# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 10 15:49:14 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.244.88.183
country_id: 2921044
description:
[2026-06-10 15:50:01 +0000] info [cpaneld] 79.244.88.183 - relancei "GET /login/?login_only=1&user=relancei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.95.57.80
country_id: 3469034
description:
[2026-06-10 15:50:27 +0000] info [cpaneld] 177.95.57.80 - rel "GET /login/?login_only=1&user=rel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.88.131.139
country_id: 3017382
description:
[2026-06-10 15:49:52 +0000] info [cpaneld] 89.88.131.139 - relanceinfotg "GET /login/?login_only=1&user=relanceinfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.72.83.90
country_id: 2017370
description:
[2026-06-10 15:49:49 +0000] info [cpaneld] 37.72.83.90 - relanceinfo "GET /login/?login_only=1&user=relanceinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.232.85
country_id: 1733045
description:
[2026-06-10 15:50:22 +0000] info [cpaneld] 180.75.232.85 - rela "GET /login/?login_only=1&user=rela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.118.63.83
country_id: 3686110
description:
[2026-06-10 15:49:42 +0000] info [cpaneld] 200.118.63.83 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.167.67
country_id: 3469034
description:
[2026-06-10 15:49:58 +0000] info [cpaneld] 45.165.167.67 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.37.156
country_id: 3865483
description:
[2026-06-10 15:50:10 +0000] info [cpaneld] 181.209.37.156 - relanc "GET /login/?login_only=1&user=relanc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 15:50:14 +0000] info [cpaneld] 185.213.83.243 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.127.87
country_id: 3624060
description:
[2026-06-10 15:50:05 +0000] info [cpaneld] 153.67.127.87 - relance "GET /login/?login_only=1&user=relance&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relance (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.56.193.95
country_id: 99237
description:
185.56.193.95 - - [10/Jun/2026:15:50:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6922140&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106617 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.9737.1042 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.56.193.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.218.190
country_id: 3895114
description:
[2026-06-10 15:50:32 +0000] info [cpaneld] 181.43.218.190 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.90.196.85
country_id: 6252001
description:
[2026-06-10 15:50:38 +0000] info [cpaneld] 54.90.196.85 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:15:53:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081195&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-nes-calcines-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106824 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-nes-calcines-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 10 15:53:43 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:15:53:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194262&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106817 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-06-10 15:53:47 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (vativerrel) [73.57.80.193]:43540: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:15:56:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841492&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-nes-calcines-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-nes-calcines-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:15:56:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394774&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbourses-et-allocation-au-bein%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781106994 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bourses-et-allocation-au-bein/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:15:59:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661074&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmain-robot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107149 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/main-robot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 16:01:29 +0000] info [cpaneld] 185.213.83.243 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.55
country_id: 1880251
description:
47.128.121.55 - - [10/Jun/2026:16:01:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999721&pdata=https%253A%252F%252Ftogodailynews.tg%252Frecuperation-des-forfaits-togocom-expires-voici-comment-proceder%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107259 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/recuperation-des-forfaits-togocom-expires-voici-comment-proceder/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.55


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:16:02:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803163&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fawi-toyi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107328 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/awi-toyi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:16:02:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211803&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107363 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 196.188.126.4
country_id: 337996
description:
196.188.126.4 - - [10/Jun/2026:16:02:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908514&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Finternationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107327 HTTP/2.0" 404 561 togodailynews.tg "https://togodailynews.tg/" "Mozilla/5.0 (Linux; Android 14; Pixel 6 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.119 Mobile Safari/537.36 OPR/81.2.4292.78581" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.188.126.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-06-10 16:04:22 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (noudane) [24.61.199.212]:36036: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.119
country_id: 1880251
description:
47.128.121.119 - - [10/Jun/2026:16:03:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10210409&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F09%252F22%252Ftogo-trois-braqueurs-mis-hors-detat-de-nuire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107433 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/09/22/togo-trois-braqueurs-mis-hors-detat-de-nuire/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.61.199.212
country_id: 6252001
description:
Jun 10 16:04:20 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.61.199.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 16:05:11 +0000] info [webmaild] 102.176.253.226 - dapr@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:16:05:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870180&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmedecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107513 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/medecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 16:08:09 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.136.73.213
country_id: 6252001
description:
[2026-06-10 16:10:12 +0000] info [whostmgrd] 150.136.73.213 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.35.61
country_id: 1269750
description:
152.59.35.61 - - [10/Jun/2026:16:10:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003926&pdata=https%253A%252F%252Ftogodailynews.tg%252Fenergie-solaire-lancement-imminent-dun-ambitieux-projet-de-developpement-de-400-mw%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781107815 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/energie-solaire-lancement-imminent-dun-ambitieux-projet-de-developpement-de-400-mw/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.7950.1452 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.35.61


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 16:11:33 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.6.236
country_id: 2363686
description:
[2026-06-10 16:14:03 +0000] info [cpaneld] 196.171.6.236 - iaxtjfpj "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [196.171.6.236]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.57.72.128
country_id: 357994
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/galerie HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:16:15:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051886&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108139 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.189.27.49
country_id: 337996
description:
196.189.27.49 - - [10/Jun/2026:16:17:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328219&pdata=https%253A%252F%252Ftogodailynews.tg%252Flome-peace-and-security-forum-levenement-tiendra-ses-promesses-du-20-au-22-octobre-prochain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108227 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lome-peace-and-security-forum-levenement-tiendra-ses-promesses-du-20-au-22-octobre-prochain/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.2944.1571 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.189.27.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.208.221
country_id: 1835841
description:
Jun 10 16:17:11 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [10/Jun/2026:16:16:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184298&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmode-et-protection-de-lenvironnement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108208 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mode-et-protection-de-lenvironnement/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: inscription.ucao-uut.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var ss=arguments[0x1];var jv=ss;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.208.221
country_id: 1835841
description:
2026-06-10 16:17:13 dovecot_login authenticator failed for H=(187-40-215-162.user.vtal.net.br) [175.207.208.221]:52129: 535 Incorrect authentication data (set_id=olivier.gadawouye@ekeasarl.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.180.82.103
country_id: 1861060
domain: davetechno.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/frontend/.env.backup||User:davetkoo||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:16:17:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053527&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftamea%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108271 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tamea/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.18.36.89
country_id: 2635167
description:
[2026-06-10 16:18:54 +0000] info [cpaneld] 82.18.36.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.220.37
country_id: 3469034
description:
[2026-06-10 16:19:01 +0000] info [cpaneld] 189.89.220.37 - banmlab "GET /login/?login_only=1&user=banmlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.117.136
country_id: 3865483
description:
[2026-06-10 16:18:58 +0000] info [cpaneld] 181.45.117.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.231.66
country_id: 3469034
description:
[2026-06-10 16:19:05 +0000] info [cpaneld] 191.242.231.66 - banmlabtg "GET /login/?login_only=1&user=banmlabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlabtg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:16:18:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908573&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-sud-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108329 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-sud-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:16:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211290&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108451 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.73.181.43
country_id: 953987
description:
165.73.181.43 - - [10/Jun/2026:16:22:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068442&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-togo-et-lunion-europeenne-passent-en-revue-le-portefeuille-3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108550 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-togo-et-lunion-europeenne-passent-en-revue-le-portefeuille-3/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.8972.1625 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.73.181.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.51.143.1
country_id: 3658394
description:
179.51.143.1 - - [10/Jun/2026:16:21:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054549&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpenurie-de-carburant-au-togo-le-ministere-du-commerce-rassure-les-consommateurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108508 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/penurie-de-carburant-au-togo-le-ministere-du-commerce-rassure-les-consommateurs/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8694.1615 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.51.143.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.177.185.253
country_id: 2802361
description:
91.177.185.253 - - [10/Jun/2026:16:23:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274716&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmedias-la-1ere-edition-de-la-semaine-de-la-presse-lancee-ce-lundi-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108613 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/medias-la-1ere-edition-de-la-semaine-de-la-presse-lancee-ce-lundi-a-lome/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2750.1263 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.177.185.253


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:16:22:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316959&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-sud-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108555 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-sud-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 16:23:12 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:16:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117929&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108645 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.217.184.170
country_id: 953987
description:
102.217.184.170 - - [10/Jun/2026:16:24:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313611&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvictoire-tomegah-dogbe-ouvre-les-travaux-de-la-premiere-conference-de-lalliance-politique-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108649 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/victoire-tomegah-dogbe-ouvre-les-travaux-de-la-premiere-conference-de-lalliance-politique-africaine/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2967.1261 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.217.184.170


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 16:23:42 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:16:25:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7325341&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flocation-habitation-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108730 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/location-habitation-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:16:25:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-nes-calcines-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108716 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-nes-calcines-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.129.254
country_id: 1880251
domain: civilemagazine.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://civilemagazine.tg/onu-bola-tinubu-points-a-retenir?amp=1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.124.62
country_id: 6252001
description:
[2026-06-10 16:27:09 +0000] info [whostmgrd] 82.40.124.62 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [10/Jun/2026:16:28:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209691&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-voici-les-grandes-decisions-du-conseil-des-ministres-du-jeudi-20-janvier-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108885 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-voici-les-grandes-decisions-du-conseil-des-ministres-du-jeudi-20-janvier-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 16:27:53 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [10/Jun/2026:16:29:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119280&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuivi-en-ligne-de-sa-demande-de-passeport-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108974 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/suivi-en-ligne-de-sa-demande-de-passeport-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:16:28:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907030&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781108922 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 16:28:56 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:16:30:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301535&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-de-rdc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109006 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-de-rdc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.228.219.250
country_id: 660013
domain: www.marketplace.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:marketplacenetma||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:16:31:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595759&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109070 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.135.105.181
country_id: 2363686
description:
79.135.105.181 - - [10/Jun/2026:16:32:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276265&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F06%252F23%252Ftogo-manifestations-publiques-lexecutif-rappelle-les-dispositions-en-vigueur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109139 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/06/23/togo-manifestations-publiques-lexecutif-rappelle-les-dispositions-en-vigueur/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.135.105.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:16:33:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000028&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dans-une-usine-chimique-en-chine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109199 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dans-une-usine-chimique-en-chine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.222.253.138
country_id: 660013
description:
2026-06-10 16:33:26 dovecot_plain authenticator failed for H=(hd99wgadcvwow9y3iq4sk5be63j) [168.222.253.138]:40047: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:16:32:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092505&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109167 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:16:35:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919319&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109318 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.239.161
country_id: 290557
description:
[2026-06-10 16:35:56 +0000] info [cpaneld] 5.107.239.161 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.151.75.34
country_id: 1210997
description:
[2026-06-10 16:36:02 +0000] info [cpaneld] 103.151.75.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.34.131
country_id: 1562822
description:
[2026-06-10 16:36:15 +0000] info [cpaneld] 14.191.34.131 - ese "GET /login/?login_only=1&user=ese&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.60.112
country_id: 99237
description:
[2026-06-10 16:36:19 +0000] info [cpaneld] 185.24.60.112 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:16:36:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646423&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrise-energetique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109392 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crise-energetique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:16:35:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211240&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109353 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.169.219.235
country_id: 6252001
description:
[2026-06-10 16:37:08 +0000] info [whostmgrd] 193.169.219.235 - 91536897 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:16:36:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791684&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuivi-en-ligne-de-sa-demande-de-passeport-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109399 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/suivi-en-ligne-de-sa-demande-de-passeport-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:16:37:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065819&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109462 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:16:37:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104926&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbulldogs-de-lady-gaga%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109469 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bulldogs-de-lady-gaga/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 16:37:42 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 102.64.154.65
country_id: 2363686
description:
Jun 10 16:39:14 ns5 pure-ftpd[959261]: (corpsdip@corpsdiplomaticnews.tg@102.64.154.65) [NOTICE] //home/ygpdcalt/public_html/wp-content/plugins/elementor-pro/assets/lib/dom-to-image/js/dom-to-image.min.js uploaded  (9450 bytes, 837.82KB/sec)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:16:39:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080423&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109555 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 11309
name: FTP Authentication success.
abuser: 102.64.154.65
country_id: 2363686
description:
Jun 10 16:39:14 ns5 pure-ftpd[959261]: (?@102.64.154.65) [INFO] corpsdip@corpsdiplomaticnews.tg is now logged in


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:16:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999720&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbulldogs-de-lady-gaga%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109528 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bulldogs-de-lady-gaga/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:16:41:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12882838&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyndicat-des-hommes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109662 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syndicat-des-hommes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:16:42:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262936&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcartes-nationales-didentite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109744 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cartes-nationales-didentite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.50.71
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-42.45.3.50.71||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:16:43:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856666&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcartes-nationales-didentite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109827 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cartes-nationales-didentite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [10/Jun/2026:16:46:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593221&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109969 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.166.26.43
country_id: 99237
description:
185.166.26.43 - - [10/Jun/2026:16:46:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133417&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcapital-humain-le-togo-note-positivement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109977 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/capital-humain-le-togo-note-positivement/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5008.1589 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.166.26.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:16:46:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394257&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrise-energetique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781109995 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crise-energetique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 16:47:50 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:16:48:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249880&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdisciplines-sportives-suspendues-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110105 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/disciplines-sportives-suspendues-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:16:47:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644843&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110055 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.18.22.6
country_id: 289688
domain: www.tps.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/tmp/backup.sql||User:xdkbrmjc||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.233.190
country_id: 6252001
description:
[2026-06-10 16:49:19 +0000] info [whostmgrd] 216.26.233.190 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:16:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670189&pdata=https%253A%252F%252Ftdn.tg%252Faccident-camion-citerne-togo-bafilo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110196 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-camion-citerne-togo-bafilo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.175
country_id: 1880251
description:
47.128.96.175 - - [10/Jun/2026:16:52:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197099&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110343 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.88.188
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/diplomatie-matthias-veltin-fait-le-point-de-la-cooperation-a-faure-gnassingbe/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 16:52:28 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.156.54.144
country_id: 2542007
description:
2026-06-10 16:52:14 dovecot_plain authenticator failed for H=([192.168.1.80]) [105.156.54.144]:50672: 535 Incorrect authentication data (set_id=2096)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [10/Jun/2026:16:52:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128519&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagba-adzowa-annita-jfl-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110362 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agba-adzowa-annita-jfl-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.55
country_id: 1880251
description:
47.128.121.55 - - [10/Jun/2026:16:53:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070997&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdecentralisation-et-service-deau-potable-et-dassainissement-le-premier-projet-pilote-mis-en-route%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110411 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/decentralisation-et-service-deau-potable-et-dassainissement-le-premier-projet-pilote-mis-en-route/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.55


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:16:54:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181209&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fagba-adzowa-annita-jfl-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110471 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/agba-adzowa-annita-jfl-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.76.248.5
country_id: 6252001
description:
[2026-06-10 16:54:40 +0000] info [cpaneld] 45.76.248.5 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.154.65
country_id: 2363686
description:
[2026-06-10 16:56:03 +0000] info [cpaneld] 102.64.154.65 NEW ygpdcalt:s2GZC9ZRsP1Yg_Xy address=102.64.154.65,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:ygpdcalt:yP9cqK5yyNtbt3za:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:16:55:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998691&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frussie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110556 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/russie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:16:56:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869511&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-dg-hotel-concorde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110580 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-dg-hotel-concorde/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [10/Jun/2026:16:59:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856037&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftamea%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110740 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tamea/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [10/Jun/2026:16:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735216&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fambassade-de-la-republique-federale-dallemagne-a-lome-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110747 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ambassade-de-la-republique-federale-dallemagne-a-lome-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [10/Jun/2026:16:59:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659542&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuivi-en-ligne-de-sa-demande-de-passeport-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110754 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/suivi-en-ligne-de-sa-demande-de-passeport-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.65.134.226
country_id: 1210997
description:
103.65.134.226 - - [10/Jun/2026:17:00:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853831&pdata=https%253A%252F%252Ftogodailynews.tg%252Findustrie-la-zone-franche-togolaise-source-demplois%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110799 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/industrie-la-zone-franche-togolaise-source-demplois/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.9008.1076 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.65.134.226


