena-2026.pdf\">communiqu\xc3\xa9 et arr\xc3\xaat\xc3\xa9 d'ouverture d'un concours d'entr\xc3\xa9e \xc3\xa0 l'ena 2026</a></span>||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.173.101.138
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/15.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [09/Jun/2026:09:35:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985878&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997713 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:09:36:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723478&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-tax-laws%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-tax-laws/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-09 09:36:25 +0000] info [cpaneld] 107.174.169.229 NEW nerohostfreenetm:RcFUsnYfiJl1EgFU address=107.174.169.229,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.130
country_id: 2921044
description:
[2026-06-09 09:36:25 +0000] info [cpaneld] 5.175.229.130 NEW ecukpqcm:lQVLZsVoWZ38gD9R address=5.175.229.130,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.190
country_id: 3017382
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.992285304584025.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:09:37:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171184&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997858 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:09:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384024&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997865 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:09:37:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13329772&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-astrazeneca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997872 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-astrazeneca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [09/Jun/2026:09:38:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051881&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997883 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:09:38:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262940&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997890 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [09/Jun/2026:09:39:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142620&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagba-adzowa-annita-jfl-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997946 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agba-adzowa-annita-jfl-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.98
country_id: 6252001
description:
[2026-06-09 09:38:40 +0000] info [whostmgrd] 95.164.195.98 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:09:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250693&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsaison-8-de-game-of-thrones%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780997928 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/saison-8-de-game-of-thrones/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 09:39:20 +0000] info [cpaneld] 102.54.238.57 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun  9 09:40:42 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [09/Jun/2026:09:40:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134444&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998042 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:09:40:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804187&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkickboxing%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998049 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kickboxing/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:09:40:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12804804&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-hm-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998015 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-hm-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:09:40:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327963&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsaison-8-de-game-of-thrones%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998035 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/saison-8-de-game-of-thrones/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.225.28
country_id: 1269750
description:
Jun  9 09:41:31 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.225.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.41.116
country_id: 3017382
description:
2026-06-09 09:42:26 dovecot_login authenticator failed for H=ip116.ip-51-75-41.eu (51.75.41.116) [51.75.41.116]:16042: 535 Incorrect authentication data (set_id=pfcgolfe4@arcop.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:09:42:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647191&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnunya-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998160 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nunya-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun  9 09:42:47 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun  9 09:42:13 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 45.3.39.244
country_id: 6252001
domain: dany2.mairie.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:password123.dany2.mairie.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.85
country_id: 1819730
description:
2026-06-09 09:44:10 dovecot_login authenticator failed for H=(223-197-196-85.static.imsbiz.com) [223.197.196.85]:51755: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.85
country_id: 1819730
description:
Jun  9 09:44:08 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[slides]||MV:{\"slide\":{\"addOns\":{},\"id\":1,\"version\":\"7.0.0\",\"title\":\"\",\"parentId\":null,\"language\":\"default\",\"order\":1,\"thumb\":{\"src\":\"\",\"srcId\":\"\",\"admin\":\"\",\"adminId\":\"\",\"dimension\":\"slider\",\"default\":{\"image\":{\"src\":\"https://camilliens.tg/wp-content/uploads/2026/06/Banniere1.jpg.jpeg\",\"repeat\":\"\",\"size\":\"cover\",\"pos\":{\"x\":\"50%\",\"y\":\"50%\"}}}},\"acc\":{\"label\":\"unset\",\"hidden\":\"true\",\"live\":\"auto\",\"role\":\"presentation\",\"roledep\":\"slide\"},\"description\":\"\",\"attr\":{\"class\":\"\",\"data\":\"\",\"id\":\"\",\"a\":\"\",\"aO\":\"ml\",\"t\":\"\",\"tO\":\"\",\"deepLink\":\"\",\"attr\":\"\"},\"publish\":{\"from\":\"\",\"to\":\"\",\"state\":\"published\",\"sch\":true},\"slideshow\":{\"stop\":false,\"len\":\"default\",\"hal\":0,\"hom\":false,\"hfn\":false},\"loop\":{\"u\":false,\"r\":-1,\"s\":0,\"e\":99999}},\"layers\":{\"0\":{\"fluid\":{\"tx\":true,\"tr\":true,\"sp\":true},\"id\":0,\"alias\":\"Text-0\",\"content\":{\"text\":\"Au service des malades \"},\"runtime\":{\"locked\":false,\"hidden\":false},\"size\":{\"w\":[\"#a\",\"auto\",\"auto\",\"auto\",\"auto\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:09:43:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920599&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcooperation-iran-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998198 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cooperation-iran-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Activate Your Wreath Reward bonotdamvam.blogspot.tw rH||Email:khatkarsureander@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-46.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.113
country_id: 2963597
description:
Jun  9 09:47:56 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.24.130
country_id: 933860
description:
Jun  9 09:47:31 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.24.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.106
country_id: 1880251
description:
47.128.122.106 - - [09/Jun/2026:09:48:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855064&pdata=https%253A%252F%252Ftogodailynews.tg%252Fuk-wcaf-iv-le-choix-du-togo-un-symbole-fort-douverture-et-de-leadership-regional%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998503 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/uk-wcaf-iv-le-choix-du-togo-un-symbole-fort-douverture-et-de-leadership-regional/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.106


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.236.243.254
country_id: 1880251
description:
Jun  9 09:48:39 ns5 pure-ftpd[636380]: (?@47.236.243.254) [WARNING] Authentication failed for user [centif]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:09:49:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922713&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrise-energetique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998589 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crise-energetique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:09:49:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842480&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998567 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:09:49:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869937&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-tax-laws%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998582 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-tax-laws/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:09:50:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541319&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998607 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:09:49:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209127&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998560 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:09:49:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247253&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnew-york-echanges-entre-robert-dussey-et-louise-mushikiwabo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998577 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/new-york-echanges-entre-robert-dussey-et-louise-mushikiwabo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[slides]||MV:{\"slide\":{\"addOns\":{},\"id\":2,\"version\":\"7.0.0\",\"title\":\"\",\"parentId\":null,\"language\":\"default\",\"order\":2,\"thumb\":{\"src\":\"\",\"srcId\":\"\",\"admin\":\"\",\"adminId\":\"\",\"dimension\":\"slider\",\"default\":{\"image\":{\"src\":\"https://camilliens.tg/wp-content/uploads/2026/06/2.webp\",\"repeat\":\"\",\"size\":\"cover\",\"pos\":{\"x\":\"50%\",\"y\":\"50%\"}}}},\"acc\":{\"label\":\"unset\",\"hidden\":\"true\",\"live\":\"auto\",\"role\":\"presentation\",\"roledep\":\"slide\"},\"description\":\"\",\"attr\":{\"class\":\"\",\"data\":\"\",\"id\":\"\",\"a\":\"\",\"aO\":\"ml\",\"t\":\"\",\"tO\":\"\",\"deepLink\":\"\",\"attr\":\"\"},\"publish\":{\"from\":\"\",\"to\":\"\",\"state\":\"published\",\"sch\":true},\"slideshow\":{\"stop\":false,\"len\":\"default\",\"hal\":0,\"hom\":false,\"hfn\":false},\"loop\":{\"u\":false,\"r\":-1,\"s\":0,\"e\":99999}},\"layers\":{\"3\":{\"fluid\":{\"tx\":true,\"tr\":true,\"sp\":true},\"id\":3,\"alias\":\"Text-3\",\"content\":{\"text\":\"Servir le malade par amour pour Dieu\"},\"runtime\":{\"locked\":false,\"hidden\":false},\"size\":{\"w\":[\"731px\",\"731px\",\"#a\",\"#a\",\"#a\


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.188.97
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:191.101.188.97||TA:191.101.188.97||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.244.249.178
country_id: 1831722
description:
103.244.249.178 - - [09/Jun/2026:09:51:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068950&pdata=http%253A%252F%252Fabttogo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998700 HTTP/1.1" 302 0 abttogo.com "http://abttogo.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.244.249.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:09:51:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327242&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998715 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-09 09:52:08 +0000] info [cpaneld] 5.230.153.254 NEW sadis:vP_iupoWmDoczLCU address=5.230.153.254,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:09:51:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395796&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998678 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 09:52:14 +0000] info [cpaneld] 103.210.132.14 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:09:53:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881195&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjoanna-agudetse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998780 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/joanna-agudetse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:09:54:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931047&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjoanna-agudetse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998843 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/joanna-agudetse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:09:53:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855318&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.154.201.91
country_id: 99237
description:
[2026-06-09 09:54:13 +0000] info [cpaneld] 204.154.201.91 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:09:54:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527642&pdata=https%253A%252F%252Ftogodailynews.tg%252Freformes-socioeconomiques-le-togo-passe-a-la-vitesse-superieure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998872 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/reformes-socioeconomiques-le-togo-passe-a-la-vitesse-superieure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:09:54:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092254&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998874 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.133.230
country_id: 3469034
description:
Jun  9 09:56:11 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.133.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [09/Jun/2026:09:56:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932835&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepe-ekpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780998975 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epe-ekpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:09:57:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605156&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepe-ekpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999046 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epe-ekpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.207.165.43
country_id: 2363686
description:
[2026-06-09 09:58:21 +0000] info [cpaneld] 41.207.165.43 NEW ezowcpdc:8sld6nqqT42EV6sV address=41.207.165.43,app=cpaneld,creator=ezowcpdc,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:09:59:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804953&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feconomic-freedom-fighters%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999167 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/economic-freedom-fighters/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.184.110
country_id: 732800
description:
Jun  9 09:59:15 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.184.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:09:59:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855365&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999186 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:09:59:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248027&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999173 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:10:00:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7510685&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frose-christiane-ossouka-raponda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999205 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rose-christiane-ossouka-raponda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:10:00:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106706&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999244 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:10:00:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062677&pdata=http%253A%252F%252Ftogodailynews.tg%252Fpromotion-des-energies-renouvelables-le-togo-joue-sa-partition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999238 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/promotion-des-energies-renouvelables-le-togo-joue-sa-partition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [09/Jun/2026:10:00:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804182&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999225 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:10:03:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921939&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999426 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:10:03:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066839&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999419 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:10:03:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724974&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrise-energetique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999438 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crise-energetique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:10:04:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936291&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999484 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.107.225
country_id: 2395170
description:
2026-06-09 10:05:03 H=([137.255.107.225]) [137.255.107.225]:54197 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.198
country_id: 1880251
description:
47.128.119.198 - - [09/Jun/2026:10:04:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251623&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D11445&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999473 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=11445" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.198


