SQLite format 3@ .v ZY@( tfXJ<. xj\N@2$  i|.t i-\ iy/,mH iq+=0 ij0* ib( iY' iR& iK%i iC$D i;z# i3x!} i,P i i%Q i~e9 i9C$ i   ii i i i3h i= i in iʍX iA ii+ ih: i i i i ih j iy; io{ ide iYN iPl6 iC_5 i71 < 2 ( <<<y'w 201.22.53.135WHITEiiWhitelisted for 3 hours due to successful panel login34690345local {z'!k31.57.112.164GRAYiWUImunify360iV)Automatically blocked due to distributed attack31753959plocal{zy'!k46.62.209.187GRAYirImunify360iqAutomatically blocked due to distributed attack660013.>ѻlocal{)!k104.152.52.213GRAYi:Imunify360i9lAutomatically blocked due to distributed attack6252001h4localw!!k2.58.84.67GRAYiImunify360iAutomatically blocked due to distributed attack2921044:TClocalz'!k47.76.240.198GRAYiImunify360icAutomatically blocked due to distributed attack1819730/Llocalz'! k50.207.23.120GRAYiFImunify360i|>Automatically blocked due to distributed attack62520012xlocaly%! k3.131.215.38GRAYi Imunify360iAutomatically blocked due to distributed attack6252001&localy%!k3.134.148.59GRAYiImunify360iܱAutomatically blocked due to distributed attack6252001;local} )!k203.16.241.212GRAYiImunify360iAutomatically blocked due to distributed attack2077456localz %!k188.44.20.25GRAYi Imunify360iAutomatically blocked due to distributed attack718075,localw !!k2.58.84.61GRAYicImunify360i7Automatically blocked due to distributed attack2921044:T=local|'!k139.59.57.131GRAYiIImunify360iHAutomatically blocked due to distributed attack1269750;9local y %!k3.137.73.221GRAYioImunify360iCAutomatically blocked due to distributed attack6252001Ilocal Yp+B5WHITE9pGRAY.>ѻGRAYh4GRAY:TCGRAY/LGRAY2xGRAY&GRAY;GRAYGRAY IGRAY :T=GRAY ;9GRAY,GRAY               1 Gh  k  y f I 2 Z 8   U wG% |  D6 '!X 2750405L 2921044 3469034, 1835841*Z 1814991+ 3469034 2510769U 3469034(< 6252001tP 2017370!$d 1819730%g 2017370 n8 1562822 3469034#Z 1835841dD 1269750z 1814991 6252001?E 3469034F 2077456- 1668284! 130758) 1562822 3469034" 6252001 3469034 690791 f/ 1269750 1814991#_i 1814991 3469034Fr 1814991 1605651%o{ 6252001j 3469034 0 1269750 1835841? 6252001' 1880251!d# 3865483- 3017382 1819730 3469034 1835841|< 1814991n 597427X 1269750*aA 3469034 2233387! MAYA}q 3469034e 3175395 660013 6252001 2921044 1819730 6252001 6252001 6252001 2077456 6252001 2921044 1269750 718075 vllll WHITE GRAY GRAYGRAYGRAYGRAYGRAYGRAYGRAYGRAY GRAY GRAY GRAYGRAY 6 q <  Dq a6 .x78Z/{indexi ''?tablelast_synclistlast_synclist CREATE TABLE "last_synclist" ("name" VARCHAR(255) NOT NULL PRIMARY KEY, "timestamp" REAL)i;m ##!tableignore_listignore_list CREATE TABLE "ignore_list" ("ip" VARCHAR(255) NOT NULL, "network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, PRIMARY KEY ("network_address", "netmask", "version"))5 I#indexsqlite_autoindex_ignore_list_1ignore_list )''tableiplistpurposeiplistpurposeCREATE TABLE "iplistpurpose" ("purpose" VARCHAR(255) NOT NULL, "iplist_id" INTEGER NOT NULL, PRIMARY KEY ("purpose", "iplist_id"))9M'indexsqlite_autoindex_iplistpurpose_1iplistpurpose %%AtableiplistrecordiplistrecordCREATE TABLE "iplistrecord" ("network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, "iplist_id" INTEGER