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.240.199.64
country_id: 2802361
description:
81.240.199.64 - - [10/Jun/2026:17:00:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529698&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110831 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.1915.1823 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.240.199.64


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.55
country_id: 1880251
description:
47.128.121.55 - - [10/Jun/2026:17:00:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002860&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-ltcc-en-campagne-de-sensibilisation-et-de-depistage-du-cancer-du-sein-et-du-col-de-luterus-a-dogta-lafie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110847 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-ltcc-en-campagne-de-sensibilisation-et-de-depistage-du-cancer-du-sein-et-du-col-de-luterus-a-dogta-lafie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.55


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.128
country_id: 1880251
description:
47.128.96.128 - - [10/Jun/2026:17:02:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885140&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-tomegah-dogbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110961 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-tomegah-dogbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:17:03:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882014&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmagicien-des-porte-monnaies-magiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781110979 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/magicien-des-porte-monnaies-magiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.202.186.161
country_id: 6252001
description:
[2026-06-10 17:03:11 +0000] info [whostmgrd] 64.202.186.161 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 64.202.186.161
country_id: 6252001
description:
[2026-06-10 17:03:15 +0000] info [whostmgrd] 64.202.186.161 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.58.128.108
country_id: 6252001
description:
[2026-06-10 17:03:26 +0000] info [cpaneld] 207.58.128.108 - pnls "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 207.58.128.108
country_id: 6252001
description:
[2026-06-10 17:03:28 +0000] info [cpaneld] 207.58.128.108 - pnls "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:17:03:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803719&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111015 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F3%2F%2Fpage%2F3%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [10/Jun/2026:17:03:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920857&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111030 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:17:05:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381160&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecoles-clandestines-fermees-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111107 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecoles-clandestines-fermees-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.136.114.39
country_id: 1814991
description:
152.136.114.39 - - [10/Jun/2026:17:06:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068392&pdata=http%253A%252F%252Ftogodailynews.tg%252Flonu-tourisme-offre-des-bourses-detudes-gratuites-aux-etudiants-et-professionnels-du-secteur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111170 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.136.114.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 17:05:58 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 17:07:15 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.157
country_id: 1880251
description:
47.128.96.157 - - [10/Jun/2026:17:08:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065264&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdefile-haute-couture-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111313 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/defile-haute-couture-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [10/Jun/2026:17:08:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13288813&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-variants-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-variants-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.193
country_id: 1880251
description:
47.128.96.193 - - [10/Jun/2026:17:07:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972004&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111275 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [10/Jun/2026:17:09:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844312&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111340 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:17:08:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646984&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flocation-habitation-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/location-habitation-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.18.92.158
country_id: 289688
domain: mail.clinique-ccl.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:udxjqqmt||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:17:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339988&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-de-rdc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111436 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-de-rdc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:17:11:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382694&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbem-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111475 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bem-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.176.226.67
country_id: 3996063
description:
189.176.226.67 - - [10/Jun/2026:17:12:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067048&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Finternationale%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111533 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/internationale/page/3/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.1502.1637 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.176.226.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:17:12:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158815&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdates-des-examens-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111545 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dates-des-examens-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.65.227.85
country_id: 3865483
description:
[2026-06-10 17:13:29 +0000] info [cpaneld] 45.65.227.85 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.139.61.33
country_id: 2510769
description:
[2026-06-10 17:12:50 +0000] info [cpaneld] 185.139.61.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.146.74.203
country_id: 3017382
description:
[2026-06-10 17:12:52 +0000] info [cpaneld] 176.146.74.203 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.134.237
country_id: 3865483
description:
[2026-06-10 17:13:04 +0000] info [cpaneld] 98.97.134.237 - launetog "GET /login/?login_only=1&user=launetog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.49.67.147
country_id: 290557
description:
[2026-06-10 17:13:10 +0000] info [cpaneld] 2.49.67.147 - launet "GET /login/?login_only=1&user=launet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launet (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [10/Jun/2026:17:12:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053223&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fperdiem-de-reportage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111571 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/perdiem-de-reportage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.61.208.104
country_id: 1880251
description:
[2026-06-10 17:13:00 +0000] info [cpaneld] 42.61.208.104 - launetogotg "GET /login/?login_only=1&user=launetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.158.177
country_id: 285570
description:
[2026-06-10 17:13:25 +0000] info [cpaneld] 37.231.158.177 - lau "GET /login/?login_only=1&user=lau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lau (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 17:15:21 +0000] info [webmaild] 102.176.253.226 - dgi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.22.245
country_id: 3932488
description:
[2026-06-10 17:15:44 +0000] info [cpaneld] 38.25.22.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.9.161.233
country_id: 3625428
description:
[2026-06-10 17:15:52 +0000] info [cpaneld] 66.9.161.233 - hapluciatogotg "GET /login/?login_only=1&user=hapluciatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluciatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.116.40.225
country_id: 3865483
description:
[2026-06-10 17:16:21 +0000] info [cpaneld] 181.116.40.225 - haplu "GET /login/?login_only=1&user=haplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user haplu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.35.140
country_id: 3895114
description:
[2026-06-10 17:16:36 +0000] info [cpaneld] 181.43.35.140 - hapluci1 "GET /login/?login_only=1&user=hapluci1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluci1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.64.156.11
country_id: 2017370
description:
[2026-06-10 17:15:40 +0000] info [cpaneld] 195.64.156.11 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [10/Jun/2026:17:17:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988296&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-dg-hotel-concorde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111848 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-dg-hotel-concorde/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.56.174.110
country_id: 294640
description:
[2026-06-10 17:16:39 +0000] info [cpaneld] 62.56.174.110 - hapluci2 "GET /login/?login_only=1&user=hapluci2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluci2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.127.1.85
country_id: 2542007
description:
[2026-06-10 17:18:12 +0000] info [cpaneld] 196.127.1.85 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.148.248.66
country_id: 2017370
description:
[2026-06-10 17:18:21 +0000] info [cpaneld] 46.148.248.66 - lv "GET /login/?login_only=1&user=lv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.6.91
country_id: 2017370
description:
[2026-06-10 17:18:07 +0000] info [cpaneld] 95.26.6.91 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.59.49.201
country_id: 2017370
description:
[2026-06-10 17:18:09 +0000] info [cpaneld] 5.59.49.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.7.153.148
country_id: 3469034
description:
45.7.153.148 - - [10/Jun/2026:17:19:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868913&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Froch-marc-christian-kabore%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111976 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/roch-marc-christian-kabore/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.9548.1833 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.7.153.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:17:19:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918813&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781111950 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [10/Jun/2026:17:20:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080521&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112000 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:17:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776465&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112008 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.39
country_id: 2363686
description:
[2026-06-10 17:21:32 +0000] info [webmaild] 102.212.93.39 - info@matosshop.tg "GET /cpsess3711286326/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent&login=1&post_login=72962310595814 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.51] != Current IP Address [102.212.93.39]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:17:21:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776416&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-marabouts-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112066 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-marabouts-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-10 17:22:07 +0000] info [whostmgrd] 104.28.192.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.35
country_id: 2363686
description:
[2026-06-10 17:22:01 +0000] info [webmaild] 102.212.93.35 - info@matosshop.tg "GET /cpsess3711286326/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent&login=1&post_login=72962310595814 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.61] != Current IP Address [102.212.93.35]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:17:22:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10260939&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftechniques-pour-fideliser-ses-clients%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112151 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/techniques-pour-fideliser-ses-clients/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:17:21:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727647&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fauguste-dogbo-navitrans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112111 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/auguste-dogbo-navitrans/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 17:22:01 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-10 17:22:09 +0000] info [whostmgrd] 104.28.192.94 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:17:21:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120854&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112098 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/H4ZHaQ4Sz9Q[/embed]||WPU:direct7tv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.104
country_id: 1880251
description:
47.128.121.104 - - [10/Jun/2026:17:22:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199510&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F05%252F02%252Fentreprenariat-agricole-des-jeunes-se-confient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112126 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/05/02/entreprenariat-agricole-des-jeunes-se-confient/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.104


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.49
country_id: 2363686
description:
[2026-06-10 17:22:23 +0000] info [webmaild] 102.212.93.49 - info@matosshop.tg "GET /cpsess3711286326/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent&login=1&post_login=72962310595814 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.44] != Current IP Address [102.212.93.49]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 17:21:47 +0000] info [webmaild] 102.176.253.226 - dgi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@matosshop.tg [06/10/2026:17:23:22 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@matosshop.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:17:23:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066536&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112201 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.46
country_id: 2363686
description:
[2026-06-10 17:22:36 +0000] info [webmaild] 102.212.93.46 - info@matosshop.tg "GET /cpsess3711286326/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent&login=1&post_login=72962310595814 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.35] != Current IP Address [102.212.93.46]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.212.93.45
country_id: 2363686
description:
[2026-06-10 17:22:43 +0000] info [webmaild] 102.212.93.45 - contact@matosshop.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.129.178
country_id: 2363686
description:
102.64.129.178 - - [10/Jun/2026:17:22:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012521&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F05%252F17%252Flusaid-ghsc-ta-fto-lance-le-recrutement-dun-consultant-national-pour-le-renforcement-de-la-chaine-dapprovisionnement-des-produits-de-sante%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112162 HTTP/2.0" 404 159 togomedia24.tg "-" "Mozilla/5.0 (Android 13; Mobile; SM-A356E; rv:142.0) Gecko/142.0 Firefox/142.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.129.178


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.49
country_id: 2363686
description:
[2026-06-10 17:22:49 +0000] info [webmaild] 102.212.93.49 - info@matosshop.tg "GET /cpsess4613763247/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent&login=1&post_login=72962310595814 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.51] != Current IP Address [102.212.93.49]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.212.93.58
country_id: 2363686
description:
[2026-06-10 17:23:08 +0000] info [webmaild] 102.212.93.58 - contact@matosshop.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-10 17:24:34 +0000] info [cpaneld] 185.213.83.243 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.148.199
country_id: 2363686
description:
[2026-06-10 17:25:19 +0000] info [cpaneld] 102.64.148.199 NEW muzsajnk:cmsw92_SfWvMsQqW address=102.64.148.199,app=cpaneld,creator=muzsajnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.131.1.4
country_id: 1643084
description:
27.131.1.4 - - [10/Jun/2026:17:25:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788251&pdata=https%253A%252F%252Ftogodailynews.tg%252F100-primo-entrepreneurs-bientot-outilles-pour-la-creation-de-richesses%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112320 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/100-primo-entrepreneurs-bientot-outilles-pour-la-creation-de-richesses/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.3501.1177 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.131.1.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.148.199
country_id: 2363686
description:
[2026-06-10 17:24:54 +0000] info [webmaild] 102.64.148.199 - ruben.lamboni@cecap.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:17:25:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12805222&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feau-potable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112304 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eau-potable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:17:26:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908519&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feau-potable-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112361 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eau-potable-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:17:26:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117670&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112413 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 80.252.243.102
country_id: 690791
description:
80.252.243.102 - - [10/Jun/2026:17:28:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196126&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-crise-du-cepes-quel-impact-sur-les-ecoles-esa-et-esgis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112493 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-crise-du-cepes-quel-impact-sur-les-ecoles-esa-et-esgis/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.3531.1323 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:80.252.243.102


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.120.227.17
country_id: 3895114
description:
200.120.227.17 - - [10/Jun/2026:17:29:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858406&pdata=https%253A%252F%252Ftogodailynews.tg%252F100-primo-entrepreneurs-bientot-outilles-pour-la-creation-de-richesses%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112565 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/100-primo-entrepreneurs-bientot-outilles-pour-la-creation-de-richesses/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.6163.1947 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.120.227.17


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-10 17:30:52 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.190.197.34
country_id: 3996063
description:
187.190.197.34 - - [10/Jun/2026:17:30:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868485&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcomment-concentrer-votre-energie-pour-atteindre-vos-buts%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112638 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/comment-concentrer-votre-energie-pour-atteindre-vos-buts/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.3608.1527 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.190.197.34


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 62.201.248.74
country_id: 99237
description:
62.201.248.74 - - [10/Jun/2026:17:31:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791430&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-aliments-complets-fortifient-le-corps-savourez-les%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112700 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-aliments-complets-fortifient-le-corps-savourez-les/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.9663.1522 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:62.201.248.74


plugin: cl_dos
name: DOS detection
abuser: 34.163.99.185
country_id: 3017382
description:
2026-06-10 17:31:55.064947181 +0000 GMT m=+75019.224413003 Denial of Service attack was discovered from 34.163.99.185, on port 443. Open connections: 272


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ruben.lamboni@cecap.tg [06/10/2026:17:33:17 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ruben.lamboni@cecap.tg


plugin: cl_dos
name: DOS detection
abuser: 34.163.99.185
country_id: 3017382
description:
2026-06-10 17:32:55.74091516 +0000 GMT m=+75079.900381082 Denial of Service attack was discovered from 34.163.99.185, on port 443. Open connections: 272


plugin: cl_dos
name: DOS detection
abuser: 34.163.99.185
country_id: 3017382
description:
2026-06-10 17:33:56.436276049 +0000 GMT m=+75140.595741871 Denial of Service attack was discovered from 34.163.99.185, on port 443. Open connections: 272


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.74.1.144
country_id: 290557
description:
[2026-06-10 17:34:14 +0000] info [cpaneld] 91.74.1.144 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.121.130.123
country_id: 6251999
description:
[2026-06-10 17:34:20 +0000] info [cpaneld] 216.121.130.123 - leadelle "GET /login/?login_only=1&user=leadelle&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.248.63.128
country_id: 2542007
description:
[2026-06-10 17:34:24 +0000] info [cpaneld] 41.248.63.128 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.224.111.148
country_id: 1210997
description:
[2026-06-10 17:34:29 +0000] info [cpaneld] 43.224.111.148 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.77.53.217
country_id: 99237
description:
[2026-06-10 17:34:08 +0000] info [cpaneld] 37.77.53.217 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.31.72.24
country_id: 2921044
description:
[2026-06-10 17:34:11 +0000] info [cpaneld] 94.31.72.24 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.152.236.235
country_id: 3658394
description:
[2026-06-10 17:34:32 +0000] info [cpaneld] 190.152.236.235 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: cl_dos
name: DOS detection
abuser: 34.163.99.185
country_id: 3017382
description:
2026-06-10 17:34:57.081041905 +0000 GMT m=+75201.240507827 Denial of Service attack was discovered from 34.163.99.185, on port 443. Open connections: 272


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.235.117.89
country_id: 1327865
description:
[2026-06-10 17:34:41 +0000] info [cpaneld] 180.235.117.89 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.59.178.16
country_id: 3865483
description:
200.59.178.16 - - [10/Jun/2026:17:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936021&pdata=https%253A%252F%252Ftogodailynews.tg%252Fconventions-de-financement-lue-appuie-le-togo-dans-deux-secteurs-cles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112971 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/conventions-de-financement-lue-appuie-le-togo-dans-deux-secteurs-cles/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.8169.1768 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.59.178.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.22.159
country_id: 3932488
description:
38.25.22.159 - - [10/Jun/2026:17:36:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460312&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-perspectives-de-developpement-et-les-performances-macroeconomiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781112983 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-perspectives-de-developpement-et-les-performances-macroeconomiques/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.7302.1456 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.22.159


plugin: cl_dos
name: DOS detection
abuser: 34.163.99.185
country_id: 3017382
description:
2026-06-10 17:35:57.528184455 +0000 GMT m=+75261.687650377 Denial of Service attack was discovered from 34.163.99.185, on port 443. Open connections: 272