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.121
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:142.111.93.121||TA:142.111.93.121||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:10:05:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184392&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999549 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-06-09 10:05:32 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:11262: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:10:06:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070696&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999575 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.104.214
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:191.96.104.214||TA:191.96.104.214||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-09 10:06:17 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "GET /cpsess6657688824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-09 10:07:52 H=([77.83.39.169]) [77.83.39.169]:57258 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:10:08:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867926&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999680 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:10:07:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6865769&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999647 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.65.217.149
country_id: 2542007
description:
2026-06-09 10:08:29 dovecot_plain authenticator failed for H=(s9h7v2bvso4ke7pfttsaemcdkc07mmd0) [196.65.217.149]:49245: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 10:08:13 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [09/Jun/2026:10:09:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787685&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999795 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:10:09:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077592&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999750 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [09/Jun/2026:10:11:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080940&pdata=https%253A%252F%252Ftdn.tg%252Fmega-le-kedeeee-recuperer-data-expire-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999917 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mega-le-kedeeee-recuperer-data-expire-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:10-12.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 10:12:06 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Seize Your Enormous Prize sepoladi.blogspot.pt 2g||Email:Dejohn.brown.db@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 10:12:21 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:10:12:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935258&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frose-christiane-ossouka-raponda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780999957 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rose-christiane-ossouka-raponda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:10:13:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885651&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feconomic-freedom-fighters%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000034 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/economic-freedom-fighters/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:10:14:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396265&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommission-de-luemoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000066 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commission-de-luemoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:10:15:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027479&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-de-jules-tete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000105 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-de-jules-tete/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 10:14:18 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.13.116
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togomedia24.tg/2026/06/09/togo-le-concours-dentree-a-lena-pour-les-cycles-ii-et-iii-ouvert/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:10:14:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660617&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000068 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [09/Jun/2026:10:14:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001322&pdata=https%253A%252F%252Ftogodailynews.tg%252Finclusion-financiere-victoire-tomegah-dogbe-recoit-youssef-ibrahim%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000072 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/inclusion-financiere-victoire-tomegah-dogbe-recoit-youssef-ibrahim/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:10:15:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986850&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000099 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 101.6.30.210
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:10:16:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869972&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000183 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:10:17:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116181&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000248 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:10:17:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724266&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000273 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:10:18:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12752997&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcooperation-iran-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000306 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cooperation-iran-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:19:11 +0000] info [whostmgrd] 54.166.153.72 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID jxr5n2) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:19:27 +0000] info [whostmgrd] 54.166.153.72 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:10:19:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277333&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepe-ekpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000397 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epe-ekpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 166.88.15.187
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Opportunit\xc3\xa9s d\xe2\x80\x99investissement\xc2\xa0: Lom\xc3\xa9 accueille l\xe2\x80\x99Africa executing meeting 2023||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.36.92.79
country_id: 6252001
description:
[2026-06-09 10:21:04 +0000] info [whostmgrd] 138.36.92.79 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:10:21:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016422&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdematerialisation-au-togo-les-effets-se-font-ressentir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000465 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/dematerialisation-au-togo-les-effets-se-font-ressentir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:10:21:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806851&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frose-christiane-ossouka-raponda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000475 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rose-christiane-ossouka-raponda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:10:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274152&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000494 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:10:21:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316904&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommission-de-luemoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000501 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commission-de-luemoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:10:23:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182024&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsaison-3-de-maitresse-dun-homme-marie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000610 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/saison-3-de-maitresse-dun-homme-marie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:10:24:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13331046&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprogramme-de-bourse-mandela-washington-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000662 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/programme-de-bourse-mandela-washington-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:10:24:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999763&pdata=https%253A%252F%252Ftogodailynews.tg%252F3eme-ciesres-pour-une-relance-economique-post-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000687 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/3eme-ciesres-pour-une-relance-economique-post-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:10:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937323&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000758 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.225.134.174
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-55-milliards-fcfa-pour-moderniser-106-km-de-routes-en-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [09/Jun/2026:10:25:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949955&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging-citoyen%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000720 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging-citoyen/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 10:25:47 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jun  9 10:26:08 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.225.134.174
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-55-milliards-fcfa-pour-moderniser-106-km-de-routes-en-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.102.145.148
country_id: 6252001
description:
191.102.145.148 - - [09/Jun/2026:10:25:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132068&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000748 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.102.145.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.145.148
country_id: 6252001
description:
[2026-06-09 10:25:52 +0000] info [whostmgrd] 191.102.145.148 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [09/Jun/2026:10:25:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118742&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000752 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [09/Jun/2026:10:26:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011803&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finseed-recrutement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000778 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inseed-recrutement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:26:44 +0000] info [whostmgrd] 54.166.153.72 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID fs59nx) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.48.69
country_id: 3469034
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-26.104.207.48.69||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:10:26:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312226&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felle-donne-naissance-a-des-quadruples-apres-16-ans-de-mariage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000810 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elle-donne-naissance-a-des-quadruples-apres-16-ans-de-mariage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jun  9 10:26:14 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:10:26:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183464&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000792 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:26:51 +0000] info [whostmgrd] 54.166.153.72 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 10:26:25 +0000] info [cpaneld] 160.242.192.96 - butodra "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user butodra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.106.141.238
country_id: 2963597
description:
2026-06-09 10:27:50 dovecot_login authenticator failed for H=(89.106.141.238) [89.106.141.238]:33251: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:10:27:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987949&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bts-les-frais-dinscription-desormais-gratuits%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000875 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bts-les-frais-dinscription-desormais-gratuits/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.187.39
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2026/06/09/togo-le-concours-dentree-a-lena-pour-les-cycles-ii-et-iii-ouvert/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.68
country_id: 1880251
description:
[2026-06-09 10:28:20 +0000] info [cpaneld] 188.166.248.68 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:10:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974572&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000888 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:10:28:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920552&pdata=https%253A%252F%252Ftdn.tg%252Fmercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000895 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.238.75
country_id: 2542007
description:
2026-06-09 10:29:16 dovecot_plain authenticator failed for H=(1ayfngh5tt7emxun5evdm7fht2uz) [196.75.238.75]:53059: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:10:29:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514839&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000967 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:10:29:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657174&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000949 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:10:29:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301533&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsucre-roux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000951 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sucre-roux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.75.238.75
country_id: 2542007
description:
Jun  9 10:29:14 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.75.238.75 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:10:29:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989230&pdata=https%253A%252F%252Ftdn.tg%252Fmercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000979 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-09 10:30:01 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:43338: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [09/Jun/2026:10:29:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922661&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781000953 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 10:30:24 ns5 pure-ftpd[670481]: (?@146.190.126.213) [WARNING] Authentication failed for user [direct7]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:10:30:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857898&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781001012 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  9 10:30:17 ns5 pure-ftpd[670481]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.32
country_id: 2363686
description:
[2026-06-09 10:31:17 +0000] info [cpaneld] 80.248.70.32 NEW neliam:pMC1PfW_ls60mtNi address=80.248.70.32,app=cpaneld,creator=neliam,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Highest Meeting Point Reward bonotdamvam.blogspot.tw Sy||Email:charliebuzzacott2018@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-09 10:36:21 +0000] info [cpaneld] 5.230.153.167 NEW marketplacenetma:pXLzHr5mbhlOjGZw address=5.230.153.167,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:10-36.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [09/Jun/2026:10:36:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724711&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781001415 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-09 10:37:31 +0000] info [whostmgrd] 157.66.56.227 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID v35f2c) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-09 10:37:35 +0000] info [whostmgrd] 157.66.56.227 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:37:39 +0000] info [whostmgrd] 54.166.153.72 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID kw2f3s) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:37:48 +0000] info [whostmgrd] 54.166.153.72 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.133
country_id: 6252001
description:
[2026-06-09 10:38:38 +0000] info [cpaneld] 172.111.157.133 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 38.133.213.175
country_id: 2750405
description:
Jun  9 10:38:15 ns5 pure-ftpd[678516]: (?@38.133.213.175) [WARNING] Authentication failed for user [GKAIU5ctJr]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.133
country_id: 6252001
description:
[2026-06-09 10:40:08 +0000] info [cpaneld] 172.111.157.133 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.133
country_id: 6252001
description:
[2026-06-09 10:40:30 +0000] info [cpaneld] 172.111.157.133 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [09/Jun/2026:10:40:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12895855&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781001610 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.149.90
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/inscription/ucaoinscription/vendor/symfony/translation/Resources/schemas/xliff-core-2.0.xsd||User:ucaouut||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.113.238.202
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:194.113.238.202||TA:194.113.238.202||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:10:42:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525297&pdata=https%253A%252F%252Ftdn.tg%252Ftogocom-celebre-4-ans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781001732 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togocom-celebre-4-ans/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.81.244.171
country_id: 6252001
domain: www.apisolde.chuso.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-06-09 10:44:39 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:Elh9xNBdIOlj2TpI address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.68
country_id: 1880251
description:
[2026-06-09 10:44:27 +0000] info [cpaneld] 188.166.248.68 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cfpj@cfpj.tg [06/09/2026:10:45:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cfpj@cfpj.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.49.44
country_id: 3469034
description:
Jun  9 10:45:35 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.49.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:10:46:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933415&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-heidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002012 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:10:47:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538096&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002025 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [09/Jun/2026:10:47:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842011&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002058 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:10:47:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263959&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002056 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [09/Jun/2026:10:47:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065306&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002077 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [09/Jun/2026:10:49:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738853&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyl-consult-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002142 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syl-consult-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:10:48:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180998&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002093 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.201.255.243
country_id: 1668284
domain: sp-eau.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.backup||User:doufelg||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:10:50:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514630&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002202 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:10:50:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806761&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002253 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:10:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935255&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002226 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:10:51:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607316&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002260 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:10:51:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13082520&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002299 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.107.0.32
country_id: 3017382
description:
212.107.0.32 - - [09/Jun/2026:10:51:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131299&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fstructure-specialisee-dans-le-service-a-la-personne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002305 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/structure-specialisee-dans-le-service-a-la-personne/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9805.1668 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.107.0.32


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:10:52:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591891&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002357 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:10:53:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987221&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002384 HTTP/1.1" 404 561 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [09/Jun/2026:10:53:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062428&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002431 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [09/Jun/2026:10:54:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185624&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fauguste-dogbo-navitrans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002460 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/auguste-dogbo-navitrans/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:10:54:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7172461&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002473 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 10:54:45 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:4994: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.127.50.2
country_id: 1522867
description:
2026-06-09 10:54:32 H=([188.127.50.2]) [188.127.50.2]:60079 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:10:55:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116143&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprogramme-de-bourse-mandela-washington-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002527 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/programme-de-bourse-mandela-washington-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 10:55:33 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:10:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749959&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouvelles-nominations-au-ministere-du-commerce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002539 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouvelles-nominations-au-ministere-du-commerce/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:10:55:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fauguste-dogbo-navitrans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002553 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/auguste-dogbo-navitrans/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:10:56:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792406&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Favant-le-premier-cri%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002604 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/avant-le-premier-cri/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 10:56:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:9728: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.72
country_id: 2363686
description:
2026-06-09 10:56:29 dovecot_plain authenticator failed for H=(CanonD1D677.CFMI.com) [160.242.192.72]:54003: 535 Incorrect authentication data (set_id=cfmiscan@cfmi.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:10:56:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053786&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002597 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 10:57:39 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:21504: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.210
country_id: 3469034
description:
Jun  9 10:57:55 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.210 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:10:57:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7303620&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002635 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/environnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:10:58:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685607&pdata=https%253A%252F%252Ftogodailynews.tg%252Fe-commerce-renforcement-des-competences-des-dirigeants-des-pme-pmi-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002681 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/e-commerce-renforcement-des-competences-des-dirigeants-des-pme-pmi-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.210
country_id: 3469034
description:
Jun  9 10:58:10 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.119.94.8
country_id: 6252001
domain: www.test.mesyscom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/jmtctoni/public_html/test/public/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 10:58:35 +0000] info [cpaneld] 103.210.132.14 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 10:59:01 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2176: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 10:59:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2562: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 10:59:22 +0000] info [whostmgrd] 80.248.64.198 NEW zxtqbmmj:91I_YAAMUBqMBEvt address=80.248.64.198,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 10:59:23 +0000] info [cpaneld] 80.248.64.198 NEW zxtqbmmj:SDRlcb3jdsie3Foy address=80.248.64.198,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=loadsession:zxtqbmmj:91I_YAAMUBqMBEvt,possessed=1,possessor=root


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.127.50.2
country_id: 1522867
description:
2026-06-09 11:00:35 H=([188.127.50.2]) [188.127.50.2]:49213 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.138.151.171
country_id: 1819730
description:
159.138.151.171 - - [09/Jun/2026:11:01:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722199&pdata=https%253A%252F%252Flaunetogo.tg%252Fcategory%252Fpolitique%252Fpage%252F9%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002864 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/category/politique/page/9/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.138.151.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:11:00:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132077&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpiraterie-maritime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002822 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/piraterie-maritime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 11:01:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:22143: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:11:01:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6409154&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F1ere-femme-chuteur-de-larmee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002909 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/1ere-femme-chuteur-de-larmee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 11:02:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:22170: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.103.53.194
country_id: 6252001
description:
146.103.53.194 - - [09/Jun/2026:11:02:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448230&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002943 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.103.53.194


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.103.53.194
country_id: 6252001
description:
[2026-06-09 11:02:28 +0000] info [whostmgrd] 146.103.53.194 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:11:02:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012006&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781002961 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 11:03:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2600: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 11:04:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2601: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 11:05:16 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2607: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:11:06:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446743&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003190 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:11:06:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054295&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finseed-recrutement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003196 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inseed-recrutement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:11:07:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039332&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003222 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:11:07:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003274 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:11:08:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659799&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:11:08:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197100&pdata=https%253A%252F%252Ftdn.tg%252Freseau-voleurs-telephones-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003313 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/reseau-voleurs-telephones-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - simtaya@cfpj.tg [06/09/2026:11:09:57 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: simtaya@cfpj.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:11:09:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592364&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003357 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:11:09:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933978&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ficc-be-kpota%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003373 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/icc-be-kpota/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:11:09:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855071&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-heidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003385 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 11:10:02 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2627: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:11:10:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999973&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-de-tivaoune-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003405 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-de-tivaoune-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:11:09:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738951&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-prison-ferme-homos3xuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003353 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-prison-ferme-homos3xuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [09/Jun/2026:11:10:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340712&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpiraterie-maritime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003398 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/piraterie-maritime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [09/Jun/2026:11:10:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104968&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F1ere-femme-chuteur-de-larmee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003412 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/1ere-femme-chuteur-de-larmee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:11:10:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997606&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003457 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:11:12:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671791&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagicien-des-porte-monnaies-magiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003522 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magicien-des-porte-monnaies-magiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [09/Jun/2026:11:11:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934280&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffinale-de-la-coupe-du-monde-fifa-qatar-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003476 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/finale-de-la-coupe-du-monde-fifa-qatar-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.187.178.226
country_id: 1819730
description:
Jun  9 11:11:33 ns5 pure-ftpd[706982]: (?@194.187.178.226) [INFO] New connection from 194.187.178.226


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:11:11:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871574&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-des-concours-de-recrutement-a-lotr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003496 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-des-concours-de-recrutement-a-lotr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 11:12:17 +0000] info [cpaneld] 102.54.238.57 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 163.227.255.253
country_id: 1149361
description:
2026-06-09 11:12:38 H=([163.227.255.253]) [163.227.255.253]:59327 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 11:14:19 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56564: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-09 11:14:22 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-09 11:14:44 +0000] info [cpaneld] 5.231.64.168 NEW frtwilql:KQe8N597coGH5MB_ address=5.231.64.168,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-09 11:15:14 +0000] info [webmaild] 102.176.253.226 - scolarite@ucao-uut.tg "GET /cpsess0449805113/3rdparty/roundcube/?_task=mail&_frame=1&_mbox=INBOX&_uid=4517&_part=3&_action=get&_extwin=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.173
country_id: 3469034
description:
Jun  9 11:16:29 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.173 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:11:17:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170708&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-westlab24%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781003862 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-westlab24/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 163.227.255.253
country_id: 1149361
description:
2026-06-09 11:17:26 H=([163.227.255.253]) [163.227.255.253]:64226 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 11:19:31 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-09 11:19:54 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.247.213.2
country_id: 1522867
description:
2026-06-09 11:20:51 H=([188.247.213.2]) [188.247.213.2]:61832 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.53
country_id: 3865483
description:
Jun  9 11:21:52 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.187.178.121
country_id: 1819730
description:
Jun  9 11:23:00 ns5 pure-ftpd[715898]: (?@194.187.178.121) [INFO] New connection from 194.187.178.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.152
country_id: 6290252
description:
Jun  9 11:22:11 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.152 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:11:24:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657731&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781004268 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:11:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854811&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-heidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781004298 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 11:25:05 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [09/Jun/2026:11:25:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793437&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging-citoyen%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781004317 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging-citoyen/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 11:27:58 +0000] info [cpaneld] 160.242.192.96 NEW vefzejhd:I3ZLJH7muOMY1BVs address=160.242.192.96,app=cpaneld,creator=vefzejhd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.180.78.168
country_id: 1861060
domain: www.portailbj.mesyscom.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/src/.env.production||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.180.78.168
country_id: 1861060
domain: www.portailbj.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/api/.env.backup||User:jmtctoni||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.229
country_id: 3865483
description:
Jun  9 11:33:12 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 5.231.64.159
country_id: 3017382
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Hidden file access||RSV:8.15||T:APACHE||QS:to=bobilopaol@universitasnasional506.onmicrosoft.com||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.159
country_id: 3017382
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.403040315410698.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.75.143.200
country_id: 2542007
description:
Jun  9 11:34:28 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.75.143.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.155
country_id: 6252001
description:
[2026-06-09 11:34:30 +0000] info [cpaneld] 45.58.50.155 NEW aopsacai:Oeh1wmkTlLk9s_TC address=45.58.50.155,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.65.231.130
country_id: 2542007
description:
2026-06-09 11:34:33 dovecot_plain authenticator failed for H=(7vp6kgp9gg06nqkz) [196.65.231.130]:48147: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-09 11:34:47 +0000] info [cpaneld] 5.230.153.114 NEW mgvybwur:MjAp3_JQfFjlAZSE address=5.230.153.114,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.143.200
country_id: 2542007
description:
2026-06-09 11:34:30 dovecot_plain authenticator failed for H=(c8dbmnm8smo1hq09zoabvo5o) [196.75.143.200]:34469: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-09 11:34:50 +0000] info [cpaneld] 5.230.153.154 NEW pjwfvzan:2qHpHKxFO9yYIdRK address=5.230.153.154,app=cpaneld,creator=pjwfvzan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-09 11:34:30 +0000] info [cpaneld] 5.230.133.158 NEW doufelg:IBZmbfVidZwmt8Oi address=5.230.133.158,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 11:35:24 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55052: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 11:36:59 +0000] info [cpaneld] 37.114.148.247 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [09/Jun/2026:11:37:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987209&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-jeunesse-preparee-aux-metiers-de-demain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005048 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-jeunesse-preparee-aux-metiers-de-demain/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 11:37:59 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:11:38:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6407791&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Favant-le-premier-cri%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005097 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/avant-le-premier-cri/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [09/Jun/2026:11:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12819051&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005207 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:11:41:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853225&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005264 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:11:41:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237064&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005311 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 11:42:56 +0000] info [cpaneld] 37.114.148.247 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: cl_dos
name: DOS detection
abuser: 34.22.139.93
country_id: 2802361
description:
2026-06-09 11:44:51.635665095 +0000 GMT m=+22781.313272625 Denial of Service attack was discovered from 34.22.139.93, on port 443. Open connections: 276


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 11:44:50 +0000] info [cpaneld] 103.65.237.227 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:11:45:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275479&pdata=https%253A%252F%252Ftdn.tg%252Fboad-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005502 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/boad-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:11:44:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12753557&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005457 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: cl_dos
name: DOS detection
abuser: 34.22.139.93
country_id: 2802361
description:
2026-06-09 11:45:21.989580958 +0000 GMT m=+22811.667188388 Denial of Service attack was discovered from 34.22.139.93, on port 443. Open connections: 276


plugin: cl_dos
name: DOS detection
abuser: 34.22.139.93
country_id: 2802361
description:
2026-06-09 11:46:22.728971315 +0000 GMT m=+22872.406578845 Denial of Service attack was discovered from 34.22.139.93, on port 443. Open connections: 276


plugin: cl_dos
name: DOS detection
abuser: 34.22.139.93
country_id: 2802361
description:
2026-06-09 11:47:23.453413378 +0000 GMT m=+22933.131020908 Denial of Service attack was discovered from 34.22.139.93, on port 443. Open connections: 276


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:11:48:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117762&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005696 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: cl_dos
name: DOS detection
abuser: 34.22.139.93
country_id: 2802361
description:
2026-06-09 11:48:24.145755694 +0000 GMT m=+22993.823363224 Denial of Service attack was discovered from 34.22.139.93, on port 443. Open connections: 276


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.0.232.67
country_id: 6252001
description:
2026-06-09 11:48:35 dovecot_login authenticator failed for H=(azma.gold) [162.0.232.67]:59350: 535 Incorrect authentication data (set_id=e.sanvee@lacs1.mairie.tg)


plugin: cl_dos
name: DOS detection
abuser: 34.22.139.93
country_id: 2802361
description:
2026-06-09 11:49:24.902604711 +0000 GMT m=+23054.580212241 Denial of Service attack was discovered from 34.22.139.93, on port 443. Open connections: 276