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.203.162.120
country_id: 357994
description:
[2026-06-10 17:36:59 +0000] info [cpaneld] 156.203.162.120 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 17:36:47 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.7.15
country_id: 6252001
description:
[2026-06-10 17:37:05 +0000] info [webmaild] 65.111.7.15 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.223.57.180
country_id: 953987
description:
[2026-06-10 17:37:15 +0000] info [cpaneld] 102.223.57.180 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.153.6.84
country_id: 3625428
description:
[2026-06-10 17:37:03 +0000] info [cpaneld] 190.153.6.84 - zephyrtg "GET /login/?login_only=1&user=zephyrtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyrtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.125.171.135
country_id: 298795
description:
[2026-06-10 17:37:17 +0000] info [cpaneld] 188.125.171.135 - ze "GET /login/?login_only=1&user=ze&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ze (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.237.26.22
country_id: 3686110
description:
181.237.26.22 - - [10/Jun/2026:17:38:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868650&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffaure-gnassingbe-recoit-les-lettres-de-creance-de-gerard-mark-miles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113093 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/faure-gnassingbe-recoit-les-lettres-de-creance-de-gerard-mark-miles/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.6417.1793 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.237.26.22


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.150.101.15
country_id: 1643084
description:
Jun 10 17:40:26 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.150.101.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.101.15
country_id: 1643084
description:
2026-06-10 17:40:28 dovecot_plain authenticator failed for H=(tre3pcjb5i2q8c52wchp) [103.150.101.15]:38764: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.42.202.215
country_id: 1210997
description:
103.42.202.215 - - [10/Jun/2026:17:40:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778007&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14798&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113247 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14798" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.1048.1092 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.42.202.215


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:17:41:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119113&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-variants-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113259 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-variants-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:17:41:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788716&pdata=https%253A%252F%252Ftdn.tg%252Ftombes-profanees-cranes-ossements-voles-reseau-trafic-restes-humains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113303 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tombes-profanees-cranes-ossements-voles-reseau-trafic-restes-humains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-10 17:41:53 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:39026: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 17:41:52 +0000] info [webmaild] 102.176.253.226 - presidence@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [10/Jun/2026:17:43:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738904&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftayc-en-concert-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113380 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tayc-en-concert-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [10/Jun/2026:17:42:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527642&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecensement-electoral-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113360 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recensement-electoral-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 10 17:42:49 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [10/Jun/2026:17:42:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608133&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcan-2021-reportee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113373 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/can-2021-reportee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.6.236
country_id: 2363686
description:
2026-06-10 17:42:45 dovecot_login authenticator failed for H=(finance1) [196.171.6.236]:1306: 535 Incorrect authentication data (set_id=faustinhoinso)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 17:43:02 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.80.185.46
country_id: 3624060
description:
Jun 10 17:44:14 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.80.185.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.185.46
country_id: 3624060
description:
2026-06-10 17:44:16 dovecot_plain authenticator failed for H=(vjzrp556uxvh66utyspdgk4wafp3oz) [45.80.185.46]:10253: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:17:45:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592150&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fadkontact-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113508 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/adkontact-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-10 17:45:21 +0000] info [cpaneld] 5.230.133.117 NEW ruuwezvf:lWZ33caR4mG9pyJr address=5.230.133.117,app=cpaneld,creator=ruuwezvf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.194
country_id: 1880251
description:
47.128.96.194 - - [10/Jun/2026:17:45:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659492&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffievre-typhoide%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113554 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fievre-typhoide/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.224.84.215
country_id: 2921044
description:
Jun 10 17:46:13 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.224.84.215 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [10/Jun/2026:17:47:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867308&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoleur-de-sacs-detudiants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113631 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voleur-de-sacs-detudiants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:17:47:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791895&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaster-en-ecologie-et-de-gestion-des-ressources-fauniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113651 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/master-en-ecologie-et-de-gestion-des-ressources-fauniques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.198.48.10
country_id: 3469034
domain: libertetogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:libertepansel||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-10 17:46:59 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:17:47:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055015&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frussie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113637 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/russie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.198.48.10
country_id: 3469034
domain: libertetogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/server/.env.backup||User:libertepansel||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [10/Jun/2026:17:50:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13082005&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fimportation-de-viandes-de-volailles-surgelees-interdite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113810 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/importation-de-viandes-de-volailles-surgelees-interdite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [10/Jun/2026:17:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673107&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecomposition-de-la-ceni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113803 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recomposition-de-la-ceni/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 95.164.195.82
country_id: 6252001
description:
95.164.195.82 - - [10/Jun/2026:17:51:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234966&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113875 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.164.195.82


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.140
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-50.176.97.79.140||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 17:51:33 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.26.219
country_id: 1733045
description:
115.135.26.219 - - [10/Jun/2026:17:52:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6714013&pdata=https%253A%252F%252Ftogodailynews.tg%252Fconcours-de-recrutement-vers-le-renforcement-du-personnel-soignant%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113931 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/concours-de-recrutement-vers-le-renforcement-du-personnel-soignant/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7569.1727 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.26.219


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.189.253
country_id: 2363686
description:
[2026-06-10 17:52:30 +0000] info [webmaild] 41.207.189.253 - kakue@togointerim.net "POST /cpsess7242427945/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [41.207.189.253]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.169.39.138
country_id: 1643084
description:
103.169.39.138 - - [10/Jun/2026:17:52:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711959&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14350&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781113953 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14350" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.3974.1131 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.169.39.138


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 17:55:47 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.51.33.119
country_id: 3686110
description:
181.51.33.119 - - [10/Jun/2026:17:55:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659435&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-cybersecurite-une-priorite-absolue-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114141 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-cybersecurite-une-priorite-absolue-au-togo/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.4252.1869 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.51.33.119


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.68
country_id: 1880251
description:
47.128.121.68 - - [10/Jun/2026:17:57:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815199&pdata=http%253A%252F%252Ftogodailynews.tg%252Frevision-constitutionnelle-faure-gnassingbe-demande-une-relecture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114234 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/revision-constitutionnelle-faure-gnassingbe-demande-une-relecture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:17:57:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776472&pdata=https%253A%252F%252Ftdn.tg%252Ftogocom-jeu-tmoney%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114276 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togocom-jeu-tmoney/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 10 17:57:58 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.56.163.133
country_id: 1562822
description:
2026-06-10 17:58:11 dovecot_plain authenticator failed for H=(77jssyvg4069z2ujw5f9prism9oq58) [103.56.163.133]:49890: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.171
country_id: 1880251
description:
47.128.96.171 - - [10/Jun/2026:17:59:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118598&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcas-du-nouveau-variant-omicron-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114348 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cas-du-nouveau-variant-omicron-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-10 17:58:43 +0000] info [cpaneld] 80.248.64.198 - sikqydyz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sikqydyz (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.9.159
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/plu-enregistrement-des-parcelles-de-terrain-dans-zio-2-et-ave-2/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.224.84.215
country_id: 2921044
description:
Jun 10 17:59:45 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.224.84.215 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:17:59:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880676&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcas-du-nouveau-variant-omicron-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114387 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cas-du-nouveau-variant-omicron-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.119.136
country_id: 6252001
description:
Jun 10 17:59:50 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.119.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.9.159
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/plu-enregistrement-des-parcelles-de-terrain-dans-zio-2-et-ave-2/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:18:02:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040458&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fle-journal-de-ferdinand-ayite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/le-journal-de-ferdinand-ayite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [10/Jun/2026:18:02:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777751&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114551 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.191.138.102
country_id: 2017370
description:
[2026-06-10 18:02:43 +0000] info [cpaneld] 46.191.138.102 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.244.76.4
country_id: 6254930
description:
[2026-06-10 18:03:01 +0000] info [cpaneld] 83.244.76.4 - sah "GET /login/?login_only=1&user=sah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.211.252.130
country_id: 690791
description:
[2026-06-10 18:03:03 +0000] info [cpaneld] 195.211.252.130 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [10/Jun/2026:18:03:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871834&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-de-tivaoune-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114587 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-de-tivaoune-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.210.152.176
country_id: 2017370
description:
[2026-06-10 18:04:34 +0000] info [cpaneld] 176.210.152.176 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-10 18:03:40 +0000] info [webmaild] 196.171.122.34 - e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:18:04:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988205&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fle-journal-de-ferdinand-ayite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781114644 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/le-journal-de-ferdinand-ayite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-10 18:04:06 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.56
country_id: 3469034
description:
Jun 10 00:14:49 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.176
country_id: 2300660
description:
Jun 10 05:43:05 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-10 05:40:18 +0000] info [cpaneld] 107.174.169.229 NEW lhqeyybr:BXbfnc6OoRIHn0XX address=107.174.169.229,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jun 10 08:44:52 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 01:33:08 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-10 07:08:12 +0000] info [webmaild] 160.242.195.10 - ldaro@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.130
country_id: 690791
description:
Jun 10 00:37:01 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.80.20.86
country_id: 3595528
description:
2026-06-10 00:00:23 dovecot_login authenticator failed for H=([198.23.185.222]) [170.80.20.86]:56594: 535 Incorrect authentication data (set_id=hr@togointerim.net)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-10 05:40:08 +0000] info [cpaneld] 5.230.133.56 NEW sotragonet:7wustVJa2XCZLMyc address=5.230.133.56,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-10 06:13:24 +0000] info [cpaneld] 5.230.153.254 - mbyqtkiw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.132.20.105
country_id: 2017370
description:
2026-06-10 00:01:27 dovecot_login authenticator failed for H=([198.23.185.222]) [91.132.20.105]:3843: 535 Incorrect authentication data (set_id=clients@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jun 10 01:32:00 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.207.133
country_id: 3469034
description:
Jun 10 06:09:50 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.207.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.116
country_id: 690791
description:
Jun 10 01:15:21 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.108.23
country_id: 3175395
description:
Jun 10 01:18:32 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.108.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-10 08:34:23 +0000] info [cpaneld] 160.242.192.96 NEW vefzejhd:5X7FLz7BODkzjeGd address=160.242.192.96,app=cpaneld,creator=vefzejhd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-10 09:15:48 +0000] info [webmaild] 160.242.192.96 - informatique@butodra.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-10 00:15:36 +0000] info [cpaneld] 5.230.153.114 NEW galsync:EaNg142p44mOjsy3 address=5.230.153.114,app=cpaneld,creator=galsync,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.33
country_id: 6252001
description:
[2026-06-10 06:12:53 +0000] info [cpaneld] 64.44.59.33 - ruuwezvf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.156
country_id: 2635167
description:
[2026-06-10 04:14:39 +0000] info [cpaneld] 5.230.133.156 NEW hnefmnqz:J_KuazxEQyebzA_T address=5.230.133.156,app=cpaneld,creator=hnefmnqz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.130
country_id: 933860
description:
Jun 10 07:53:59 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-10 09:04:26 +0000] info [cpaneld] 5.230.153.179 NEW mipbtgnb:LgBSdrMJiPv0Su3d address=5.230.153.179,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-10 07:31:40 +0000] info [cpaneld] 5.230.153.254 NEW aopsacai:kkEkIqfoZgxYX1wS address=5.230.153.254,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.11.38
country_id: 2921044
description:
[2026-06-10 08:49:26 +0000] info [whostmgrd] 178.254.11.38 - root "GET /cpsess7723016001/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun 10 04:39:28 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.138
country_id: 3686110
description:
Jun 10 01:33:26 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.113
country_id: 3469034
description:
Jun 10 01:07:26 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 10 04:39:22 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-10 02:03:14 +0000] info [cpaneld] 107.174.169.209 NEW hgfdcvbnk:ZJr0_H8gLnMqxv97 address=107.174.169.209,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jun 10 08:20:02 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 10 08:45:35 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 10 08:44:54 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-10 04:56:09 +0000] info [cpaneld] 78.135.61.227 - ifxmoxbf "GET /assets/brand/favicon.ico HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [10/Jun/2026:00:27:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197150&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecojogging%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781051268 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecojogging/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-10 06:12:58 +0000] info [cpaneld] 5.230.133.152 - qfaclpeg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.154
country_id: 3077311
description:
Jun 10 02:03:43 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-10 00:29:02 +0000] info [cpaneld] 5.230.153.167 NEW cinemafreenetmas:0zyOteXHOQ5xIMc3 address=5.230.153.167,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-10 04:14:31 +0000] info [cpaneld] 5.230.133.74 NEW lhqeyybr:BtLV_tGOZSZ2cUMA address=5.230.133.74,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-10 05:40:10 +0000] info [cpaneld] 134.195.83.207 NEW jdzxeovw:XvZIMEh_eQMlThaU address=134.195.83.207,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-10 07:02:25 +0000] info [cpaneld] 5.230.153.156 NEW togorer:IrYAjOl47DWa94y2 address=5.230.153.156,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.50
country_id: 3469034
description:
Jun 10 05:49:04 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.29
country_id: 1269750
description:
Jun 10 01:07:05 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-10 04:14:25 +0000] info [cpaneld] 5.230.153.169 NEW wgqhqbem:cXZbSNwGVR5gTQ7T address=5.230.153.169,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-06-10 09:24:48 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:y2V5jTUbtyab_FJh address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 10 00:08:46 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.246
country_id: 2363686
description:
2026-06-10 00:23:35 dovecot_plain authenticator failed for H=ns5mail.netmaster.tg (ns5.netmaster.tg) [154.70.82.246]:46606: 535 Incorrect authentication data (set_id=edy.fatigba@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jun 10 02:14:15 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.215.235.84
country_id: 1831722
description:
[2026-06-10 00:10:07 +0000] info [cpaneld] 188.215.235.84 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-10 04:20:42 +0000] info [cpaneld] 134.195.82.55 NEW mbyqtkiw:rC9yRR9WGAeGXe7H address=134.195.82.55,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-10 05:22:59 +0000] info [whostmgrd] 45.198.224.5 - root "GET /cpsess6854447594/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.147
country_id: 3175395
description:
Jun 10 02:27:00 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.115
country_id: 690791
description:
Jun 10 04:30:11 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.192.96
country_id: 2363686
description:
[2026-06-10 08:28:40 +0000] info [cpaneld] 160.242.192.96 - vefzejhd "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.122.223
country_id: 1694008
description:
2026-06-10 00:00:53 dovecot_login authenticator failed for H=([198.23.185.222]) [202.137.122.223]:49854: 535 Incorrect authentication data (set_id=soporte@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.235.31.47
country_id: 6252001
description:
Jun 10 07:03:57 ns5 auth[209857]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.235.31.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 10 08:45:23 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.8.179
country_id: 3077311
description:
Jun 10 00:26:29 ns5 auth[44136]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.8.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 193.32.248.156
country_id: 2921044
description:
[2026-06-10 00:27:44 +0000] info [cpaneld] 193.32.248.156 NEW galsync:RU7HG65yHWwtCGV3 address=193.32.248.156,app=cpaneld,creator=galsync,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.203.237.116
country_id: 2017370
description:
2026-06-10 12:41:01 dovecot_login authenticator failed for H=([198.23.185.222]) [91.203.237.116]:35244: 535 Incorrect authentication data (set_id=comercial@dagl.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.43.125.177
country_id: 3895114
description:
2026-06-10 14:14:31 dovecot_login authenticator failed for H=([198.23.185.222]) [181.43.125.177]:5882: 535 Incorrect authentication data (set_id=comercial@tchambainvest.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.122
country_id: 3175395
description:
Jun 10 09:36:50 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.224.228.221
country_id: 102358
description:
2026-06-10 12:39:44 dovecot_login authenticator failed for H=([198.23.185.222]) [176.224.228.221]:56990: 535 Incorrect authentication data (set_id=marketing@dagl.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.83
country_id: 690791
description:
Jun 10 13:29:58 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.148.180.224
country_id: 690791
description:
2026-06-10 11:31:07 dovecot_login authenticator failed for H=([198.23.185.222]) [46.148.180.224]:50406: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.251.94.92
country_id: 2750405
description:
2026-06-10 11:28:46 dovecot_login authenticator failed for H=([198.23.185.222]) [62.251.94.92]:34418: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.71.243.57
country_id: 3017382
description:
2026-06-10 14:15:25 dovecot_login authenticator failed for H=57.243.71.86.rev.sfr.net ([198.23.185.222]) [86.71.243.57]:37814: 535 Incorrect authentication data (set_id=suporte@tchambainvest.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-10 10:02:18 +0000] info [webmaild] 154.70.80.74 - mlapa.eyram@cloud-et-racks.tg "GET /cpsess0526772435/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=8&_mbox=INBOX&_action=show HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-10 10:28:50 +0000] info [cpaneld] 5.230.133.154 NEW vejjghdd:1bemfdpG2mbZxSP8 address=5.230.133.154,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.211.168.154
country_id: 2363686
description:
[2026-06-10 10:03:19 +0000] info [cpaneld] 102.211.168.154 NEW fhmqxwla:jzjlX1zq7pAh3WqC address=102.211.168.154,app=cpaneld,creator=fhmqxwla,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.222.116.183
country_id: 2017370
description:
2026-06-10 11:30:14 dovecot_login authenticator failed for H=([198.23.185.222]) [77.222.116.183]:54634: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.6.236
country_id: 2363686
description:
2026-06-10 12:16:58 dovecot_login authenticator failed for H=(finance1) [196.171.6.236]:59643: 535 Incorrect authentication data (set_id=faustinhoinso)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.6.7.8
country_id: 3932488
description:
2026-06-10 12:42:55 dovecot_login authenticator failed for H=([198.23.185.222]) [179.6.7.8]:57427: 535 Incorrect authentication data (set_id=ventas@dagl.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.2.82
country_id: 2363686
description:
[2026-06-10 15:20:20 +0000] info [cpaneld] 196.170.2.82 NEW verfghix:40nlAJJBTucVpyUd address=196.170.2.82,app=cpaneld,creator=verfghix,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.6.236
country_id: 2363686
description:
[2026-06-10 10:36:19 +0000] info [cpaneld] 196.171.6.236 NEW qgqjistz:94Jx3wXUlU9iSbCk address=196.171.6.236,app=cpaneld,creator=qgqjistz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.152.167
country_id: 3017382
description:
[2026-06-10 13:07:55 +0000] info [cpaneld] 161.97.152.167 - perfectl "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.156.106.74
country_id: 3439705
description:
2026-06-10 11:29:59 dovecot_login authenticator failed for H=([198.23.185.222]) [152.156.106.74]:17365: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.168.76.178
country_id: 1733045
description:
2026-06-10 12:42:24 dovecot_login authenticator failed for H=([198.23.185.222]) [202.168.76.178]:36869: 535 Incorrect authentication data (set_id=office@dagl.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-10 10:54:29 +0000] info [cpaneld] 5.231.255.174 NEW frtwilql:MriRFjTtIFywrJsi address=5.231.255.174,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.50.23.247
country_id: 2464461
description:
2026-06-10 13:37:26 dovecot_login authenticator failed for H=([198.23.185.222]) [165.50.23.247]:60902: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.105.222
country_id: 3996063
description:
2026-06-10 13:38:50 dovecot_login authenticator failed for H=fixed-189-203-105-222.totalplay.net ([198.23.185.222]) [189.203.105.222]:6095: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.64.255
country_id: 3996063
description:
2026-06-10 14:12:56 dovecot_login authenticator failed for H=fixed-187-189-64-255.totalplay.net ([198.23.185.222]) [187.189.64.255]:12991: 535 Incorrect authentication data (set_id=support@tchambainvest.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.27.192.140
country_id: 2661886
description:
[2026-06-10 11:42:49 +0000] info [cpaneld] 193.27.192.140 - mediatopnews "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnews (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.126
country_id: 2363686
description:
[2026-06-10 11:34:02 +0000] info [cpaneld] 196.168.194.126 - gemwjxuz "GET /cpsess4381008491/frontend/jupiter/wp-toolkit/index.live.php HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.252
country_id: 1269750
description:
Jun 10 10:17:24 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.156.5
country_id: 690791
description:
Jun 10 12:23:04 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.156.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jun 10 10:30:04 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.235.139.207
country_id: 102358
description:
2026-06-10 11:30:44 dovecot_login authenticator failed for H=([198.23.185.222]) [51.235.139.207]:40144: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.72
country_id: 2363686
description:
2026-06-10 13:06:21 dovecot_login authenticator failed for H=(CanonD1D677.CFMI.com) [160.242.192.72]:54153: 535 Incorrect authentication data (set_id=cfmiscan@cfmi.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.24
country_id: 3175395
description:
Jun 10 13:24:22 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-10 10:21:55 +0000] info [cpaneld] 80.248.64.198 NEW conforwellty:UDfnFuIgWv6DSKG0 address=80.248.64.198,app=cpaneld,creator=conforwellty,method=handle_form_login,path=loadsession:conforwellty:9BzKw59i2uWoVur9,possessed=1,possessor=root


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-10 12:39:36 +0000] info [cpaneld] 107.175.5.84 NEW marketplacenetma:5yuJJnGAIHlr3NtZ address=107.175.5.84,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-10 11:17:57 +0000] info [cpaneld] 80.248.64.198 - fwitcplx "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fwitcplx (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.29.180.141
country_id: 3686110
description:
2026-06-10 14:13:59 dovecot_login authenticator failed for H=dynamic-186-29-180-141.dynamic.etb.net.co ([198.23.185.222]) [186.29.180.141]:3528: 535 Incorrect authentication data (set_id=contacto@tchambainvest.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.210.229
country_id: 1512440
description:
2026-06-10 12:08:34 H=([95.214.210.229]) [95.214.210.229]:10789 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-10 10:15:04 +0000] info [webmaild] 160.242.195.10 - sadedjouma@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.252.59.228
country_id: 2921044
description:
2026-06-10 12:40:43 dovecot_login authenticator failed for H=dyndsl-092-252-059-228.ewe-ip-backbone.de ([198.23.185.222]) [92.252.59.228]:62134: 535 Incorrect authentication data (set_id=financeiro@dagl.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.211.168.118
country_id: 2363686
description:
[2026-06-10 11:56:05 +0000] info [webmaild] 102.211.168.118 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.34.195
country_id: 2017370
description:
2026-06-10 13:36:53 dovecot_login authenticator failed for H=([198.23.185.222]) [5.206.34.195]:45344: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.6.236
country_id: 2363686
description:
[2026-06-10 11:31:04 +0000] info [cpaneld] 196.171.6.236 - qgqjistz "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 12:19:57 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.217.88.92
country_id: 2542007
description:
2026-06-10 11:29:24 dovecot_login authenticator failed for H=adsl196-92-88-217-196.adsl196-11.iam.net.ma ([198.23.185.222]) [196.217.88.92]:42062: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-10 10:21:55 +0000] info [whostmgrd] 80.248.64.198 NEW conforwellty:9BzKw59i2uWoVur9 address=80.248.64.198,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-10 11:39:29 +0000] info [cpaneld] 80.248.64.198 - vtytmwmz "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.163
country_id: 3469034
description:
Jun 10 12:39:53 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.83.33
country_id: 3865483
description:
2026-06-10 14:14:15 dovecot_login authenticator failed for H=([198.23.185.222]) [38.156.83.33]:33264: 535 Incorrect authentication data (set_id=financeiro@tchambainvest.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-10 12:41:23 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.12
country_id: 798544
description:
Jun 10 09:50:58 ns5 auth[486657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.21
country_id: 798544
description:
Jun 10 12:41:51 ns5 auth[698134]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.227.50.134
country_id: 3895114
description:
2026-06-10 12:38:56 dovecot_login authenticator failed for H=([198.23.185.222]) [45.227.50.134]:55440: 535 Incorrect authentication data (set_id=info@dagl.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-10 11:03:07 +0000] info [cpaneld] 80.248.64.198 - qvyovutb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user qvyovutb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.244.154.223
country_id: 99237
description:
2026-06-10 12:40:14 dovecot_login authenticator failed for H=([198.23.185.222]) [185.244.154.223]:36614: 535 Incorrect authentication data (set_id=contato@dagl.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.195
country_id: 3469034
description:
Jun 10 13:38:32 ns5 auth[788831]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.169.155.229
country_id: 3865483
description:
[2026-06-10 18:04:44 +0000] info [cpaneld] 152.169.155.229 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.76.248.5
country_id: 6252001
description:
[2026-06-10 16:54:43 +0000] info [cpaneld] 45.76.248.5 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-10 19:20:25 +0000] info [cpaneld] 185.194.218.134 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 19:21:44 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53916: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-10 16:50:16 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 10 19:20:56 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 19:22:14 +0000] info [cpaneld] 37.114.148.247 - LWS-531391 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user LWS-531391 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.129.21.193
country_id: 1831722
description:
[2026-06-10 19:21:08 +0000] info [cpaneld] 150.129.21.193 - 2002281 "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.31.34.3
country_id: 2635167
description:
[2026-06-10 18:04:36 +0000] info [cpaneld] 86.31.34.3 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.19.50.120
country_id: 2017370
description:
Jun 10 19:22:15 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.19.50.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.19.50.120
country_id: 2017370
description:
2026-06-10 19:22:17 dovecot_plain authenticator failed for H=(ac1wwjxox19knu5x) [195.19.50.120]:61970: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [10/Jun/2026:19:23:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932123&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-cils%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119396 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-cils/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:19:24:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9609066&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdisciplines-sportives-suspendues-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119440 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/disciplines-sportives-suspendues-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.197
country_id: 1880251
description:
47.128.96.197 - - [10/Jun/2026:19:23:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803876&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgnassingbe-eyadema%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119404 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gnassingbe-eyadema/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 19:24:57 +0000] info [cpaneld] 37.114.148.247 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:19:24:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7195847&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsociete-specialisee-dans-le-financement-du-secteur-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119490 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/societe-specialisee-dans-le-financement-du-secteur-agricole/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 19:25:34 +0000] info [cpaneld] 37.114.148.247 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:19:26:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343180&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-resultats-elections-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119573 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-resultats-elections-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 10 19:25:35 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:19:26:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922201&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119566 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:26:54 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 185.177.72.13
country_id: 3017382
domain: sysadmin.devbase.tg
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.180
country_id: 2635167
domain: scafricaplc.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zauwogvk/public_html/.796020277476593.php||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.13
country_id: 3017382
domain: sysadmin.devbase.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app_dev.php/_profiler/open?file=app/.env||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.126.56.22
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:109e25b3b4e00544356c041a72998d3406c4a07b||Title:dkj65jx2gehu1dzop||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:26:56 dovecot_login authenticator failed for H=(USzD7Si) [165.154.135.32]:55511: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13335,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260609_1503521-1024x577.jpg\" alt=\"\" class=\"wp-image-13335\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong><em>le centre de lecture et d\xe2\x80\x99animation culturelle (clac) d\xe2\x80\x99an\xc3\xa9ho a eu l\xe2\x80\x99honneur de recevoir le mardi 9 juin, la visite de mme sandrine platteau, ambassadrice du royaume de belgique pr\xc3\xa8s le togo et le b\xc3\xa9nin. \xc2\xa0</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.177.72.13
country_id: 3017382
domain: sysadmin.devbase.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/opt/mailcow-dockerized/mailcow.conf||User:wungkxry||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jun 10 19:27:16 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [10/Jun/2026:19:27:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039644&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119641 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:19:27:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199724&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119649 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:19:27:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050084&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119661 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-affaire-de-pretre-catholique-reconverti-au-culte-vodou-voici-ce-qui-sest-reellement-passe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:27:15 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:27:17 dovecot_login authenticator failed for H=(g3AVqlvEt) [165.154.135.32]:59269: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:19:28:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885145&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fecoles-clandestines-fermees-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119697 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ecoles-clandestines-fermees-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:28:31 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.104.111.103
country_id: 2017370
description:
89.104.111.103 - - [10/Jun/2026:19:28:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251670&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14532&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119705 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14532" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.2021.1894 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.104.111.103