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 11:49:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:41328: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.75.83.1
country_id: 2921044
domain: lepoint-actu.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lepoint-actu.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.244.249.178
country_id: 1831722
description:
103.244.249.178 - - [09/Jun/2026:11:52:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263445&pdata=http%253A%252F%252Fabttogo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781005926 HTTP/1.1" 302 0 abttogo.com "http://abttogo.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.244.249.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-09 11:52:59 dovecot_login authenticator failed for H=([142.54.239.4]) [27.71.21.70]:17576: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:11:55:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394011&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006102 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 11:54:31 +0000] info [webmaild] 160.242.195.10 - kfandonougbo@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.36.157.186
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/uemoa-reprise-du-cadre-structure-de-concertation-bancaire/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.36.157.186
country_id: 6252001
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/uemoa-reprise-du-cadre-structure-de-concertation-bancaire/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:11:55:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131050&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006142 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:11:55:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788760&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouvelles-nominations-au-ministere-du-commerce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006149 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouvelles-nominations-au-ministere-du-commerce/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:11:55:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300251&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmecanicien-voleur-a-adeticope%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006109 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mecanicien-voleur-a-adeticope/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:11:55:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934443&pdata=https%253A%252F%252Ftdn.tg%252Fcovid-19-au-togo-voici-la-liste-des-eglises-baptistes-qui-vont-rouvrir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006128 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/covid-19-au-togo-voici-la-liste-des-eglises-baptistes-qui-vont-rouvrir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:11:56:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658927&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006179 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:11:56:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722668&pdata=https%253A%252F%252Ftdn.tg%252Fboad-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006193 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/boad-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [09/Jun/2026:11:56:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460102&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-julie-ou-lhistoire-de-la-jeune-eleve-officier-medecin-de-19-ans-dont-le-deces-au-parachutisme-attriste-les-coeurs-voici-ce-qui-sest-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006172 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-julie-ou-lhistoire-de-la-jeune-eleve-officier-medecin-de-19-ans-dont-le-deces-au-parachutisme-attriste-les-coeurs-voici-ce-qui-sest-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 11:56:14 +0000] info [webmaild] 160.242.195.10 - kfandonougbo@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:11:56:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661077&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006211 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [09/Jun/2026:11:57:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10470759&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-1000-jeunes-pour-la-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006225 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-1000-jeunes-pour-la-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:11:57:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117715&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpratique-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006243 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pratique-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.60.134
country_id: 1210997
domain: www.ave2.mairie.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ave2.mairie.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:11:57:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868132&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flundi-3-mai-2021-ferie-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006276 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lundi-3-mai-2021-ferie-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.130.213
country_id: 2542007
description:
2026-06-09 11:58:43 dovecot_plain authenticator failed for H=(9p51v4fvjgp8xxaesdijtwa37src0c5) [196.75.130.213]:37687: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-09 11:59:20 +0000] info [cpaneld] 103.164.183.114 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jun  9 12:00:41 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.68.171.251
country_id: 3017382
domain: cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-09 12:05:55 +0000] info [cpaneld] 154.70.80.74 - cloudetracks "GET /cpsess4200179524/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-09 12:05:11 +0000] info [webmaild] 196.168.0.186 - a.ajavon@wages.tg "POST /cpsess3785259764/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 12:05:52 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46174: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:12:06:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186391&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781006787 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 12:09:33 +0000] info [cpaneld] 37.114.148.247 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:11:04 dovecot_login authenticator failed for H=server.fusionmail.shop (lhL5pu) [91.92.241.106]:57875: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:12:10:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182540&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007025 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:11:02 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 12:10:24 +0000] info [cpaneld] 102.54.238.57 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:11:28 dovecot_login authenticator failed for H=server.fusionmail.shop (JZOvB556tq) [91.92.241.106]:58205: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:12:11:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974866&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007108 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 12:12:08 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:12:11:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724712&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007076 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:12:11:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443864&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007083 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:11:26 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:12:25 dovecot_login authenticator failed for H=server.fusionmail.shop (uqZ44VOal7) [91.92.241.106]:62508: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:12:12:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001044&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007161 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:12:23 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:12:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711707&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007153 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:13:18 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:13:20 dovecot_login authenticator failed for H=server.fusionmail.shop (pG0U4Iz) [91.92.241.106]:61468: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 12:13:20 +0000] info [cpaneld] 37.114.148.247 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - koudjramey.akua@cloud-et-racks.tg [06/09/2026:12:14:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: koudjramey.akua@cloud-et-racks.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:12:14:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644837&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007250 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:14:16 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:12-14.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:14:18 dovecot_login authenticator failed for H=server.fusionmail.shop (fUwHkH) [91.92.241.106]:60040: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Unexpected Financial Gain eropolik.blogspot.nl Ys||Email:kittykattgirlmason@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.80.22
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.80.22||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:15:23 dovecot_login authenticator failed for H=server.fusionmail.shop (Q2OTOYm) [91.92.241.106]:62239: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 186.179.10.198
country_id: 3996063
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.186.179.10.198||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.90.219
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.90.219||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 186.179.10.87
country_id: 3996063
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.186.179.10.87||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.90.221
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.90.221||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.50.186
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.196.51.50.186||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.50.61
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.196.51.50.61||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:15:21 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.55.241
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.55.241||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.50.197
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.196.51.50.197||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [09/Jun/2026:12:15:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738096&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007322 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.71.61
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.71.61||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.71.43
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.71.43||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.178.62
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.178.62||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.71.36
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.71.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.50.103
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-15.38.154.50.103||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:16:30 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:16:32 dovecot_login authenticator failed for H=server.fusionmail.shop (IpbmBtH) [91.92.241.106]:56280: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:12:17:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842215&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclicks-pharmacy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007432 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clicks-pharmacy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cdf67aa08fce69fd1d1d2578459c6ce1a9a58d38||Title:pt2zt49io3t76jyp||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:17:24 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:17:26 dovecot_login authenticator failed for H=server.fusionmail.shop (Qer6Zns) [91.92.241.106]:56159: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 120.239.113.90
country_id: 1814991
description:
2026-06-09 12:17:57 H=([120.239.113.90]) [120.239.113.90]:21251 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.113.238.207
country_id: 6252001
description:
194.113.238.207 - - [09/Jun/2026:12:18:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144158&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007525 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.113.238.207


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d140afd99edc4b522e215bbeef933800c9c0184||Title:3pts0y30plwhv63||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:18:35 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:18:37 dovecot_login authenticator failed for H=server.fusionmail.shop (ICuwSQMqDR) [91.92.241.106]:59574: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.113.238.207
country_id: 6252001
description:
[2026-06-09 12:18:50 +0000] info [whostmgrd] 194.113.238.207 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:12:19:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392426&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepe-ekpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007579 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epe-ekpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:19:12 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-09 12:19:44 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-09 12:20:06 +0000] info [cpaneld] 5.230.153.219 NEW wgqhqbem:OQgK93xAxyksEE5e address=5.230.153.219,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:19:14 dovecot_login authenticator failed for H=server.fusionmail.shop (57NPxl) [91.92.241.106]:55783: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1fbcc27268271c51f2b46f1424f64d5608706a5||Title:ehm7x8gbis7ri21||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [09/Jun/2026:12:21:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248794&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007663 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5f9031882dc4664a9d2a48659c7bdd99c12934f||Title:24gl3jtospmz1dcmw||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:12:20:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580324&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprix-de-lhuile-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007638 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prix-de-lhuile-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-06-09 12:20:19 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:58845: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:12:20:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973288&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007645 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-avis-a-manifestation-dinteret-de-la-giz-pour-des-prestations/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [09/Jun/2026:12:20:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185414&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclicks-pharmacy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007656 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clicks-pharmacy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ff566dc37125aaf60af89ecff388120fb473d72||Title:88rkwrsgibq0et||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:12:21:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171741&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feconomic-freedom-fighters%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007701 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/economic-freedom-fighters/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: wellcity.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 BytedanceWebview/d8a21c6 trill_31.7.0 JsSdk/2.0 NetType/WIFI Channel/App Store ByteLocale/id Region/ID FalconTag/B01A80E7-4BCD-4660-A50A-8FC7551A9C2F TTP_H5_URLPROTOCOL||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:21:57 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:21:59 dovecot_login authenticator failed for H=server.fusionmail.shop (5hS1SJcFwE) [91.92.241.106]:63030: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a04ee84b813aaa2485713a6349be16fcbff6083a||Title:vi8rxkhu1e91ifw9||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:12:22:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591640&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007741 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:12:22:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870550&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007749 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:22:35 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:22:37 dovecot_login authenticator failed for H=server.fusionmail.shop (OZ8Vjl) [91.92.241.106]:55584: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:23:11 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.37
country_id: 690791
description:
2026-06-09 12:23:17 H=([77.83.39.37]) [77.83.39.37]:63585 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@ucelmakina.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:23:13 dovecot_login authenticator failed for H=server.fusionmail.shop (aIHOd9XTrj) [91.92.241.106]:61568: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6205265603d88e2b490c7da33068ac8f24564067||Title:3y70bemnxfni46o||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-09 12:23:45 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [09/Jun/2026:12:25:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170668&pdata=http%253A%252F%252F154.70.82.249%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007902 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:24:40 dovecot_login authenticator failed for H=server.fusionmail.shop (XKYClM) [91.92.241.106]:63588: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ff7d9dd4cab3ce2c85e29e690b1da9b248d148b||Title:bijdbyyq875tzsyqn8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:24:38 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:060311aadd7ddc435afa0114347d69ff9b6fd5f4||Title:je7khmmx9izh614jqm||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [09/Jun/2026:12:25:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182959&pdata=http%253A%252F%252Fgstock.soena.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007911 HTTP/1.1" 302 0 gstock.soena.tg "http://gstock.soena.tg:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [09/Jun/2026:12:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985067&pdata=http%253A%252F%252Fmail.ns7.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007913 HTTP/1.1" 302 0 mail.ns7.netmaster.tg "http://mail.ns7.netmaster.tg:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 12:27:03 +0000] info [cpaneld] 160.242.195.10 NEW assedderetrm:gIN7HZ__EtGfFmXI address=160.242.195.10,app=cpaneld,creator=assedderetrm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:26:26 dovecot_login authenticator failed for H=server.fusionmail.shop (t74exYB) [91.92.241.106]:58453: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:12:26:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710632&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781007988 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 12:27:00 +0000] info [cpaneld] 160.242.195.10 - assedderetrm "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21d709e465916e18480c46484fe1beabd34ac726||Title:76oayau4zuxia9jg||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:26:24 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e207325955f6b1c6408a7f2f32469d76e9d6bcfa||Title:btnklt0gulrrao1x||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:27:39 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:27:41 dovecot_login authenticator failed for H=server.fusionmail.shop (YlR0aAPkM) [91.92.241.106]:64166: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:976bd8c39f3d402ff6fff78381e41bc5e5a1625e||Title:iju7zz8b0r7u46mrhd||RSV:8.15||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kfandonougbo@caissederetraites.tg [06/09/2026:12:28:38 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kfandonougbo@caissederetraites.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:28:16 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:28:18 dovecot_login authenticator failed for H=server.fusionmail.shop (miIOZJpd) [91.92.241.106]:65391: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:29:31 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f7fb9e59a0e1745a5431f0f7092feaa6fcf9583c||Title:huc8jb4i4hnh5w||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:29:33 dovecot_login authenticator failed for H=server.fusionmail.shop (oPwK78) [91.92.241.106]:56571: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:682d30c62db75f5247f585b924d9d8914fb2f02a||Title:95so1zqu9eqwtu||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 12:30:38 +0000] info [cpaneld] 37.114.148.247 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:30:47 dovecot_login authenticator failed for H=server.fusionmail.shop (2CHWbIiF) [91.92.241.106]:52495: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:30:45 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa709f38d067528b6e0e7d29ed58aae7d1714277||Title:ru6xgv5mx69ld31rk||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:32:13 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:32:15 dovecot_login authenticator failed for H=server.fusionmail.shop (HzxOvnxi) [91.92.241.106]:63361: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.194.1
country_id: 1512440
description:
2026-06-09 12:32:17 H=([198.163.194.1]) [198.163.194.1]:60073 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3c0eb46c452e16a573bdbb97e3b1a1afd358a29||Title:7rhp8umlasb02jbfi||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 12:33:37 +0000] info [cpaneld] 37.114.148.247 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:34:04 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:34:06 dovecot_login authenticator failed for H=server.fusionmail.shop (tXbgGLv) [91.92.241.106]:64133: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:078f2cbc2e7ebab2ad129e6acfda75628efb4698||Title:qjtqs6gny8j8oe||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:70f512d7f6c687c0c7c8b142750abee4869c58f8||Title:e9k7krpkt1ejkgax||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:34:42 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:34:44 dovecot_login authenticator failed for H=server.fusionmail.shop (6DaJGN) [91.92.241.106]:63981: 535 Incorrect authentication data (set_id=esp.togo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-09 12:35:04 +0000] info [cpaneld] 37.114.148.247 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 46.151.182.58
country_id: 2750405
domain: cfpj.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 46.151.182.58
country_id: 2750405
domain: cfpj.tg
description:
IM360 WAF: Block .suspected files||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun  9 12:35:20 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-09 12:35:22 dovecot_login authenticator failed for H=server.fusionmail.shop (j0WQ7MO8q) [91.92.241.106]:57734: 535 Incorrect authentication data (set_id=esp.togo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.254.183.79
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5db6bc88278b90182302d15d0493cab24c04f063||Title:o2vm90bg1uwr73mn||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:12:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263454&pdata=https%253A%252F%252Fzephyr.tg%252Fsport-au-feminin-les-femmes-rondes-en-demonstration-ce-samedi-a-bamako%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781008573 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/sport-au-feminin-les-femmes-rondes-en-demonstration-ce-samedi-a-bamako/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.153
country_id: 1512440
description:
2026-06-09 12:37:40 H=([213.230.93.153]) [213.230.93.153]:7092 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:12:37:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722247&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781008677 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.93
country_id: 690791
description:
Jun  9 12:39:46 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.236.49
country_id: 6252001
description:
[2026-06-09 12:39:19 +0000] info [whostmgrd] 168.196.236.49 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:12-40.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.113.238.232
country_id: 6252001
description:
[2026-06-09 12:40:33 +0000] info [whostmgrd] 194.113.238.232 - cp909049p23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Premier Member Bonus eropolik.blogspot.jp bA||Email:willjackson767@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:12:40:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961129&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprix-togolais-de-la-qualite-la-8%2525E1%2525B5%252589-edition-lancee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781008854 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/prix-togolais-de-la-qualite-la-8%E1%B5%89-edition-lancee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.14
country_id: 2510769
description:
2026-06-09 12:42:40 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [185.214.169.14]:43038: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.23.168
country_id: 1814991
description:
Jun  9 12:46:45 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.23.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  9 12:46:45 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun  9 12:46:49 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun  9 12:46:56 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.225.28
country_id: 1269750
description:
Jun  9 12:47:13 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.225.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun  9 12:47:21 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  9 12:49:22 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 12:49:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53038: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 12:49:28 +0000] info [cpaneld] 103.65.237.227 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 12:49:37 +0000] info [cpaneld] 102.54.238.57 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.21.104.100
country_id: 2802361
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/plugins/gtranslate/flags/svg/fr.svg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.168.90.68
country_id: 798544
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.27-1.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 18.232.116.112
country_id: 6252001
description:
18.232.116.112 - - [09/Jun/2026:12:50:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669670&pdata=https%253A%252F%252Fwebmail.confortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009456 HTTP/2.0" 302 0 webmail.confortis.tg "https://webmail.confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:18.232.116.112