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:28:33 dovecot_login authenticator failed for H=(CNsgr9T4F) [165.154.135.32]:61881: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:29:28 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:19:29:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527898&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpratique-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119762 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pratique-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:29:30 dovecot_login authenticator failed for H=(YANcxu) [165.154.135.32]:64537: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:19:29:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604188&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-de-minamata%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119767 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-de-minamata/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:30:27 dovecot_login authenticator failed for H=(PT9P36OW) [165.154.135.32]:58742: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 19:30:36 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49180: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:30:46 dovecot_login authenticator failed for H=(9mvdstUWn) [165.154.135.32]:60799: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [10/Jun/2026:19:31:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777035&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcomment-suivre-gratuitement-le-match-senegal-togo-sur-son-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119875 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/comment-suivre-gratuitement-le-match-senegal-togo-sur-son-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:30:25 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:19:31:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119906 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [10/Jun/2026:19:32:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6779032&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcabinet-aka-financial-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119936 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cabinet-aka-financial-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:31:22 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:19:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936029&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcalvaire-des-usagers-de-la-route-de-segbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119899 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/calvaire-des-usagers-de-la-route-de-segbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:31:24 dovecot_login authenticator failed for H=(2h5PuhpGQ) [165.154.135.32]:58957: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [10/Jun/2026:19:31:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961646&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclimat-des-affaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119882 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/climat-des-affaires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.135.32
country_id: 6252001
description:
Jun 10 19:32:19 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.135.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.135.32
country_id: 6252001
description:
2026-06-10 19:32:21 dovecot_login authenticator failed for H=(gd4Sab8R6e) [165.154.135.32]:55377: 535 Incorrect authentication data (set_id=aisgroup-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:19:32:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723430&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrash-dun-avion-en-chine-avec-132-passagers-a-bord%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119942 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crash-dun-avion-en-chine-avec-132-passagers-a-bord/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:19:33:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997655&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffinale-de-la-coupe-du-monde-fifa-qatar-2022%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119982 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/finale-de-la-coupe-du-monde-fifa-qatar-2022/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:19:33:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065048&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-sud-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781119993 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-sud-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 19:33:51 +0000] info [cpaneld] 37.114.148.247 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:19:33:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051884&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftelevision-togolaise-tvt%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120037 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/television-togolaise-tvt/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 10 19:34:31 ns5 pure-ftpd[21486]: (?@47.84.199.24) [WARNING] Authentication failed for user [tresorerie]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [10/Jun/2026:19:34:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997868&pdata=https%253A%252F%252Ftdn.tg%252Faccident-camion-citerne-togo-bafilo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120075 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-camion-citerne-togo-bafilo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 19:35:02 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.159
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:23.229.126.159||TA:23.229.126.159||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:19:34:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462108&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-dun-maire-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120081 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-dun-maire-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [10/Jun/2026:19:35:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804396&pdata=https%253A%252F%252Ftdn.tg%252Fbceao-recrute-19-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120113 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/bceao-recrute-19-postes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.173
country_id: 1880251
description:
47.128.96.173 - - [10/Jun/2026:19:35:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723173&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F10-bienfaits-yaourt%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120158 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/10-bienfaits-yaourt/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.121
country_id: 1880251
description:
47.128.96.121 - - [10/Jun/2026:19:36:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134486&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120165 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [10/Jun/2026:19:35:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248747&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120127 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.78.144.91
country_id: 3469034
description:
[2026-06-10 19:36:35 +0000] info [cpaneld] 170.78.144.91 - vitrine1 "GET /login/?login_only=1&user=vitrine1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine1 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [10/Jun/2026:19:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132628&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dans-une-usine-chimique-en-chine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120227 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dans-une-usine-chimique-en-chine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-10 19:36:22 +0000] info [cpaneld] 107.175.5.140 NEW togorer:WdMPvp2a0Gbsf7d9 address=107.175.5.140,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.72.82
country_id: 3469034
description:
[2026-06-10 19:36:30 +0000] info [cpaneld] 45.181.72.82 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.74.25
country_id: 3658394
description:
[2026-06-10 19:36:19 +0000] info [cpaneld] 45.162.74.25 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.235.153
country_id: 3865483
description:
[2026-06-10 19:36:24 +0000] info [cpaneld] 131.0.235.153 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [10/Jun/2026:19:37:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788764&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F11e-edition-togocom-fimo228%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120265 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/11e-edition-togocom-fimo228/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:19:37:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842012&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmil%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120272 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mil/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 10 19:39:08 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:19:39:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7127661&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogocom-fimo228-11e-edition%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120348 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togocom-fimo228-11e-edition/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:19:38:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12947861&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprestation-de-serment-dalassane-ouattara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120297 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prestation-de-serment-dalassane-ouattara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 10 19:39:43 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:19:40:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853573&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120399 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:19:40:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262629&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexamens-du-baccalaureat-deuxieme-partie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120400 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/examens-du-baccalaureat-deuxieme-partie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [10/Jun/2026:19:39:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103593&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhachalu-hundessa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120380 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hachalu-hundessa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [10/Jun/2026:19:40:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841706&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120432 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [10/Jun/2026:19:41:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6840933&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuivi-en-ligne-de-sa-demande-de-passeport-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120462 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/suivi-en-ligne-de-sa-demande-de-passeport-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [10/Jun/2026:19:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725800&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecensement-electoral-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120469 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recensement-electoral-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:19:42:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377506&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fattaque-terroriste-de-kafolo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120526 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/attaque-terroriste-de-kafolo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [10/Jun/2026:19:41:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671268&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fugp-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120488 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ugp-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.163.8.156
country_id: 798544
description:
Jun 10 19:41:34 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.163.8.156 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:19:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367829&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fministere-de-leducation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120507 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ministere-de-leducation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.68
country_id: 2395170
description:
Jun 10 19:41:56 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.68 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.179
country_id: 1880251
description:
47.128.96.179 - - [10/Jun/2026:19:42:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920545&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feleves-de-classe-de-passage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120558 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eleves-de-classe-de-passage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.179


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.222.187.184
country_id: 2750405
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.222.187.184||TA:104.222.187.184||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:19:43:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657384&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F12%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120606 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/12/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:19:44:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9789854&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbem-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120646 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bem-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [10/Jun/2026:19:43:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131348&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120627 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.104.136.171
country_id: 2017370
description:
2026-06-10 19:44:03 H=([176.104.136.171]) [176.104.136.171]:59269 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 19:43:26 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.43
country_id: 3865483
description:
Jun 10 19:44:24 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:19:44:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004489&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpass-vaccinal-obligatoire-avant-lacces-aux-banques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120678 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pass-vaccinal-obligatoire-avant-lacces-aux-banques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [10/Jun/2026:19:45:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661537&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Foradys-group-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120703 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/oradys-group-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 200.125.170.156
country_id: 3508796
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:86792.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f734fa432871bb2e9b75df459772a442a2b71ed8||Title:cedcjfebqvlxh4d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 200.125.170.156
country_id: 3508796
domain: sp-eau.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.6132232199743666||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:19:45:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932582&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcndh-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120754 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cndh-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jun 10 19:46:02 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.186
country_id: 1880251
description:
47.128.96.186 - - [10/Jun/2026:19:45:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791430&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcedeao-coup-detat-guinee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120722 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cedeao-coup-detat-guinee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.82.48.234
country_id: 3469034
description:
170.82.48.234 - - [10/Jun/2026:19:46:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842823&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcovid-19-64-togolais-de-lespace-schengen-rapatries-ce-10-juillet%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120760 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/covid-19-64-togolais-de-lespace-schengen-rapatries-ce-10-juillet/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.3872.1871 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.82.48.234