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.232.116.112
country_id: 6252001
description:
[2026-06-09 12:51:26 +0000] info [webmaild] 18.232.116.112 - info@confortis.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 12:51:44 +0000] info [cpaneld] 102.54.238.57 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 12:52:33 +0000] info [cpaneld] 102.54.238.57 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [09/Jun/2026:12:52:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712216&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetablissement-des-actes-de-naissance-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009567 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etablissement-des-actes-de-naissance-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.194.125.146
country_id: 1861060
description:
2026-06-09 12:53:15 dovecot_plain authenticator failed for H=146.125.194.35.bc.googleusercontent.com (sstucbl3k3ecaqe4dl3iw) [35.194.125.146]:19695: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [09/Jun/2026:12:53:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526877&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009624 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:12:54:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802642&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009654 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:12:54:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168659&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fancien-president-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009656 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ancien-president-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [09/Jun/2026:12:54:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662107&pdata=https%253A%252F%252Ftdn.tg%252Fcovid-19-au-togo-voici-la-liste-des-eglises-baptistes-qui-vont-rouvrir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009664 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/covid-19-au-togo-voici-la-liste-des-eglises-baptistes-qui-vont-rouvrir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:12:56:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985583&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsalaire-minimum-interprofessionnel-garanti%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009763 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/salaire-minimum-interprofessionnel-garanti/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:12:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986393&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fancien-president-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009730 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ancien-president-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:12:56:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313765&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsalaire-minimum-interprofessionnel-garanti%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009815 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/salaire-minimum-interprofessionnel-garanti/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [09/Jun/2026:12:56:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145451&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-julie-ou-lhistoire-de-la-jeune-eleve-officier-medecin-de-19-ans-dont-le-deces-au-parachutisme-attriste-les-coeurs-voici-ce-qui-sest-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009781 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-julie-ou-lhistoire-de-la-jeune-eleve-officier-medecin-de-19-ans-dont-le-deces-au-parachutisme-attriste-les-coeurs-voici-ce-qui-sest-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [09/Jun/2026:12:57:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986187&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009867 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:12:58:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884377&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009926 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:12:59:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261658&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781009940 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.180.227.227
country_id: 2017370
description:
2026-06-09 12:58:17 H=([94.180.227.227]) [94.180.227.227]:63240 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.86.22
country_id: 1819730
description:
Jun  9 12:59:34 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.86.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.86.22
country_id: 1819730
description:
2026-06-09 12:59:36 dovecot_plain authenticator failed for H=awork082022.netvigator.com (q9yio7kvvvj42w09tms67ui240vlrl4) [203.198.86.22]:28793: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 13:01:20 +0000] info [cpaneld] 103.65.237.227 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:01:32 +0000] info [cpaneld] 102.54.238.57 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/preprod.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/pre-prod.sql||User:antasadmin||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Dice Games Reward bonotdamvam.blogspot.fi T3||Email:lizardknee505@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.148.146.65
country_id: 458258
description:
2026-06-09 13:06:54 dovecot_login authenticator failed for H=(bMmHbO) [159.148.146.65]:47472: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-06.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.148.146.65
country_id: 458258
description:
Jun  9 13:06:52 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.148.146.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/qa.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/express.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:13:10:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920856&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781010609 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/spring.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:09:28 +0000] info [cpaneld] 102.54.238.57 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun  9 13:09:31 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/zend.sql||User:antasadmin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:10:35 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2687: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.52.13
country_id: 2963597
description:
Jun  9 13:11:58 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.52.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/wp-includes.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:11:14 +0000] info [cpaneld] 102.54.238.57 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.176
country_id: 690791
description:
Jun  9 13:12:08 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/concrete5.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.176
country_id: 690791
description:
Jun  9 13:12:16 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.52.13
country_id: 2963597
description:
Jun  9 13:12:11 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.52.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 150.109.19.197
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-10-jours-de-quarantaine-systematique-pour-les-voyageurs-venants-de-6-pays/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:13:18 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2562: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-09 13:13:34 +0000] info [cpaneld] 64.44.59.71 NEW wwayrzpl:tlIul0eePfyxuEju address=64.44.59.71,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.251106562269697.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.54
country_id: 6252001
description:
[2026-06-09 13:13:52 +0000] info [cpaneld] 134.195.82.54 NEW lhqeyybr:Ipz06yRg_eMWL2dj address=134.195.82.54,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-09 13:13:34 +0000] info [cpaneld] 5.231.255.233 NEW wgqhqbem:BDz2DZr_Hcwt90Cg address=5.231.255.233,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-09 13:13:59 +0000] info [cpaneld] 5.230.133.42 NEW oviaiart:oTWL5bXm5YyJH6k7 address=5.230.133.42,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.151
country_id: 6252001
description:
[2026-06-09 13:13:59 +0000] info [cpaneld] 173.211.89.151 NEW wcnyaruu:7H0myi0Pazdg4TgW address=173.211.89.151,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-09 13:14:07 +0000] info [cpaneld] 5.230.133.216 NEW cinemafreenetmas:O_AQi963Yrv8HURP address=5.230.133.216,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-09 13:13:42 +0000] info [cpaneld] 173.211.88.116 NEW sotragonet:YYF2hdioFdgJIhtQ address=173.211.88.116,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.125
country_id: 2635167
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.005147881777633.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.254
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.581420657408124.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-09 13:13:40 H=([46.151.182.45]) [46.151.182.45]:55036 F=<mail@mailling.co.uk> rejected RCPT <arse@arse.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.31
country_id: 6252001
description:
[2026-06-09 13:14:00 +0000] info [cpaneld] 134.195.83.31 NEW oviaiart:JpbLYIRkz_gWsmAQ address=134.195.83.31,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-09 13:13:38 +0000] info [cpaneld] 5.230.153.156 NEW sotragonet:nC2zSRj3h7AKrlPR address=5.230.153.156,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.217
country_id: 2635167
description:
[2026-06-09 13:13:40 +0000] info [cpaneld] 5.230.153.217 NEW jdzxeovw:_amHQamZGXvmSOuu address=5.230.153.217,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.23
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.242359413215726.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.48
country_id: 2635167
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.386768486220293.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:13:13 +0000] info [cpaneld] 102.54.238.57 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-09 13:13:34 +0000] info [cpaneld] 5.231.255.50 NEW wgqhqbem:H6o2oIVPx1LGP3aa address=5.231.255.50,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-09 13:13:46 +0000] info [cpaneld] 5.230.133.133 NEW nerohostfreenetm:mnM7ZLGPVieLYoiv address=5.230.133.133,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.184
country_id: 6252001
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.311749199575523.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/modx.sql||User:antasadmin||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-09 13:13:50 +0000] info [cpaneld] 64.44.59.151 NEW nerohostfreenetm:Rkuc9S5u3neYRhv_ address=64.44.59.151,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/poetry.sql||User:antasadmin||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-09 13:14:12 +0000] info [cpaneld] 64.44.62.229 NEW sadis:R4niYuV3d2BXIqzG address=64.44.62.229,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.197
country_id: 2635167
domain: afrique-distribution.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/sadis/public_html/.777323193486284.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/pipeline.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:16:21 +0000] info [cpaneld] 102.54.238.57 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/helm.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:13:16:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069719&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetablissement-des-actes-de-naissance-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781010987 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etablissement-des-actes-de-naissance-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:16:40 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2567: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/iac.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:13:17:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117524&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetablissement-des-actes-de-naissance-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011055 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etablissement-des-actes-de-naissance-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [09/Jun/2026:13:18:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056303&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcataracte-des-soins-gratuits-efficients-et-de-grande-envergure-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011129 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cataracte-des-soins-gratuits-efficients-et-de-grande-envergure-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/error_log.sql||User:antasadmin||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.248.181.3
country_id: 1814991
description:
2026-06-09 13:19:41 H=([0.0.0.0]) [42.248.181.3]:25521 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:13:19:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792865&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011173 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/administrator.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:20:40 +0000] info [cpaneld] 102.54.238.57 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:20:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2580: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:13:21:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919367&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011265 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/migrations.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/private/postman.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:13:21:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130589&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsalaire-minimum-interprofessionnel-garanti%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011312 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/salaire-minimum-interprofessionnel-garanti/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [09/Jun/2026:13:23:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806295&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011385 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public/backup_full.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:13:22:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857644&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011371 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:13:23:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909849&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremboursement-de-la-dot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011398 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remboursement-de-la-dot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:13:23:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724251&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011425 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public/old.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:13:23:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182946&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011431 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.104.121
country_id: 1880251
description:
43.134.104.121 - - [09/Jun/2026:13:23:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132166&pdata=https%253A%252F%252Flaunetogo.tg%252Flhopital-dogta-lafie-partenaire-de-choix-pour-la-faculte-des-sciences-et-sante-de-luniversite-de-kara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011433 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/lhopital-dogta-lafie-partenaire-de-choix-pour-la-faculte-des-sciences-et-sante-de-luniversite-de-kara/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.104.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [09/Jun/2026:13:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000534&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-generale-des-moulins-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011446 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-generale-des-moulins-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:23:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2581: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public/source.sql||User:antasadmin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 13:24:15 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60124: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:24:44 +0000] info [cpaneld] 102.54.238.57 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:13:25:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908011&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011556 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public/build.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public/artifacts.sql||User:antasadmin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-09 13:26:37 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.99]:41926: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-09 13:27:13 H=([46.151.182.45]) [46.151.182.45]:57159 F=<mail@mailling.co.uk> rejected RCPT <ekeabenin@ekeasarl.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.119
country_id: 1880251
description:
47.128.121.119 - - [09/Jun/2026:13:31:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158505&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F09%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781011895 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/09/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.119


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-32.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Amusing Plays vamvozmviigr.blogspot.ch x5||Email:rhangerzo@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 170.199.228.133
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:170.199.228.133||TA:170.199.228.133||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:13:35:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104616&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-covid-19-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012106 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-covid-19-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:13:35:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924502&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcimco-industrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012124 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cimco-industrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [09/Jun/2026:13:35:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065003&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012117 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun  9 13:35:32 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:13:36:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064786&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012203 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 13:36:30 +0000] info [cpaneld] 103.65.237.227 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.65.228.163
country_id: 2542007
description:
2026-06-09 13:38:26 dovecot_plain authenticator failed for H=(7zrainb0les2k1wyv7myvd5) [196.65.228.163]:53931: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:13:38:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051415&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012315 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-09 13:38:47 H=([46.151.182.45]) [46.151.182.45]:52943 F=<mail@mailling.co.uk> rejected RCPT <info@arse.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.12
country_id: 1880251
description:
47.128.119.12 - - [09/Jun/2026:13:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9592930&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14138&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012331 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14138" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.65.228.163
country_id: 2542007
description:
Jun  9 13:38:24 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.65.228.163 has been locked due to Imunify RBL


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 34.106.28.161
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"149\", \"google chrome\";v=\"149\"||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.165.44
country_id: 2542007
description:
2026-06-09 13:39:24 dovecot_plain authenticator failed for H=(wqi2mckh6v0x48i5s) [196.75.165.44]:43665: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.75.165.44
country_id: 2542007
description:
Jun  9 13:39:22 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.75.165.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-09 13:40:38 +0000] info [cpaneld] 5.230.153.42 NEW pjwfvzan:OA4BMFrR5d1SvvR0 address=5.230.153.42,app=cpaneld,creator=pjwfvzan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 13:40:17 +0000] info [cpaneld] 102.54.238.57 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-09 13:41:43 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.99]:40005: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.30
country_id: 798544
description:
Jun  9 13:43:42 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.196.236.49
country_id: 6252001
description:
168.196.236.49 - - [09/Jun/2026:13:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660003&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781012823 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.196.236.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.236.49
country_id: 6252001
description:
[2026-06-09 13:47:07 +0000] info [whostmgrd] 168.196.236.49 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.156.134.86
country_id: 2464461
description:
[2026-06-09 13:48:34 +0000] info [cpaneld] 102.156.134.86 - netflix "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun  9 13:48:48 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:13:50:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132166&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781013008 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun  9 13:51:03 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 181.188.178.144
country_id: 3923057
domain: ca-togo.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25336.ca-togo.org||ServerName:ca-togo.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:408e4d958b24d2d613131f35df4adff9890ffa85||Title:r632ylgvt40xyc5zqz||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 13:50:53 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:51:58 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2598: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:52:37 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2601: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-09 13:52:33 +0000] info [cpaneld] 5.230.153.136 NEW doufelg:hSFlftPdIkvmAQ28 address=5.230.153.136,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.83
country_id: 690791
description:
Jun  9 13:52:28 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.83 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.217.107
country_id: 6252001
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:38.154.217.107||TA:38.154.217.107||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:53:39 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2606: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  9 13:54:45 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-09 13:54:47 dovecot_plain authenticator failed for H=(hcuhog72gk33ndewha38hnug51c8n) [27.73.209.71]:59351: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:55:44 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2618: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:56:51 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2561: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 13:57:50 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2594: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-09 13:57:18 +0000] info [cpaneld] 5.230.153.254 NEW wcnyaruu:UaUKKq76mL0B2158 address=5.230.153.254,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Unlock Your Security Token eropolik.blogspot.dk x3||Email:audreykouma20@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-58.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:13:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791341&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fheidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781013520 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:13:59:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578540&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781013567 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:13:59:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382746&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felimination-des-eperviers-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781013574 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elimination-des-eperviers-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.45
country_id: 2750405
description:
2026-06-09 13:59:48 H=([46.151.182.45]) [46.151.182.45]:55651 F=<mail@mailling.co.uk> rejected RCPT <misstg@misstogo.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:02:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2601: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:04:06 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2602: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:05:08 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2603: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [09/Jun/2026:14:04:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011542&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781013860 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-09 14:06:06 +0000] info [cpaneld] 134.195.82.55 NEW aopsacai:HNaBN6ipdY3SYeiF address=134.195.82.55,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-09 14:06:08 +0000] info [cpaneld] 107.174.169.209 NEW aopsacai:s9tPcHZY6HAmGUFa address=107.174.169.209,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.206.78
country_id: 953987
description:
Jun  9 14:05:57 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.206.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.180
country_id: 2635167
description:
[2026-06-09 14:06:05 +0000] info [cpaneld] 5.230.153.180 NEW aopsacai:dM0inlliaqeCfV_L address=5.230.153.180,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:06:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2604: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.190
country_id: 3017382
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.788204146530247.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.177
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.927624189200595.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-09 14:07:51 +0000] info [cpaneld] 64.44.59.244 NEW mgvybwur:KQdIrBZgyJWMZubO address=64.44.59.244,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:07:18 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2606: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-09 14:07:54 +0000] info [cpaneld] 107.175.5.84 NEW mgvybwur:Kfrn0aXUlgZvyroV address=107.175.5.84,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:09:28 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2610: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [09/Jun/2026:14:11:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302601&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagicien-des-porte-monnaies-magiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014258 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magicien-des-porte-monnaies-magiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:14:12:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050648&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014348 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [09/Jun/2026:14:14:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011238&pdata=https%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014443 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:14:13:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673622&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjoanna-agudetse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014399 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/joanna-agudetse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.46.218.151
country_id: 1522867
description:
2026-06-09 14:14:45 H=([92.46.218.151]) [92.46.218.151]:49839 F=<www.linkedin.comarse@arse.tg> rejected RCPT <www.linkedin.comarse@arse.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:14:16:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065255&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014564 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.248.126.58
country_id: 1269750
domain: hotelyabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:63097.hotelyabisso.com||ServerName:hotelyabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:616d156feb04b619ea33888565ce7e8d6cf5a497||Title:0x06ae8587||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [09/Jun/2026:14:18:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778002&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftokyo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014683 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tokyo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:17:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2619: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [09/Jun/2026:14:17:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278100&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014657 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:18:39 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2620: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.202.171.130
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-18.198.202.171.130||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.177.102.165
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-19.181.177.102.165||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:14:19:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724254&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014744 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:14:18:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802607&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014730 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:19:48 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2621: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.133.46
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_b8f1656fe74917c0889f45e66ede5492.css?ver=1.0.0 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.125.230.19
country_id: 660013
description:
2026-06-09 14:20:02 dovecot_plain authenticator failed for H=(2uywr7znwu0hvf4ic1w7k8jwxr52) [185.125.230.19]:49150: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.91.135
country_id: 2921044
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/Justin_Pilante1-860x645-1-300x225.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 14:19:14 +0000] info [cpaneld] 102.54.238.57 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.232.228
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_1ae2b2895a8976da80c9a1afa6a98e23.css?ver=1.7.12 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.177
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_fa757170427f0ca61fdafc865cbd50f1.css?ver=1.0.0 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.12.117.176
country_id: 6251999
description:
[2026-06-09 14:21:02 +0000] info [cpaneld] 154.12.117.176 - aifkjzqm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.232.228
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:14:20:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132120&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpiraterie-maritime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/piraterie-maritime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.79.10.160
country_id: 1880251
description:
47.79.10.160 - - [09/Jun/2026:14:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394984&pdata=https%253A%252F%252Fcrrhuemoa.org%252Fen%252Fnode%252F25&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014849 HTTP/2.0" 302 0 crrhuemoa.org "https://crrhuemoa.org/en/node/25" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"47.79.10.160" CAPTCHA:"0" PEER:172.70.93.78