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [10/Jun/2026:19:47:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949608&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvente-illiciteme-de-poches-de-sang-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120830 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vente-illiciteme-de-poches-de-sang-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [10/Jun/2026:19:47:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405782&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120868 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [10/Jun/2026:19:47:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673324&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsyndicat-des-hommes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120875 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/syndicat-des-hommes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:19:47:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067041&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrutement-consultant%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120837 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrutement-consultant/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.16
country_id: 1880251
description:
47.128.96.16 - - [10/Jun/2026:19:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908820&pdata=https%253A%252F%252Ftdn.tg%252Fmercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120906 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/mercato-thiago-sylva-a-chelsea-pour-une-nouvelle-aventure/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [10/Jun/2026:19:48:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261102&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-1000-jeunes-pour-la-pia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120938 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-1000-jeunes-pour-la-pia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:19:48:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604391&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdoctorat-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781120913 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/doctorat-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 19:49:48 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [10/Jun/2026:19:50:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067929&pdata=https%253A%252F%252Ftdn.tg%252Fmadame-monsieur-saison-3-serie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121034 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/madame-monsieur-saison-3-serie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:19:50:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115674&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fweek-end-prolonge-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121058 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/week-end-prolonge-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [10/Jun/2026:19:51:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068651&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fadkontact-togo-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121064 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/adkontact-togo-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:19:51:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659224&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrute-comptable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121071 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrute-comptable/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:19:51:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872558&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fglobal-trade-corporation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121083 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/global-trade-corporation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 19:52:10 +0000] info [cpaneld] 37.114.148.247 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [10/Jun/2026:19:53:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249253&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-assassine-a-adakpame%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121203 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-assassine-a-adakpame/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 10 19:53:50 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [10/Jun/2026:19:54:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313255&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121260 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-casier-judiciaire-informatise-voici-le-site-a-utiliser-pour-faire-sa-demande-en-ligne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.228.130
country_id: 1512440
description:
2026-06-10 19:54:31 H=([188.113.228.130]) [188.113.228.130]:46193 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.200.124.89
country_id: 1861060
domain: sproca.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:sprocaadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [10/Jun/2026:19:56:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12873327&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftayc-en-concert-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121400 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tayc-en-concert-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:19:56:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607110&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhigh-life%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121406 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/high-life/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 19:57:43 +0000] info [cpaneld] 37.114.148.247 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.38.95.14
country_id: 953987
description:
102.38.95.14 - - [10/Jun/2026:20:01:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883397&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmaster-en-ecologie-et-de-gestion-des-ressources-fauniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121564 HTTP/2.0" 404 159 tdn.tg "https://www.yandex.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/124.0  Mobile/15E148 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.38.95.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:01:58 +0000] info [cpaneld] 37.114.148.247 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [10/Jun/2026:20:03:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145706&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%252Fpage%252F12%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781121788 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F12%2F/page/12/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 20:03:47 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 20:04:33 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:06:32 +0000] info [cpaneld] 37.114.148.247 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.98.16.143
country_id: 290557
description:
2026-06-10 20:07:08 dovecot_plain authenticator failed for H=bba-92-98-16-143.alshamil.net.ae ([69.172.210.47]) [92.98.16.143]:43034: 535 Incorrect authentication data (set_id=admin@devbase.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.54.251
country_id: 6252001
description:
Jun 10 20:07:59 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.54.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.37.68
country_id: 690791
description:
2026-06-10 20:08:03 dovecot_plain authenticator failed for H=([69.172.210.47]) [195.62.37.68]:50802: 535 Incorrect authentication data (set_id=contact@devbase.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.133.149
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">il est temps de dire les choses avec franchise : aucun pays ne peut se d\xc3\xa9velopper durablement lorsque la haine, la jalousie, la m\xc3\xa9disance et les r\xc3\xa8glements de comptes prennent le pas sur l'int\xc3\xa9r\xc3\xaat g\xc3\xa9n\xc3\xa9ral.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">depuis trop longtemps, nos espaces politiques et publics ou les m\xc3\xa9dias,\xc2\xa0 r\xc3\xa9seaux sociaux, plateformes wathsap etc. sont pollu\xc3\xa9s par des querelles de personnes, des rivalit\xc3\xa9s de leadership, des campagnes de d\xc3\xa9nigrement et des luttes d'ego qui d\xc3\xa9tournent l'attention des v\xc3\xa9ritables d\xc3\xa9fis auxquels nos populations sont confront\xc3\xa9es.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">pendant que certains consacrent leur \xc3\xa9nergie \xc3\xa0 discr\xc3\xa9diter leurs compatriotes, \xc3\xa0 semer la division ou \xc3\xa0 alimenter les ranc\xc5\x93urs, les probl\xc3\xa8mes r\xc3\xa9els de d\xc3\xa9veloppement, d'emploi, d'\xc3\xa9ducation, de sant\xc3\xa9 et de gouvernance continuent de s'aggraver.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">l'histoire enseigne pourtant une v\xc3\xa9rit\xc3\xa9 simple : <strong>aucun peuple n'a conquis sa libert\xc3\xa9, consolid\xc3\xa9 sa d\xc3\xa9mocratie ou acc\xc3\xa9l\xc3\xa9r\xc3\xa9 son d\xc3\xa9veloppement dans un climat de haine permanente.</strong></span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les grandes avanc\xc3\xa9es collectives ont toujours \xc3\xa9t\xc3\xa9 le fruit de la capacit\xc3\xa9 des femmes, des jeunes et des hommes \xc3\xa0 d\xc3\xa9passer leurs diff\xc3\xa9rences pour servir une cause plus grande qu'eux-m\xc3\xaames.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">la diversit\xc3\xa9 des opinions est une richesse. le d\xc3\xa9bat contradictoire est une n\xc3\xa9cessit\xc3\xa9 d\xc3\xa9mocratique. mais la m\xc3\xa9chancet\xc3\xa9 gratuite, la jalousie destructrice, la mauvaise foi et la haine politique constituent des poisons qui fragilisent les nations, d\xc3\xa9truisent la confiance entre les citoyens et offrent un terrain fertile \xc3\xa0 l'immobilisme.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">le v\xc3\xa9ritable patriotisme ne consiste pas \xc3\xa0 souhaiter l'\xc3\xa9chec de son adversaire politique.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">il consiste \xc3\xa0 souhaiter la r\xc3\xa9ussite de son pays, m\xc3\xaame lorsque ceux qui gouvernent ou ceux qui s'opposent ne partagent pas nos convictions.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">une nation progresse lorsque ses citoyens apprennent \xc3\xa0 combattre les id\xc3\xa9es qu'ils jugent mauvaises sans pour autant d\xc3\xa9shumaniser ceux qui les portent.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\"><strong>nous devons collectivement refuser cette culture de l'invective permanente qui transforme les divergences politiques en haines personnelles</strong>. nous devons apprendre \xc3\xa0 critiquer sans diffamer, \xc3\xa0 nous opposer sans d\xc3\xa9truire, \xc3\xa0 rivaliser sans nous d\xc3\xa9tester.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">aucun r\xc3\xa9gime, aucune opposition, aucune organisation politique ne pourra r\xc3\xa9pondre aux aspirations profondes du peuple si les ambitions personnelles continuent de primer sur l'int\xc3\xa9r\xc3\xaat national.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les divisions artificielles, les guerres d'ego et les calculs individuels ont d\xc3\xa9j\xc3\xa0 fait perdre trop de temps \xc3\xa0 nos peuples.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">l'heure n'est plus \xc3\xa0 la haine. l'heure est \xc3\xa0 la responsabilit\xc3\xa9. car un pays ne tombe pas seulement \xc3\xa0 cause de ses adversaires ; <strong>il s'affaiblit surtout lorsque ses propres filles et fils consacrent plus d'\xc3\xa9nergie \xc3\xa0 se combattre entre eux qu'\xc3\xa0 construire ensemble son avenir.</strong></span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">la plus grande victoire politique n'est pas la d\xc3\xa9faite d'un rival.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">la plus grande victoire politique est la victoire du bien commun sur les int\xc3\xa9r\xc3\xaats particuliers, de la sagesse sur les passions, et de l'unit\xc3\xa9 nationale sur les divisions st\xc3\xa9riles.</span>\r\n\r\n<strong><span style=\"font-family: verdana, geneva, sans-serif;\">dr tindjo richard</span></strong>\r\n\r\n<strong><span style=\"font-family: verdana, geneva, sans-serif;\">vice-pr\xc3\xa9sident des d\xc3\xa9mocrates socialistes africains (dsa)</span></strong>\r\n\r\n&nbsp;||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.17.154
country_id: 6252001
description:
[2026-06-10 20:08:16 +0000] info [cpaneld] 45.38.17.154 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.108.61.70
country_id: 3469034
description:
2026-06-10 20:07:26 dovecot_plain authenticator failed for H=([69.172.210.47]) [179.108.61.70]:20639: 535 Incorrect authentication data (set_id=support@devbase.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.120.38
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.247.120.38||TA:151.247.120.38||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.6.103.43
country_id: 6254930
description:
2026-06-10 20:07:45 dovecot_plain authenticator failed for H=([69.172.210.47]) [213.6.103.43]:59162: 535 Incorrect authentication data (set_id=marketing@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.183.19.223
country_id: 2017370
description:
2026-06-10 20:09:05 dovecot_plain authenticator failed for H=([69.172.210.47]) [62.183.19.223]:12039: 535 Incorrect authentication data (set_id=comercial@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.143.221.189
country_id: 2542007
description:
2026-06-10 20:08:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [41.143.221.189]:36490: 535 Incorrect authentication data (set_id=contato@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.179.44.170
country_id: 3017382
description:
2026-06-10 20:08:34 dovecot_plain authenticator failed for H=176-179-44-170.abo.bbox.fr ([69.172.210.47]) [176.179.44.170]:47464: 535 Incorrect authentication data (set_id=contacto@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.179.161.11
country_id: 2542007
description:
2026-06-10 20:08:48 dovecot_plain authenticator failed for H=([69.172.210.47]) [160.179.161.11]:50756: 535 Incorrect authentication data (set_id=financeiro@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.119.0.37
country_id: 2017370
description:
2026-06-10 20:10:13 dovecot_plain authenticator failed for H=([69.172.210.47]) [185.119.0.37]:9713: 535 Incorrect authentication data (set_id=office@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.65.1.183
country_id: 630336
description:
2026-06-10 20:09:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [128.65.1.183]:13856: 535 Incorrect authentication data (set_id=suporte@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.41.42.106
country_id: 2921044
description:
2026-06-10 20:09:58 dovecot_plain authenticator failed for H=p5b292a6a.dip0.t-ipconnect.de ([69.172.210.47]) [91.41.42.106]:49782: 535 Incorrect authentication data (set_id=hr@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.76.188.122
country_id: 2542007
description:
2026-06-10 20:09:20 dovecot_plain authenticator failed for H=([69.172.210.47]) [105.76.188.122]:3491: 535 Incorrect authentication data (set_id=it@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.19.96
country_id: 1562822
description:
2026-06-10 20:10:30 dovecot_plain authenticator failed for H=([69.172.210.47]) [171.237.19.96]:54850: 535 Incorrect authentication data (set_id=soporte@devbase.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.28.192
country_id: 2750405
description:
[2026-06-10 20:10:37 +0000] info [cpaneld] 195.63.28.192 - vodvpozo "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.119.0.37
country_id: 2017370
description:
2026-06-10 20:10:20 dovecot_login authenticator failed for H=([69.172.210.47]) [185.119.0.37]:9713: 535 Incorrect authentication data (set_id=office@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.87.169.85
country_id: 3585968
description:
2026-06-10 20:10:47 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.87.169.85]:3840: 535 Incorrect authentication data (set_id=ventas@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.36.233.220
country_id: 1168579
description:
2026-06-10 20:11:03 dovecot_plain authenticator failed for H=([69.172.210.47]) [39.36.233.220]:45744: 535 Incorrect authentication data (set_id=clients@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.234.19.6
country_id: 2017370
description:
2026-06-10 20:11:19 dovecot_plain authenticator failed for H=([69.172.210.47]) [83.234.19.6]:46046: 535 Incorrect authentication data (set_id=info@devbase.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:11:27 +0000] info [cpaneld] 37.114.148.247 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-10 20:13:27 +0000] info [cpaneld] 45.61.130.187 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [10/Jun/2026:20:14:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144200&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781122473 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.119.85.174
country_id: 2589581
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/5.jpeg HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 10 20:15:39 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.154
country_id: 6252001
description:
Jun 10 20:15:51 ns5 pure-ftpd[44847]: (?@45.38.17.154) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:16:03 +0000] info [cpaneld] 37.114.148.247 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun 10 20:15:21 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 10 20:15:42 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.79.207.2
country_id: 1880251
domain: www.togosem.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/category/ai-news/www.togosem.com||User:aogodmm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 10 20:16:26 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [10/Jun/2026:20:16:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055271&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781122588 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.142.52.58
country_id: 2542007
description:
2026-06-10 20:16:32 dovecot_plain authenticator failed for H=([10.5.0.2]) [41.142.52.58]:60464: 535 Incorrect authentication data (set_id=l.amegee@ccit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.114.177.183
country_id: 587116
description:
2026-06-10 20:17:06 dovecot_plain authenticator failed for H=([69.172.210.47]) [37.114.177.183]:1325: 535 Incorrect authentication data (set_id=info@devbase.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 10 20:16:20 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [10/Jun/2026:20:16:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988762&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781122586 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.162.192.150
country_id: 3996063
description:
189.162.192.150 - - [10/Jun/2026:20:16:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656713&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprotection-sociale-school-assur-se-rapproche-de-la-barre-des-2-000-000-de-prises-en-charge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781122590 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/protection-sociale-school-assur-se-rapproche-de-la-barre-des-2-000-000-de-prises-en-charge/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.6177.1890 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.162.192.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.208.234
country_id: 1643084
description:
2026-06-10 20:18:14 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.175.208.234]:34740: 535 Incorrect authentication data (set_id=contato@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.245.97.84
country_id: 1522867
description:
2026-06-10 20:17:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [195.245.97.84]:10872: 535 Incorrect authentication data (set_id=admin@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.103.180.68
country_id: 3508796
description:
2026-06-10 20:17:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.103.180.68]:57116: 535 Incorrect authentication data (set_id=marketing@devbase.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.157.133
country_id: 2363686
description:
102.64.157.133 - - [10/Jun/2026:20:18:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673066&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-a-lecole-primaire-evangelique-de-nyekonakpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781122531 HTTP/2.0" 404 159 tdn.tg "http://www.baidu.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/138.0.3351.83 Version/18.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.157.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.108.5.124
country_id: 3686110
description:
2026-06-10 20:17:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [191.108.5.124]:53460: 535 Incorrect authentication data (set_id=contact@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.157.118.27
country_id: 3996063
description:
2026-06-10 20:19:14 dovecot_plain authenticator failed for H=([69.172.210.47]) [189.157.118.27]:47980: 535 Incorrect authentication data (set_id=comercial@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.208.234
country_id: 1643084
description:
2026-06-10 20:18:22 dovecot_login authenticator failed for H=([69.172.210.47]) [103.175.208.234]:34740: 535 Incorrect authentication data (set_id=contato@devbase.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.128.23.63
country_id: 1814991
description:
2026-06-10 20:18:29 H=([39.128.23.138]) [39.128.23.63]:59649 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.42.228.155
country_id: 1210997
description:
2026-06-10 20:18:36 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.42.228.155]:53018: 535 Incorrect authentication data (set_id=contacto@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.117.85.171
country_id: 3686110
description:
2026-06-10 20:18:58 dovecot_plain authenticator failed for H=([69.172.210.47]) [138.117.85.171]:49048: 535 Incorrect authentication data (set_id=financeiro@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.157.118.27
country_id: 3996063
description:
2026-06-10 20:19:21 dovecot_login authenticator failed for H=([69.172.210.47]) [189.157.118.27]:47980: 535 Incorrect authentication data (set_id=comercial@devbase.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 20:19:21 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.60.142
country_id: 2017370
description:
2026-06-10 20:19:30 dovecot_plain authenticator failed for H=46-138-60-142.dynamic.spd-mgts.ru ([69.172.210.47]) [46.138.60.142]:3571: 535 Incorrect authentication data (set_id=it@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.219.119.39
country_id: 2921044
description:
2026-06-10 20:20:08 dovecot_plain authenticator failed for H=ipservice-092-219-119-039.092.219.pools.vodafone-ip.de ([69.172.210.47]) [92.219.119.39]:50524: 535 Incorrect authentication data (set_id=suporte@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.224.157.243
country_id: 1562822
description:
2026-06-10 20:19:53 dovecot_plain authenticator failed for H=([69.172.210.47]) [14.224.157.243]:50612: 535 Incorrect authentication data (set_id=accounts@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.238.94.242
country_id: 2464461
description:
2026-06-10 20:20:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [196.238.94.242]:34782: 535 Incorrect authentication data (set_id=office@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.104.20
country_id: 3865483
description:
2026-06-10 20:21:06 dovecot_plain authenticator failed for H=([69.172.210.47]) [200.107.104.20]:59638: 535 Incorrect authentication data (set_id=ventas@devbase.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.237.102.19
country_id: 3017382
description:
[2026-06-10 20:20:45 +0000] info [cpaneld] 185.237.102.19 NEW conforwellty:tWnviikWjLhlm4Fy address=185.237.102.19,app=cpaneld,creator=conforwellty,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:20:37 +0000] info [cpaneld] 37.114.148.247 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.129.156.75
country_id: 2017370
description:
2026-06-10 20:20:48 dovecot_plain authenticator failed for H=([69.172.210.47]) [31.129.156.75]:52954: 535 Incorrect authentication data (set_id=soporte@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.15.243
country_id: 3996063
description:
2026-06-10 20:21:23 dovecot_plain authenticator failed for H=fixed-187-189-15-243.totalplay.net ([69.172.210.47]) [187.189.15.243]:1500: 535 Incorrect authentication data (set_id=clients@devbase.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.94.115
country_id: 1512440
description:
2026-06-10 20:21:40 dovecot_plain authenticator failed for H=([69.172.210.47]) [84.54.94.115]:48283: 535 Incorrect authentication data (set_id=info@devbase.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [10/Jun/2026:20:23:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065565&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdiego-armando-maradona%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781122981 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/diego-armando-maradona/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.14
country_id: 1880251
description:
47.128.96.14 - - [10/Jun/2026:20:23:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988459&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781123026 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:24:15 +0000] info [cpaneld] 37.114.148.247 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 20:24:57 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.154
country_id: 6252001
description:
Jun 10 20:25:08 ns5 pure-ftpd[50057]: (?@45.38.17.154) [WARNING] Authentication failed for user [contact@dany2.mairie.tg]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.107.207
country_id: 3469034
description:
Jun 10 20:25:09 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.107.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.207
country_id: 3469034
description:
Jun 10 20:24:21 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.107.207
country_id: 3469034
description:
Jun 10 20:25:23 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.107.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.147.153.102
country_id: 3508796
description:
2026-06-10 20:26:38 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.147.153.102]:53398: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.76.2.145
country_id: 3469034
description:
2026-06-10 20:26:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [201.76.2.145]:41268: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.59.235.45
country_id: 290557
description:
2026-06-10 20:27:12 dovecot_plain authenticator failed for H=bba-94-59-235-45.alshamil.net.ae ([69.172.210.47]) [94.59.235.45]:49820: 535 Incorrect authentication data (set_id=support@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.176.95.250
country_id: 3508796
description:
2026-06-10 20:28:03 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.176.95.250]:41052: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.59.235.45
country_id: 290557
description:
2026-06-10 20:27:19 dovecot_login authenticator failed for H=bba-94-59-235-45.alshamil.net.ae ([69.172.210.47]) [94.59.235.45]:49820: 535 Incorrect authentication data (set_id=support@togointerim.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.128.23.63
country_id: 1814991
description:
2026-06-10 20:27:23 H=([39.128.23.138]) [39.128.23.63]:21648 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.191.209.254
country_id: 1562822
description:
2026-06-10 20:27:32 dovecot_plain authenticator failed for H=([69.172.210.47]) [14.191.209.254]:23668: 535 Incorrect authentication data (set_id=marketing@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.229.212.182
country_id: 3996063
description:
2026-06-10 20:27:49 dovecot_plain authenticator failed for H=([69.172.210.47]) [177.229.212.182]:43490: 535 Incorrect authentication data (set_id=contact@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.66.80.25
country_id: 3658394
description:
2026-06-10 20:29:13 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.66.80.25]:41836: 535 Incorrect authentication data (set_id=it@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.155.17.224
country_id: 3686110
description:
2026-06-10 20:28:19 dovecot_plain authenticator failed for H=dynamic-186-155-17-224.dynamic.etb.net.co ([69.172.210.47]) [186.155.17.224]:56195: 535 Incorrect authentication data (set_id=contacto@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.216.130
country_id: 3469034
description:
2026-06-10 20:28:38 dovecot_plain authenticator failed for H=([69.172.210.47]) [177.33.216.130]:50454: 535 Incorrect authentication data (set_id=financeiro@togointerim.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.34
country_id: 2363686
description:
[2026-06-10 20:28:42 +0000] info [webmaild] 160.242.199.34 - rpi@dgdn-togo.tg "POST /cpsess3199023596/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.57.221] != Current IP Address [160.242.199.34]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.47.52.152
country_id: 1168579
description:
2026-06-10 20:28:55 dovecot_plain authenticator failed for H=([69.172.210.47]) [202.47.52.152]:47349: 535 Incorrect authentication data (set_id=comercial@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [10/Jun/2026:20:29:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409637&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fghana%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781123395 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ghana/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [10/Jun/2026:20:30:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180994&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781123410 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.66.80.25
country_id: 3658394
description:
2026-06-10 20:29:20 dovecot_login authenticator failed for H=([69.172.210.47]) [186.66.80.25]:41836: 535 Incorrect authentication data (set_id=it@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.183.184.7
country_id: 3625428
description:
2026-06-10 20:30:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.183.184.7]:44412: 535 Incorrect authentication data (set_id=hr@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:29:26 +0000] info [whostmgrd] 217.76.154.149 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.77.8.148
country_id: 2017370
description:
2026-06-10 20:29:29 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.77.8.148]:60302: 535 Incorrect authentication data (set_id=accounts@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.219.142.144
country_id: 3469034
description:
2026-06-10 20:29:46 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.219.142.144]:63458: 535 Incorrect authentication data (set_id=suporte@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.102.104
country_id: 3469034
description:
2026-06-10 20:31:04 dovecot_plain authenticator failed for H=131-108-102-104.static.entelvias.com.br ([69.172.210.47]) [131.108.102.104]:49224: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.231.9.179
country_id: 285570
description:
2026-06-10 20:30:23 dovecot_plain authenticator failed for H=([69.172.210.47]) [37.231.9.179]:35394: 535 Incorrect authentication data (set_id=soporte@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:30:29 +0000] info [whostmgrd] 217.76.154.149 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:30:35 +0000] info [whostmgrd] 217.76.154.149 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.152.162
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">face \xc3\xa0 la menace grandissante de l\xe2\x80\x99\xc3\xa9rosion c\xc3\xb4ti\xc3\xa8re, le togo franchit une nouvelle \xc3\xa9tape dans la protection de son littoral. avec l\xe2\x80\x99appui financier d\xe2\x80\x99investinternational, pr\xc3\xa8s de 29,5 millions d\xe2\x80\x99euros sont mobilis\xc3\xa9s pour renforcer la r\xc3\xa9silience des zones c\xc3\xb4ti\xc3\xa8res entre gbodjom\xc3\xa9, agbodrafo et goumoukop\xc3\xa9, tout en am\xc3\xa9liorant la protection des zones lagunaires.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ce projet s\xe2\x80\x99inscrit dans le cadre du programme waca (west africa coastal areas), qui vise \xc3\xa0 accompagner les pays ouest-africains dans la lutte contre les effets du changement climatique sur leurs littoraux. les images qui circulent montrent \xc3\xa0 la fois la gravit\xc3\xa9 du probl\xc3\xa8me \xe2\x80\x93 routes effondr\xc3\xa9es sous l\xe2\x80\x99assaut des vagues et habitations pr\xc3\xa9caires menac\xc3\xa9es par l\xe2\x80\x99oc\xc3\xa9an \xe2\x80\x93 et la d\xc3\xa9termination des autorit\xc3\xa9s \xc3\xa0 agir.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">une r\xc3\xa9union de travail a r\xc3\xa9cemment r\xc3\xa9uni des repr\xc3\xa9sentants togolais et des partenaires internationaux, dont des experts d\xe2\x80\x99investinternational, de l\xe2\x80\x99afd et d\xe2\x80\x99autres acteurs impliqu\xc3\xa9s dans le d\xc3\xa9veloppement durable. sur les clich\xc3\xa9s, on aper\xc3\xa7oit des officiels en pleine discussion, symboles d\xe2\x80\x99une collaboration concr\xc3\xa8te pour transformer ces engagements financiers en actions sur le terrain.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">l\xe2\x80\x99\xc3\xa9rosion c\xc3\xb4ti\xc3\xa8re constitue l\xe2\x80\x99un des d\xc3\xa9fis majeurs pour le togo, comme pour de nombreux pays du golfe de guin\xc3\xa9e. elle menace non seulement les infrastructures routi\xc3\xa8res et portuaires, mais aussi les moyens de subsistance des communaut\xc3\xa9s de p\xc3\xaacheurs et d\xe2\x80\x99agriculteurs riverains. les zones lagunaires, particuli\xc3\xa8rement vuln\xc3\xa9rables, sont au c\xc5\x93ur de ce nouvel investissement qui devrait permettre de stabiliser les berges, restaurer les \xc3\xa9cosyst\xc3\xa8mes et renforcer les capacit\xc3\xa9s locales d\xe2\x80\x99adaptation.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les travaux pr\xc3\xa9vus incluent probablement la construction d\xe2\x80\x99ouvrages de protection, la restauration de la mangrove et des mesures d\xe2\x80\x99accompagnement des populations affect\xc3\xa9es. les d\xc3\xa9tails techniques et le calendrier pr\xc3\xa9cis devraient \xc3\xaatre communiqu\xc3\xa9s prochainement par les autorit\xc3\xa9s togolaises et leurs partenaires.</span>||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.235.134.47
country_id: 298795
description:
2026-06-10 20:30:47 dovecot_plain authenticator failed for H=([69.172.210.47]) [88.235.134.47]:44328: 535 Incorrect authentication data (set_id=clients@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.92.138
country_id: 1512440
description:
213.230.92.138 - - [10/Jun/2026:20:31:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065556&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdbs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781123478 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dbs/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5105.1257 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.92.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:32:07 +0000] info [cpaneld] 37.114.148.247 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:32:54 +0000] info [cpaneld] 37.114.148.247 - LWS-547091 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user LWS-547091 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.150.231.175
country_id: 3996063
description:
187.150.231.175 - - [10/Jun/2026:20:32:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184338&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecomposition-de-la-ceni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781123572 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recomposition-de-la-ceni/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.6868.1335 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.150.231.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 20:34:05 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 20:35:05 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 88.185.114.205
country_id: 3017382
domain: misstogo.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:maurice||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.15.98.102
country_id: 3865483
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 131.222.253.73
country_id: 298795
description:
131.222.253.73 - - [10/Jun/2026:20:38:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063702&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecomposition-de-la-ceni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781123914 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recomposition-de-la-ceni/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3374.1256 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:131.222.253.73


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:38:47 +0000] info [cpaneld] 217.76.154.149 - sodegoz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodegoz (has_cpuser_file failed)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.176.49.247
country_id: 3895114
domain: mail.formation.free.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/frontend/.env.production||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.49.247
country_id: 3895114
domain: mail.formation.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:formationfreenet||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:40:09 +0000] info [webmaild] 217.76.154.149 - ag@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:40:51 +0000] info [webmaild] 217.76.154.149 - tps@tps.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:41:50 +0000] info [cpaneld] 37.114.148.247 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.163
country_id: 1880251
description:
47.128.96.163 - - [10/Jun/2026:20:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326616&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoleur-de-sacs-detudiants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124092 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voleur-de-sacs-detudiants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:42:31 +0000] info [cpaneld] 37.114.148.247 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 20:44:15 +0000] info [cpaneld] 37.114.148.247 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.176.85.84
country_id: 1668284
description:
180.176.85.84 - - [10/Jun/2026:20:43:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133670&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2022-nouveaux-prix%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124205 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2022-nouveaux-prix/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5868.1878 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.176.85.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:44:50 +0000] info [cpaneld] 217.76.154.149 - afxvhoxo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:45:30 +0000] info [whostmgrd] 217.76.154.149 - root "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.36.194.131
country_id: 272103
description:
Jun 10 20:47:15 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.36.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 20:47:17 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:46:26 +0000] info [cpaneld] 217.76.154.149 - 2002281 "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [10/Jun/2026:20:47:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12830667&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcolonisation-francaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124420 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/colonisation-francaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 20:48:50 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [10/Jun/2026:20:49:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922763&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124557 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.76.154.149
country_id: 2510769
description:
[2026-06-10 20:49:50 +0000] info [cpaneld] 217.76.154.149 - czqxxxnu "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:20:49:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461290&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-week-end-prolonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124588 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-week-end-prolonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.154.142.146
country_id: 3175395
domain: dankpen1.mairie.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/mysqldump.sql||User:rbnbkmre||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [10/Jun/2026:20:49:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842516&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftest-pcr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124595 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/test-pcr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [10/Jun/2026:20:50:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039174&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frisques-dinondation-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124607 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/risques-dinondation-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 104.155.210.243
country_id: 1668284
domain: www.myworkafrica.com.lct-togo.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/frontend/.env.staging||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.154.142.146
country_id: 3175395
domain: dankpen1.mairie.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.ini||User:rbnbkmre||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [10/Jun/2026:20:52:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804438&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781124733 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.155.210.243
country_id: 1668284
domain: www.myworkafrica.com.lct-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/src/.env.backup||User:lhxhatyj||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-10 20:56:29 +0000] info [cpaneld] 64.44.59.244 NEW togorer:js37sUrip73UVcxr address=64.44.59.244,app=cpaneld,creator=togorer,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.138.58.27
country_id: 6252001
domain: www.snbbrasserie.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:bighostingsnbd||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 192.141.99.134
country_id: 3932488
description:
2026-06-10 20:57:37 H=([192.141.99.134]) [192.141.99.134]:51008 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 20:57:40 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.35
country_id: 1880251
description:
47.128.112.35 - - [10/Jun/2026:20:57:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907034&pdata=https%253A%252F%252Fmisstogo.tg%252F2023%252F11%252F10%252Fwhat-are-zaza-tablets-a-comprehensive-overview%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125072 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/2023/11/10/what-are-zaza-tablets-a-comprehensive-overview/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.231.33.38
country_id: 241170
description:
[2026-06-10 21:00:12 +0000] info [cpaneld] 185.231.33.38 - newglevfer "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.231.33.38
country_id: 241170
description:
185.231.33.38 - newglevfer [10/Jun/2026:21:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999720&pdata=https%253A%252F%252Flepoint-actu.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125210 HTTP/2.0" 302 0 lepoint-actu.tg "https://lepoint-actu.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.231.33.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.120
country_id: 6251999
description:
[2026-06-10 20:59:53 +0000] info [cpaneld] 195.63.18.120 - pnls "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.84
country_id: 6251999
description:
[2026-06-10 20:59:54 +0000] info [cpaneld] 217.181.82.84 - uubplgpf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.172
country_id: 2661886
description:
45.84.107.172 - sahamtg [10/Jun/2026:20:59:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987439&pdata=https%253A%252F%252Fsahamtg.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125196 HTTP/2.0" 302 0 sahamtg.com "https://sahamtg.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.84.107.172
country_id: 2661886
description:
[2026-06-10 21:00:04 +0000] info [cpaneld] 45.84.107.172 - newglevfer "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.138.58.27
country_id: 6252001
domain: www.snbbrasserie.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:bighostingsnbd||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.91
country_id: 6251999
description:
[2026-06-10 20:59:58 +0000] info [cpaneld] 217.181.80.91 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.20
country_id: 6251999
description:
[2026-06-10 20:59:57 +0000] info [cpaneld] 195.63.16.20 - muzsajnk "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.251
country_id: 6251999
description:
[2026-06-10 21:00:19 +0000] info [cpaneld] 195.63.18.251 - afdim "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.83.199
country_id: 6251999
description:
[2026-06-10 21:00:19 +0000] info [cpaneld] 217.181.83.199 - xdkbrmjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-10 21:00:25 +0000] info [cpaneld] 157.66.56.214 - @ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.231.33.38
country_id: 241170
description:
185.231.33.38 - newglevfer [10/Jun/2026:21:00:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6996632&pdata=https%253A%252F%252Flepoint-actu.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125220 HTTP/2.0" 302 0 lepoint-actu.tg "https://lepoint-actu.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.231.33.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.231.33.38
country_id: 241170
description:
[2026-06-10 21:00:22 +0000] info [cpaneld] 185.231.33.38 - newglevfer "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.115.189
country_id: 597427
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:193.187.115.189||TA:193.187.115.189||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.158.247.35
country_id: 2542007
description:
[2026-06-10 21:01:46 +0000] info [cpaneld] 105.158.247.35 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.211.167.225
country_id: 2328926
description:
[2026-06-10 21:02:04 +0000] info [cpaneld] 102.211.167.225 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.25.212
country_id: 3932488
description:
[2026-06-10 21:01:56 +0000] info [cpaneld] 38.25.25.212 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.241.16.0
country_id: 2017370
description:
[2026-06-10 21:01:53 +0000] info [cpaneld] 92.241.16.0 - leadell "GET /login/?login_only=1&user=leadell&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadell (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.224.54.56
country_id: 3996063
description:
[2026-06-10 21:02:01 +0000] info [cpaneld] 189.224.54.56 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:21:02:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866019&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125354 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 192.141.99.134
country_id: 3932488
description:
2026-06-10 21:03:07 H=([192.141.99.134]) [192.141.99.134]:60413 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 10 21:03:23 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-10 21:03:52 +0000] info [cpaneld] 103.77.107.71 - @ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun 10 21:03:59 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 21:03:36 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [10/Jun/2026:21:03:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525334&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125397 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-10 21:05:35 +0000] info [cpaneld] 157.66.56.214 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [10/Jun/2026:21:06:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857906&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125596 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 41.78.138.1
country_id: 2363686
domain: mesyscom.com
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.15||T:APACHE||User:jmtctoni||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:07:11 +0000] info [cpaneld] 37.114.148.247 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.130.146.233
country_id: 6254930
description:
[2026-06-10 21:08:04 +0000] info [cpaneld] 178.130.146.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.254.40
country_id: 99237
description:
[2026-06-10 21:08:19 +0000] info [cpaneld] 62.201.254.40 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.152.194
country_id: 3469034
description:
[2026-06-10 21:08:27 +0000] info [cpaneld] 45.178.152.194 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.186.19.25
country_id: 2017370
description:
[2026-06-10 21:08:36 +0000] info [cpaneld] 188.186.19.25 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.157.90.4
country_id: 1282988
description:
[2026-06-10 21:08:23 +0000] info [cpaneld] 103.157.90.4 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 10 21:09:28 ns5 pure-ftpd[75041]: (?@47.84.199.24) [WARNING] Authentication failed for user [ingersarlu@gmail.com]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:11:05 +0000] info [cpaneld] 37.114.148.247 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-10 21:11:11 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:51102: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.112
country_id: 953987
description:
Jun 10 21:11:15 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.112 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [10/Jun/2026:21:10:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143898&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feducation-financiere-des-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125858 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/education-financiere-des-enfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.65.168.139
country_id: 3017382
description:
2026-06-10 21:11:45 dovecot_plain authenticator failed for H=139.168.65.86.rev.sfr.net (aspatiocke) [86.65.168.139]:49464: 535 Incorrect authentication data (set_id=no-reply@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [10/Jun/2026:21:12:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13407854&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125932 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.65.168.139
country_id: 3017382
description:
Jun 10 21:11:43 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.65.168.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [10/Jun/2026:21:11:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328262&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyali-dakar%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125913 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yali-dakar/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-10 21:12:03 +0000] info [cpaneld] 103.253.27.219 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.112
country_id: 953987
description:
Jun 10 21:11:22 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.112 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:21:12:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870042&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125958 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [10/Jun/2026:21:13:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724511&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fyva%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781125983 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/yva/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:13:15 +0000] info [cpaneld] 37.114.148.247 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [10/Jun/2026:21:13:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882007&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781126021 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [10/Jun/2026:21:14:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526309&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-de-recrutement-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781126072 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-de-recrutement-des-enseignants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 21:17:56 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:21:18:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856914&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcaravane-nationale-du-concert-party%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781126283 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/caravane-nationale-du-concert-party/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 10 21:19:06 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 10 21:19:07 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 21:18:19 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:18:50 +0000] info [cpaneld] 37.114.148.247 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun 10 21:19:28 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 10 21:19:39 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 10 21:19:58 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 10 21:19:30 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 21:20:05 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 10 21:19:29 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 192.141.99.134
country_id: 3932488
description:
2026-06-10 21:19:32 H=([192.141.99.134]) [192.141.99.134]:51692 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 10 21:20:14 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 10 21:21:10 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun 10 21:20:24 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.52.114
country_id: 1269750
description:
Jun 10 21:20:23 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.79.52.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 10 21:20:27 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [10/Jun/2026:21:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130835&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faccident-de-voiture-dans-le-drome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781126451 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/accident-de-voiture-dans-le-drome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 10 21:21:07 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 10 21:21:19 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [10/Jun/2026:21:21:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658498&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781126483 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 10 21:21:47 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 10 21:21:53 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 10 21:21:52 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jun 10 21:21:57 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun 10 21:22:08 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun 10 21:22:28 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 10 21:22:37 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 10 21:22:49 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:22:49 +0000] info [cpaneld] 37.114.148.247 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.64
country_id: 798544
description:
Jun 10 21:23:01 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 10 21:23:08 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.36.194.131
country_id: 272103
description:
Jun 10 21:23:48 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.36.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 21:23:57 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 10 21:23:17 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 10 21:23:17 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.1.34.242
country_id: 719819
description:
Jun 10 21:24:53 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.1.34.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.170.1.244
country_id: 3017382
description:
Jun 10 21:24:30 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.170.1.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 10 21:24:47 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [10/Jun/2026:21:27:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803973&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgerry-taama%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781126862 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gerry-taama/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.81.144.64
country_id: 2017370
domain: soena.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:SOUPER|t$25U3jHlP1GonbZ9)h(bVJR.soena.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77277976
name: IM360 WAF: XMLRPC getUsersBlogs RBL infectors
abuser: 157.22.16.13
country_id: 2635167
domain: soena.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL infectors||Username:Ajatovivi1994.soena.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 213.108.0.227
country_id: 2017370
domain: soena.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:t$25U3jHlP1GonbZ9)h(bVJR.soena.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.91
country_id: 1562822
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-32.117.5.142.91||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 21:33:06 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [10/Jun/2026:21:33:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998166&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fstructure-specialisee-dans-le-service-a-la-personne%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781127219 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/structure-specialisee-dans-le-service-a-la-personne/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 10 21:33:23 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:35:44 +0000] info [cpaneld] 37.114.148.247 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:36:41 +0000] info [cpaneld] 37.114.148.247 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-10 21:37:43 +0000] info [cpaneld] 157.66.56.214 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.4
country_id: 3469034
description:
Jun 10 21:38:37 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-10 21:39:07 +0000] info [cpaneld] 45.61.130.187 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [10/Jun/2026:21:40:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119785&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fforum-daffaires-et-economique-turkiye-afrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781127600 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/forum-daffaires-et-economique-turkiye-afrique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 21:39:39 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.132
country_id: 1880251
description:
47.128.121.132 - - [10/Jun/2026:21:41:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198952&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F04%252F14%252F13221%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781127673 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/04/14/13221/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.132