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.29.219.22
country_id: 6252001
domain: camilliens.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.15||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Reserve Your Non-Repeatable Bonus sepoladi.blogspot.pt 6o||Email:merrillcurba@hotmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:14-23.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:14:22:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7380593&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F1ere-femme-chuteur-de-larmee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781014949 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/1ere-femme-chuteur-de-larmee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 171.251.237.231
country_id: 1562822
description:
2026-06-09 14:22:53 H=([0.0.0.0]) [171.251.237.231]:36958 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 14:22:17 +0000] info [cpaneld] 103.253.27.219 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 14:23:46 +0000] info [cpaneld] 102.54.238.57 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [09/Jun/2026:14:23:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391170&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015016 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:14:25:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448028&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoeux-de-faure-gnassingbe-aux-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015107 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voeux-de-faure-gnassingbe-aux-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:14:26:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870487&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-lome-nouvelle-licence-professionnelle-rentree-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015166 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-lome-nouvelle-licence-professionnelle-rentree-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:14:27:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723992&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsucre-roux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015264 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sucre-roux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.223.95.187
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.223.95.187) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.6.100.172
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.6.100.172) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:14:31:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800737&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frisques-dinondation-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015483 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/risques-dinondation-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:14:32:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116951&pdata=https%253A%252F%252Ftdn.tg%252Ftogoexplosion-port-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015530 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togoexplosion-port-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [09/Jun/2026:14:33:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607830&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015636 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.84
country_id: 1512440
description:
2026-06-09 14:33:13 H=([213.230.93.84]) [213.230.93.84]:54855 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:14:35:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908821&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015704 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [09/Jun/2026:14:35:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077798&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015721 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.231
country_id: 798549
description:
2026-06-09 14:36:32 dovecot_login authenticator failed for H=(WIN-47NALKLU30J) [92.118.39.231]:50071: 535 Incorrect authentication data (set_id=acc10@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:14:36:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516376&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781015794 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:14:40:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcolonisation-francaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/colonisation-francaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:39:40 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2632: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:40:47 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2633: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:14:41:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274917&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-lome-nouvelle-licence-professionnelle-rentree-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016088 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-lome-nouvelle-licence-professionnelle-rentree-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:41:47 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2634: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:14:41:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182435&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcolonisation-francaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016108 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/colonisation-francaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:14:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236809&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsucre-roux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016116 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sucre-roux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:42:57 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2635: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:14:43:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211496&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffinale-de-la-coupe-du-monde-fifa-qatar-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016188 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/finale-de-la-coupe-du-monde-fifa-qatar-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 74.80.182.80
country_id: 6252001
description:
[2026-06-09 14:42:22 +0000] info [cpaneld] 74.80.182.80 NEW cafeitadm:9sw5aqmRKLnVKzf4 address=74.80.182.80,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.80.182.80
country_id: 6252001
description:
74.80.182.80 - - [09/Jun/2026:14:42:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7365991&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016130 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.80.182.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.37
country_id: 2287781
description:
2026-06-09 14:44:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.37]:2636: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:14:44:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131865&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fherve-djessoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016266 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/herve-djessoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:14:45:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6513820&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpiraterie-maritime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016350 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/piraterie-maritime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [09/Jun/2026:14:46:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235474&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fapessito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016389 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/apessito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:14:46:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658410&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016397 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:14:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131612&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frose-christiane-ossouka-raponda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016422 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rose-christiane-ossouka-raponda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [09/Jun/2026:14:47:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039637&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fheidelbergcement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016443 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/heidelbergcement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.138.191.45
country_id: 1210997
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/cgi-bin/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:14:47:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672392&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-fonctionnaires-de-police%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016436 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-fonctionnaires-de-police/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Apply Your Private Club Funds sepoladi.blogspot.gr tO||Email:invest.maxy@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:14-47.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:14:48:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289163&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F1ere-femme-chuteur-de-larmee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016495 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/1ere-femme-chuteur-de-larmee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  9 14:48:19 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:14:49:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118294&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkokou-dodji-fanny%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016541 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kokou-dodji-fanny/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:14:48:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7497837&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016508 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:14:48:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736028&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvaccin-contre-la-rougeole-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016535 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vaccin-contre-la-rougeole-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:14:49:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7509911&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016567 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [09/Jun/2026:14:49:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201514&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016554 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.167
country_id: 1269750
description:
Jun  9 14:49:32 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.167 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:14:50:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645607&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016627 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:14:50:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079963&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016640 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 78.40.198.174
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-50.78.40.198.174||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.249.209
country_id: 3175395
domain: v2.cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/v2.cfpj.tg/wp-login.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [09/Jun/2026:14:52:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906268&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcouple-avec-5-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016724 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/couple-avec-5-enfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:14:51:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7127914&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felimination-des-eperviers-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016679 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elimination-des-eperviers-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 14:51:35 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:14:52:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646424&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcorps-sans-vie-dun-proviseur-retrouve-dans-le-lac-daneho%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016760 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/corps-sans-vie-dun-proviseur-retrouve-dans-le-lac-daneho/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [09/Jun/2026:14:52:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735767&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjoanna-agudetse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016776 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/joanna-agudetse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-09 14:53:05 +0000] info [cpaneld] 134.195.82.68 NEW discover:D_Pdday6Y9tWfR6Q address=134.195.82.68,app=cpaneld,creator=discover,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:14:52:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10210153&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoeux-de-faure-gnassingbe-aux-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016731 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voeux-de-faure-gnassingbe-aux-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [09/Jun/2026:14:52:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815400&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016746 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-09 14:52:29 +0000] info [cpaneld] 134.195.83.207 NEW aopsacai:ebxuNL8952gK3mCH address=134.195.83.207,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [09/Jun/2026:14:52:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529962&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016753 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:14:53:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066330&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbayern-munich%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bayern-munich/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:14:53:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961134&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-hm-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016830 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-hm-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.242.106.54
country_id: 3658394
description:
[2026-06-09 14:54:51 +0000] info [whostmgrd] 190.242.106.54 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [09/Jun/2026:14:56:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011292&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016987 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [09/Jun/2026:14:56:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854552&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmediatheque-de-linstitut-francais-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781016994 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mediatheque-de-linstitut-francais-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:14:57:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988966&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbraquage-a-hedzranawoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017068 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/braquage-a-hedzranawoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.138.182.128
country_id: 1210997
description:
103.138.182.128 - - [09/Jun/2026:14:58:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804436&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F11%252F30%252Ffamal-a-agbalepedo-le-maire-aguze-akossiwa-delivre-un-message-important-aux-femmes-des-marches%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017115 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/11/30/famal-a-agbalepedo-le-maire-aguze-akossiwa-delivre-un-message-important-aux-femmes-des-marches/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.8885.1162 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.138.182.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:14:59:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869214&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-prison-ferme-homos3xuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017145 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-prison-ferme-homos3xuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.193.116
country_id: 2921044
description:
2026-06-09 14:58:31 dovecot_plain authenticator failed for H=(iyty9skgjbtrk87acb16j1xfn9n594t4) [104.28.193.116]:56865: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 14:59:32 +0000] info [cpaneld] 102.54.238.57 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [09/Jun/2026:15:00:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884326&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcorps-sans-vie-dun-proviseur-retrouve-dans-le-lac-daneho%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017250 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/corps-sans-vie-dun-proviseur-retrouve-dans-le-lac-daneho/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:15:00:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580424&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017211 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:15:00:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12764266&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-1000-jeunes-pour-la-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017224 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-1000-jeunes-pour-la-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:15:02:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788457&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fapessito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017341 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/apessito/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [09/Jun/2026:15:02:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000023&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-1000-jeunes-pour-la-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017361 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-1000-jeunes-pour-la-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:15:03:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7064687&pdata=https%253A%252F%252Ftdn.tg%252Fboad-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017381 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/boad-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [09/Jun/2026:15:04:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685446&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagloire-agbegnido%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017453 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magloire-agbegnido/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [09/Jun/2026:15:04:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182959&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017492 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:15:05:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606508&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagloire-agbegnido%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017518 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magloire-agbegnido/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:15:05:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066536&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.3.167.67
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.50.3.167.67||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.3.220.249
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.192.3.220.249||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.241.72.118
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.192.241.72.118||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.122.170.150
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.185.122.170.150||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.198.13.83
country_id: 241170
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.196.198.13.83||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.251.143.109
country_id: 6251999
description:
216.251.143.109 - - [09/Jun/2026:15:07:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974661&pdata=https%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017620 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.251.143.109


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.245.255.131
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.172.245.255.131||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.169
country_id: 1880251
description:
47.128.121.169 - - [09/Jun/2026:15:06:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619355&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F05%252F17%252Fman-city-va-soffrir-un-record-choisissez-vos-favoris-dans-la-lutte-pour-le-titre-de-lepl%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017593 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/05/17/man-city-va-soffrir-un-record-choisissez-vos-favoris-dans-la-lutte-pour-le-titre-de-lepl/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:15:06:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10207946&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017605 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [09/Jun/2026:15:07:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938083&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbraquage-a-hedzranawoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017636 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/braquage-a-hedzranawoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [09/Jun/2026:15:07:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723220&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017649 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:15:07:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923226&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmediatheque-de-linstitut-francais-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017656 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mediatheque-de-linstitut-francais-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:15:07:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038919&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017675 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.232.174
country_id: 1269750
description:
Jun  9 15:08:11 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.232.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.232.174
country_id: 1269750
description:
2026-06-09 15:08:13 dovecot_plain authenticator failed for H=(balcoite) [152.52.232.174]:49746: 535 Incorrect authentication data (set_id=admin@soroubat.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/09/2026:15:09:19 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:15:09:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067109&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dans-une-usine-chimique-en-chine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017787 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dans-une-usine-chimique-en-chine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [09/Jun/2026:15:09:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063140&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftest-pcr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017767 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/test-pcr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:15:11:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13355110&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftest-pcr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017864 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/test-pcr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:15:10:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129961&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017831 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jun  9 15:10:45 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - sandrine.a@cloud-et-racks.tg [06/09/2026:15:11:21 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: sandrine.a@cloud-et-racks.tg


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Your Special Funds eropolik.blogspot.hu t5||Email:manuelwalters42@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 15:11:31 +0000] info [cpaneld] 103.65.237.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 82.156.159.48
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/paseaf-changements-majeurs-pour-les-entreprises/<script async src=||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:15-11.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:15:11:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329495&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnegociateurs-climat-de-la-cedeao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781017903 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/negociateurs-climat-de-la-cedeao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - serge.a@cloud-et-racks.tg [06/09/2026:15:13:04 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: serge.a@cloud-et-racks.tg


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-09 15:12:18 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:H3WEl8fCMkshGPpZ address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.239.164
country_id: 3895114
domain: test.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:hphhdcxi||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:15:13:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946014&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018026 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:15:14:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802903&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnegociateurs-climat-de-la-cedeao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018090 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/negociateurs-climat-de-la-cedeao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.31.156.154
country_id: 660013
description:
Jun  9 15:14:30 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.31.156.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.156.154
country_id: 660013
description:
2026-06-09 15:14:32 dovecot_plain authenticator failed for H=(dnxjgkxp80suz6eri) [144.31.156.154]:54495: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:15:16:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988040&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018195 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:15:16:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527329&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018208 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.183
country_id: 1512440
description:
2026-06-09 15:16:13 H=([0.0.0.0]) [213.230.92.183]:39406 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:15:16:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143895&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frose-christiane-ossouka-raponda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018188 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rose-christiane-ossouka-raponda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.146.175.254
country_id: 3996063
description:
[2026-06-09 15:17:33 +0000] info [whostmgrd] 187.146.175.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [09/Jun/2026:15:17:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185876&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018254 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 152.136.49.218
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2024\xc2\xa0: Faure Gnassingb\xc3\xa9 assiste \xc3\xa0 la grande finale de Pya||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:15:18:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985627&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018293 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [09/Jun/2026:15:19:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200070&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-circulation-au-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018383 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-circulation-au-mali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.184.66
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d18e62e6d51590fcf8a6d33bb280075e50ef92ef||Title:g751lvrikibx41||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.189.44.19
country_id: 1880251
description:
[2026-06-09 15:21:10 +0000] info [cpaneld] 206.189.44.19 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephanetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 15:20:43 +0000] info [cpaneld] 80.248.64.198 - gxmvecsq "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gxmvecsq (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:15:20:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081192&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-de-tivaoune-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018415 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-de-tivaoune-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:15:21:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117415&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-circulation-au-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018512 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-circulation-au-mali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:15:22:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070021&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fethiopian-airlines%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018526 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ethiopian-airlines/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:15:21:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092972&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frose-christiane-ossouka-raponda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018500 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rose-christiane-ossouka-raponda/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.184.66
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bc22b1879393e0cd2684f0dd7b912ad3bd1afce||Title:6izb6nd39lmk9o9s||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:15:22:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144712&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flycee-francais-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018519 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/lycee-francais-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.184.66
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5274fd247a29b77a2170e6e5bd433b66b802d47||Title:5wpj03kocbqfw5z7d||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [09/Jun/2026:15:22:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327192&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018577 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [09/Jun/2026:15:23:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081031&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018617 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [09/Jun/2026:15:23:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131145&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-lie-au-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018636 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-lie-au-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 79.137.178.93
country_id: 1522867
description:
2026-06-09 15:23:59 H=([79.137.178.93]) [79.137.178.93]:51980 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.184.66
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3959abb11fc2d7352d0923b5f94fadd6c15d7052||Title:0lm6154utlddmjxyfw||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:15:23:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116484&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018614 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.160.192.216
country_id: 690791
description:
195.160.192.216 - - [09/Jun/2026:15:24:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937323&pdata=https%3A%2F%2Fwww.ns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018686 HTTP/1.1" 302 0 www.ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.160.192.216


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.160.192.216
country_id: 690791
description:
[2026-06-09 15:24:50 +0000] info [whostmgrd] 195.160.192.216 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:15:24:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777492&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcandidat-au-bepc-se-donne-la-mort-par-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018694 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/candidat-au-bepc-se-donne-la-mort-par-pendaison/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.43.180.196
country_id: 614540
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-25.94.43.180.196||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.102.190.7
country_id: 2750405
description:
Jun  9 15:25:56 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.102.190.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 15:26:03 +0000] info [cpaneld] 103.65.237.227 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [09/Jun/2026:15:25:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198725&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagloire-agbegnido%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018720 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magloire-agbegnido/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.48.12
country_id: 290557
description:
[2026-06-09 15:26:57 +0000] info [whostmgrd] 92.99.48.12 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.138.50
country_id: 2363686
description:
[2026-06-09 15:26:31 +0000] info [webmaild] 41.78.138.50 - raouf.damtare@togointerim.net "GET /cpsess7887054902/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.191.249
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08a13b5897fefd3414e764e09095adaf1f4ea1ab||Title:6v415lep8nzite4429||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:15:27:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986132&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-fraudeurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-fraudeurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.191.249
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3f9ae55f6199f9bc283382fc407cc0eeffb90472||Title:8w3s9lzsyio3vl||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:15:27:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619816&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018875 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:15:28:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988713&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsport-gala-de-la-fraternite-a-bassar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018907 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/sport-gala-de-la-fraternite-a-bassar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [09/Jun/2026:15:28:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462098&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018907 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [09/Jun/2026:15:29:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724201&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fousmane-dembele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018997 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ousmane-dembele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [09/Jun/2026:15:29:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460771&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781018978 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:15:30:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933349&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F1ere-femme-chuteur-de-larmee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019004 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/1ere-femme-chuteur-de-larmee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 15:30:22 +0000] info [cpaneld] 103.253.27.219 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [09/Jun/2026:15:31:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737368&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019063 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.34.63.150
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.34.63.150) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [09/Jun/2026:15:30:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854042&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019018 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [09/Jun/2026:15:31:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989224&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019095 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.138.50
country_id: 2363686
description:
[2026-06-09 15:31:18 +0000] info [webmaild] 41.78.138.50 - raouf.damtare@togointerim.net "GET /cpsess7887054902/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:15:31:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934952&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-camion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019082 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 79.137.178.93
country_id: 1522867
description:
2026-06-09 15:31:50 H=([79.137.178.93]) [79.137.178.93]:51981 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.91
country_id: 831053
description:
[2026-06-09 15:34:05 +0000] info [cpaneld] 37.35.67.91 - rqgqpxof "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.130
country_id: 1880251
description:
47.128.121.130 - - [09/Jun/2026:15:34:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923431&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Frecrutement-consultant%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019277 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/recrutement-consultant/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.130


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:15:35:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10341475&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019304 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:15-36.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Gather Your Kingly-Level Prize sepoladi.blogspot.hu qF||Email:dornalrhodes9502@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.189.44.19
country_id: 1880251
description:
[2026-06-09 15:37:45 +0000] info [whostmgrd] 206.189.44.19 - 91536897 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:15:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802133&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019528 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:15:39:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313522&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F4g-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019559 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/4g-togocom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.114.212.66
country_id: 1562822
description:
[2026-06-09 15:39:43 +0000] info [whostmgrd] 42.114.212.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.183
country_id: 6252001
description:
Jun  9 15:40:50 ns5 pure-ftpd[924395]: (?@147.185.132.183) [INFO] New connection from 147.185.132.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [09/Jun/2026:15:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986135&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felimination-des-eperviers-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019701 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elimination-des-eperviers-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun  9 15:42:51 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:15:43:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778009&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministre-de-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019785 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministre-de-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun  9 15:43:50 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [09/Jun/2026:15:44:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131356&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvol-de-compteur-deau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019849 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vol-de-compteur-deau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 15:43:50 +0000] info [cpaneld] 80.248.64.198 - gxmvecsq "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gxmvecsq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 15:44:50 +0000] info [cpaneld] 80.248.64.198 - qgqjistz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [09/Jun/2026:15:45:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882014&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781019940 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 15:45:44 +0000] info [cpaneld] 80.248.64.198 - qgqjistz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-09 15:46:25 +0000] info [cpaneld] 80.248.64.198 - qgqjistz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.138.50
country_id: 2363686
description:
[2026-06-09 15:46:26 +0000] info [webmaild] 41.78.138.50 - raouf.damtare@togointerim.net "GET /cpsess7887054902/3rdparty/roundcube/?_task=mail&_action=compose&_id=20359393996a22bdda00efe HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 188.239.11.23
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/formation-des-opj-vers-une-meilleure-lutte-contre-la-torture-au-togo/<script async src=||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.204.81.83
country_id: 290557
description:
[2026-06-09 15:47:34 +0000] info [whostmgrd] 94.204.81.83 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.75.247.164
country_id: 2542007
description:
Jun  9 15:48:30 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.75.247.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.247.164
country_id: 2542007
description:
2026-06-09 15:48:32 dovecot_plain authenticator failed for H=(q521a5ue20nsri5yud277h59ac09eiw) [196.75.247.164]:49357: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [09/Jun/2026:15:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328471&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F25-ans-google%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020129 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/25-ans-google/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [09/Jun/2026:15:49:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987439&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-taux-dinflation-sest-etabli-a-11-en-aout-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020173 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-taux-dinflation-sest-etabli-a-11-en-aout-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.13.52
country_id: 6252001
description:
[2026-06-09 15:50:23 +0000] info [cpaneld] 65.111.13.52 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.160.130
country_id: 6252001
description:
[2026-06-09 15:50:23 +0000] info [cpaneld] 209.50.160.130 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [09/Jun/2026:15:50:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908054&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020237 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:15:50:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922970&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020251 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.156.85
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.lacitoyennevie.tg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:15:52:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998984&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F396%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020329 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/396/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.211.46.147
country_id: 2921044
description:
2026-06-09 15:53:49 dovecot_plain authenticator failed for H=(j3589m9nxfrpgo56qg) [8.211.46.147]:51575: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:15:54:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947550&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremboursement-de-la-dot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020471 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remboursement-de-la-dot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:15:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342823&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fancien-president-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020530 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ancien-president-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.244.47.104
country_id: 6252001
description:
72.244.47.104 - - [09/Jun/2026:15:55:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739671&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020534 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.244.47.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.244.47.104
country_id: 6252001
description:
[2026-06-09 15:55:39 +0000] info [whostmgrd] 72.244.47.104 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.178.149.127
country_id: 1562822
description:
[2026-06-09 15:56:07 +0000] info [whostmgrd] 14.178.149.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.133
country_id: 3469034
description:
Jun  9 15:56:45 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.133 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.224.90.239
country_id: 6252001
domain: caissederetraites.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.224.90.239||TA:104.224.90.239||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:15:58:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449252&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020697 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:15:58:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077844&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcartes-nationales-didentite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020704 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cartes-nationales-didentite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:15:59:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987221&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020742 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Pleasurable-Game Funds sepoladi.blogspot.it BY||Email:nakoulmahabib19@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:16-00.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [09/Jun/2026:16:02:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104405&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frussie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020962 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/russie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:16:02:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038151&pdata=https%253A%252F%252Fwww.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020963 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:16:03:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949958&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781020994 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [09/Jun/2026:16:03:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200786&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021020 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [09/Jun/2026:16:04:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145284&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fherve-djessoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021079 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/herve-djessoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:16:04:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196377&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021085 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [09/Jun/2026:16:05:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661038&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpalais-des-congres-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021144 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/palais-des-congres-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:16:05:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312233&pdata=https%253A%252F%252Ftdn.tg%252Faccident-camion-citerne-togo-bafilo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021124 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-camion-citerne-togo-bafilo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [09/Jun/2026:16:06:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646128&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021198 HTTP/1.1" 302 0 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [09/Jun/2026:16:06:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6407878&pdata=http%253A%252F%252Farse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021198 HTTP/1.1" 302 0 arse.tg "http://arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