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.188.134
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.247.188.134||TA:151.247.188.134||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.50
country_id: 2750405
domain: www.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/www.zephyr.tg/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.104
country_id: 1880251
description:
47.128.121.104 - - [10/Jun/2026:21:42:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329197&pdata=https%253A%252F%252Ftogomedia24.tg%252F2019%252F07%252F26%252Ftogo-la-ceni-prete-le-vote-partiel-du-15-aout-2019%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781127741 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2019/07/26/togo-la-ceni-prete-le-vote-partiel-du-15-aout-2019/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-10 21:42:49 +0000] info [cpaneld] 45.61.130.187 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 21:47:50 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:47:57 +0000] info [cpaneld] 37.114.148.247 - ANANI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ANANI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:48:48 +0000] info [cpaneld] 37.114.148.247 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.129.110.145
country_id: 3865483
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 21:51:59 +0000] info [cpaneld] 37.114.148.247 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 21:52:45 +0000] info [cpaneld] 102.54.238.57 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 187.102.217.54
country_id: 3865483
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-58.187.102.217.54||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.66
country_id: 1269750
description:
Jun 10 21:59:26 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 21:59:49 +0000] info [cpaneld] 102.54.238.57 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 10 21:59:59 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.203.135
country_id: 2802361
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:62.105.203.135||TA:62.105.203.135||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.112.174.110
country_id: 1814991
description:
2026-06-10 22:00:40 dovecot_login authenticator failed for H=(vkunel) [171.112.174.110]:52958: 535 Incorrect authentication data (set_id=service)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.208
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-00.62.197.45.208||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.124.218
country_id: 6252001
description:
[2026-06-10 22:03:07 +0000] info [whostmgrd] 82.40.124.218 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [10/Jun/2026:22:02:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13136017&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F12%252F07%252Ftogo-reprise-progressive-des-activites-sportives%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781128944 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/12/07/togo-reprise-progressive-des-activites-sportives/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 22:02:43 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 22:03:21 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-10 22:03:20 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.163.194.100
country_id: 1512440
description:
198.163.194.100 - - [10/Jun/2026:22:05:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777698&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-financement-constant-du-secteur-educatif%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781129153 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-financement-constant-du-secteur-educatif/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7359.1731 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.163.194.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.87.190
country_id: 6252001
description:
[2026-06-10 22:07:49 +0000] info [cpaneld] 82.40.87.190 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 22:07:44 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93377.togodailynews.tg||ServerName:togodailynews.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:468b4e9ff27a612bbd45e343b31b2bb6a621b80a||Title:0xa4a071ec||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11279.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f6f8e06e2aa875a628f50e8aedbb678d2e3c671||Title:0xa0fcd7fe||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togointerim.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82312.togointerim.net||ServerName:togointerim.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a5aa2c5ebfc0e20cb9b0835e43310270ee89ea6||Title:0xa9273498||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 22:10:59 +0000] info [cpaneld] 37.114.148.247 - iaideveloppementgroupe@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42ebade1ceb92b46cabb871064f9571b9912eab8||Title:0x3d5dfedd||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togofeed.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96379.togofeed.com||ServerName:togofeed.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2b0afa6f0e8ab3cc1488341dbf410a373433d54||Title:0x7d358037||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d30646ddb08e25c760a3be86ae3b4c4204adcf3||Title:0x1b3d8649||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7cfdd4f68854682f446d4e286a9029f4217be5b0||Title:0x1736cb37||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: formation.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"data_9426263a\":\"ab55\",\"reason\":-1,\"data_16a039fc\":\"39e6\",\"_response\":{\"_prefix\":\"var vwcg=arguments['\\\\x31'];var fncf=vwcg;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb79c168b78c57b02f88b64a9a8d5b7e618399c6||Title:0x49d4adb6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.72
country_id: 831053
description:
[2026-06-10 22:14:47 +0000] info [cpaneld] 37.35.67.72 - boobilry "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6dbc200fbc7d65d0d895d9f46f0047b51fe66c14||Title:0x52d24b1d||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19d792183d7fa5af83e712c2523e71bcf340e840||Title:0xfda834bb||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6275a3598830d90271756b72bb0cd1584007db5f||Title:0x5330bf4b||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.220.137
country_id: 3469034
domain: tensai.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ulduzncs||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 22:17:55 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:decbbbbdc776abe4190f3a40d2ba600e449a0f41||Title:0xdd5d9d1c||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7afaa2ced2f5882517bd2884d866fb8788fee0f||Title:0xee1bf193||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-10 22:19:02 +0000] info [cpaneld] 5.230.153.154 NEW vejjghdd:nhoFsyLS4Dxqchfa address=5.230.153.154,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9bf445999a2259ceb442006fd6b33216b102fe1||Title:0x232d9117||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42e1683bafa52434ec4cb2f44f99ea1b09ff265e||Title:0x7c6c0ab7||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.185.194.225
country_id: 3469034
description:
138.185.194.225 - - [10/Jun/2026:22:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200536&pdata=https%253A%252F%252Feducplusmedia.tg%252F2026%252F06%252F08%252Frefela-togo-aguze-akossiwa-parmi-les-figures-du-nouveau-bureau-national-elue-vice-presidente-du-grand-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781130094 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2026/06/08/refela-togo-aguze-akossiwa-parmi-les-figures-du-nouveau-bureau-national-elue-vice-presidente-du-grand-lome/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2099.1067 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.185.194.225


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e584627123896f1c5558c126d275e638910a82c3||Title:0xf3d1ed04||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43182b5204374bbdbb08b8e9806ac302e959546c||Title:0x813b448b||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-10 22:22:41 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50916: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 22:23:58 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53c0a6b94d7666ee0219e76985a09bfe05d296c2||Title:0x83670951||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 36.100.118.90
country_id: 1814991
description:
2026-06-10 22:23:25 H=([0.0.0.0]) [36.100.118.90]:52028 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:568e5c02076ff9736408db88fb1fe557108d5f0e||Title:0x5ed7e063||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b004407e88f4666bb6481fcd15a985bcd9c4055||Title:0xba4f6ef7||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.106.147.119
country_id: 6252001
domain: www.v2.cfpj.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:cfpjusti||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [10/Jun/2026:22:26:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185882&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781130396 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:af9d9a8d94f9b0324b78484787905a77e3daeff7||Title:0x5db5692a||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [10/Jun/2026:22:27:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316135&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781130423 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:232b4369f7e97b419f0c5d872f7bb8e6d7f0c1d5||Title:0x578fed13||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [10/Jun/2026:22:27:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657173&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781130474 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9291fe9558e954a628d1b85eb8dd56cce7964a24||Title:0x1d842609||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [10/Jun/2026:22:29:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067051&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F131%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781130549 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/131/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.232.178.52
country_id: 2017370
description:
2026-06-10 22:29:58 dovecot_plain authenticator failed for H=([69.172.210.47]) [188.232.178.52]:33808: 535 Incorrect authentication data (set_id=info@nic.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.185.22
country_id: 3895114
description:
2026-06-10 22:30:14 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.225.185.22]:33680: 535 Incorrect authentication data (set_id=admin@nic.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c915d3dff8619c3ba0769ce1ca18c4b5fdd8169d||Title:0x997bd079||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 22:29:48 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.14.87.168
country_id: 6252001
description:
2026-06-10 22:30:48 dovecot_plain authenticator failed for H=104-14-87-168.lightspeed.renonv.sbcglobal.net ([69.172.210.47]) [104.14.87.168]:51742: 535 Incorrect authentication data (set_id=contact@nic.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.162.209
country_id: 3923057
description:
2026-06-10 22:31:10 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.188.162.209]:44099: 535 Incorrect authentication data (set_id=contato@nic.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2d0f0127605f6e17c36a05e8f2a14120df9b3cd3||Title:0x8d1f24d5||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.255.25.135
country_id: 3625428
description:
2026-06-10 22:30:33 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.255.25.135]:51972: 535 Incorrect authentication data (set_id=marketing@nic.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.185.22
country_id: 3895114
description:
2026-06-10 22:30:22 dovecot_login authenticator failed for H=([69.172.210.47]) [45.225.185.22]:33680: 535 Incorrect authentication data (set_id=admin@nic.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:sky.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e9b2fd95c5d8aed0144aded40066fb0a8e9972ff||Title:0xb36349d8||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.199.31.10
country_id: 3686110
description:
2026-06-10 22:31:24 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.199.31.10]:52494: 535 Incorrect authentication data (set_id=contacto@nic.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 22:33:05 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:675eda574b246d02819fa81b82aeaae1f67377b6||Title:0x84e196ee||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [10/Jun/2026:22:33:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933092&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-nes-calcines-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781130838 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-nes-calcines-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e4cebcb714e97cdfcced875887102017942057e0||Title:0x759395dc||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9a1d3d42bf5519e3b67283db7692eb76d47297b||Title:0x74651a3a||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:184ded79e5ed3cbdd3b2f8976fb4791bdd5aa5b1||Title:0xc7638fef||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb90645d2b329c1f591ba970953fe1b4302fd43a||Title:0x8dc072e0||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [10/Jun/2026:22:36:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7041641&pdata=https%253A%252F%252Ftdn.tg%252Fpage%252F74%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781131014 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/page/74/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f25d7b2e2c79331af46a93d25807c2b1486cb09||Title:0xe8f2c3cb||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 10 22:39:02 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 10 22:38:41 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.170
country_id: 1835841
description:
Jun 10 22:38:44 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 10 22:38:50 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 22:38:44 +0000] info [cpaneld] 37.114.148.247 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.122.14
country_id: 1269750
description:
Jun 10 22:38:19 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.122.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:740b34e45d10b9f3345da671cdf76dab6195faec||Title:0x126b7050||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecd7c499a5a085afd1a6e84dc9e6cd114d6cb9a6||Title:0x0a30c431||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 10 22:39:31 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 22:39:46 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun 10 22:39:53 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 112.11.223.199
country_id: 1814991
description:
2026-06-10 22:40:08 H=([112.11.223.199]) [112.11.223.199]:58421 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d1d24f5d85fb1af8943be3e4c25556372273c95a||Title:0x93009dd1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.83.142.110
country_id: 732800
description:
Jun 10 22:40:23 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.83.142.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.154
country_id: 1880251
description:
47.128.119.154 - - [10/Jun/2026:22:40:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209127&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10116&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781131240 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10116" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.154


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a88f288808af350e5e5cb2379e34033882a84a06||Title:0x92c28aad||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c79a0ea1dbc90bd8ea8c30af9deab5437f1f1bf||Title:0x9ad5cd8e||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.14
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-42.152.232.68.14||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [10/Jun/2026:22:43:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264211&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781131389 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.181
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-42.152.232.73.181||RSV:8.15||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.32.154.207
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:193.32.154.207||TA:193.32.154.207||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 169.224.36.254
country_id: 99237
domain: togosem.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.togosem.com||ServerName:togosem.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c6f20da8b2d683a3a905971c42f19bc7e622e646||Title:0x99c76308||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.17.14.46
country_id: 3175395
domain: www.koko.kpmg.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:kpmg||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 22:48:15 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.245.59
country_id: 2542007
description:
[2026-06-10 22:49:39 +0000] info [cpaneld] 41.141.245.59 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.96.205.193
country_id: 3686110
description:
[2026-06-10 22:49:44 +0000] info [cpaneld] 190.96.205.193 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.76.21.25
country_id: 2542007
description:
[2026-06-10 22:49:46 +0000] info [cpaneld] 105.76.21.25 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.94.154.80
country_id: 3469034
description:
[2026-06-10 22:49:53 +0000] info [cpaneld] 201.94.154.80 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [10/Jun/2026:22:50:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806758&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcour-constitutionnelle-sud-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781131853 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cour-constitutionnelle-sud-africaine/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [10/Jun/2026:22:51:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909854&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781131876 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 101.36.124.220
country_id: 1819730
description:
Jun 10 22:51:37 ns5 pure-ftpd[129458]: (?@101.36.124.220) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-10 22:51:57 +0000] info [cpaneld] 45.61.130.187 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.154.65
country_id: 2363686
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [10/Jun/2026:22:55:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672295&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781132116 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.124.130
country_id: 226074
description:
Jun 10 22:56:17 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.124.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.148.97.133
country_id: 3175395
description:
93.148.97.133 - - [10/Jun/2026:22:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660826&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F09%252F24%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781132120 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/09/24/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5986.1885 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.148.97.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.124.130
country_id: 226074
description:
Jun 10 22:56:24 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.124.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.238.134
country_id: 6252001
description:
[2026-06-10 22:56:45 +0000] info [webmaild] 216.26.238.134 - visite@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: haplucia-togo.tg
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b76aaecaf3d6ba42c07a69e5cceabcb01805fc3||Title:nnm6ad1wtq4l9rojh0||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 13.79.167.140
country_id: 2963597
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:q||MV:59--des-consommateurs-ivoiriens-ont-deja-utilise-lia-pour-leurs-achats-mais-la-confiance-reste-decisive-au-moment-du-paiement||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a763b7ae1756cd36535aae87ea387e2b927bc3f||Title:uiigg81u2b7eg7pw||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 23:02:33 +0000] info [cpaneld] 37.114.148.247 - 90446907 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.215.120.139
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/secteur-agricole-au-togo-1-500-fermes-modeles-mises-en-place-pour-les-producteurs/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad0a6cc9469aadd75150909116bbdfea05ffc6cf||Title:vexohlzappxthli3po||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.167.104.50
country_id: 3469034
description:
45.167.104.50 - - [10/Jun/2026:23:02:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133470&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fpage%252F22%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781132559 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/international/page/22/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.3407.1232 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.167.104.50


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [10/Jun/2026:23:03:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791851&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781132598 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e12397b270dc5024f87d6f18b1930ec7adbe73e8||Title:xxrb18khtf7ss7l||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.227.172.13
country_id: 2017370
description:
Jun 10 23:03:26 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.227.172.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8588fbfe538f0977f3b8bba444fcce4a74b872f||Title:ph5vnpcfbakvxfz2va||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b54640999daf712e0b7f0f30783925d72056bda7||Title:hk6f52sd9kceip||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 23:06:01 +0000] info [cpaneld] 37.114.148.247 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:630105f2374c044de1a37022428a142e0c8b8f0e||Title:vbbhd99owhzbjfjv||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [10/Jun/2026:23:07:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432551&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepreuve-de-dessin-bac-1-2020-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781132840 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epreuve-de-dessin-bac-1-2020-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [10/Jun/2026:23:07:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131555&pdata=https%253A%252F%252Fcfpj.tg%252Fpresentation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781132838 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/presentation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:271356bf8e203a6a1f76a7b8340dc56fe294dd29||Title:vc1n3grdif13g8v||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f0e6f40d78da835dcc7cfc64abdca270d454352||Title:551weonoat1hya4juf||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [10/Jun/2026:23:10:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791085&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781133003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6dd3fba557e02ca4801bc377bd24fbf4168f5228||Title:ljz7msuu0isfed||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [10/Jun/2026:23:10:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750427&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepreuve-de-dessin-bac-1-2020-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781133041 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epreuve-de-dessin-bac-1-2020-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.243.52
country_id: 2635167
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/wp-login.php HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df61d2e41c84c13522974e7709efdf68eed45489||Title:soewt54iypk6m24||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 10 23:10:34 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9085b7e52b166d7325979762a153c062ffcac5e1||Title:9e9kannggztj2m||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [10/Jun/2026:23:12:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053018&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsalif-keita%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781133131 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/salif-keita/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-10 23:11:30 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.58.124] != Current IP Address [196.170.1.77]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fea69fe4035d5135616809a753ce98525dcfe24e||Title:utgtd65i4sak4q||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cbbbef5c1c72f7bac958bb00017d0af26bb9f9bc||Title:qfxifbhdgkch39i42l||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
country_id: 1880251
description:
47.128.96.140 - - [10/Jun/2026:23:15:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867923&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781133300 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 23:14:19 +0000] info [cpaneld] 37.114.148.247 - iaideveloppementgroupe@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3617eed2c9e6118f9db55177334d6748d1ee829a||Title:zwsbwgtw4gqqeb7fhz||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad2de2e827b18ed7a73894e7a95634d2ead44e5d||Title:6mi5x1znhkt7d0494||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 10 23:15:43 ns5 auth[2523]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f13eabf2456d90854a766156b67a5de2433553f||Title:gcgp2z0gswad18mvpx||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 172.193.184.42
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:Signature-Input||MV:sig1=(\"@authority\" \"signature-agent\");created=1781133382;expires=1781133982;keyid=\"ov3hdsa8jq39dpeyfvffn-cupnz9yni8ldvr-5leibm\";alg=\"ed25519\";tag=\"web-bot-auth\"||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.247
country_id: 587116
description:
[2026-06-10 23:16:59 +0000] info [cpaneld] 37.114.148.247 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.214.214
country_id: 6251999
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d36cb7272447dcff37efb562ef01b5d98ba325e||Title:i0wbk2uy4vqhhf065||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.214.53
country_id: 732800
description:
2026-06-10 23:18:21 dovecot_plain authenticator failed for H=(84v388bzclumjlf37t4i) [104.28.214.53]:19238: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