NOT NULL, PRIMARY KEY ("network_address", "netmask", "version", "iplist_id"))7K%indexsqlite_autoindex_iplistrecord_1iplistrecordYtableiplistiplistCREATE TABLE "iplist" ("ip" VARCHAR(255) NOT NULL, "listname" VARCHAR(255) NOT NULL CHECK (listname in ('WHITE','BLACK','GRAY','GRAY_SPLASHSCREEN')), "expiration" INTEGER, "imported_from" VARCHAR(255), "ctime" INTEGER, "deep" INTEGER, "comment" VARCHAR(255), "country_id" VARCHAR(255), "captcha_passed" INTEGER NOT NULL, "manual" INTEGER NOT NULL, "full_access" INTEGER, "auto_whitelisted" INTEGER, "network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, "scope" VARCHAR(255) CHECK (scope in ('local','group')), PRIMARY KEY ("network_address", "netmask", "version", "listname"))+?indexsqlite_autoindex_iplist_1iplistd1indexincident_timestampincidentCREATE INDEX "incident_timestamp" ON "incident" ("timestamp")&tableincidentincidentCREATE TABLE "incident" ("id" INTEGER PRIMARY KEY, "plugin" VARCHAR(255), "rule" VARCHAR(255), "timestamp" REAL, "retries" INTEGER, "severity" INTEGER, "name" VARCHAR(255), "description" VARCHAR(255), "abuser" VARCHAR(255), "country_id" VARCHAR(255), "domain" TEXT) qhzhhhi iWU iri:iiiFi ii i io ic iI j@ I J<j =7/indexignoredbyport_country_idignored_by_port_protoCREATE INDEX "ignoredbyport_country_id" ON "ignored_by_port_proto" ("country_id")B[indexiplist_ipiplistCREATE INDEX "iplist_ip" ON iplist (ip)Z/{indexiplist_expirationiplistCREATE INDEX "iplist_expiration" ON iplist (expiration)T+sindexiplist_listnameiplistCREATE INDEX "iplist_listname" ON iplist (listname)Z/{indexiplist_country_idiplistCREATE INDEX "iplist_country_id" ON iplist (country_id)c3indexincident_country_idincidentCREATE INDEX "incident_country_id" ON incident (country_id)M77indexignored_by_port_proto_country_idignored_by_port_protoCREATE INDEX "ignored_by_port_proto_country_id" ON ignored_by_port_proto (country_id)'I7[indexignoredbyport_port_proto_id_ipignored_by_port_protoCREATE UNIQUE INDEX "ignoredbyport_port_proto_id_ip" ON "ignored_by_port_proto" ("port_proto_id", "ip")C7;indexignoredbyport_port_proto_idignored_by_port_protoCREATE INDEX "ignoredbyport_port_proto_id" ON "ignored_by_port_proto" ("port_proto_id")277tableignored_by_port_protoignored_by_port_protoCREATE TABLE ignored_by_port_proto ( "id" INTEGER NOT NULL PRIMARY KEY, "port_proto_id" INTEGER NOT NULL, "ip" VARCHAR(255) NOT NULL, "comment" VARCHAR(255), "network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, "country_id" VARCHAR(255), FOREIGN KEY ("port_proto_id") REFERENCES "blocked_port" ("id") ON DELETE CASCADE )9%-indexblockedport_port_protoblocked_portCREATE UNIQUE INDEX "blockedport_port_proto" ON "blocked_port" ("port", "proto")[%%ytableblocked_portblocked_portCREATE TABLE "blocked_port" ("id" INTEGER NOT NULL PRIMARY KEY, "port" INTEGER NOT NULL, "proto" VARCHAR(255) NOT NULL CHECK (proto in ('tcp', 'udp', 'all')), "comment" VARCHAR(255))$ --{tablemessages_to_sendmessages_to_sendCREATE TABLE "messages_to_send" ("id" INTEGER NOT NULL PRIMARY KEY, "timestamp" REAL NOT NULL, "message" BLOB NOT NULL)9 M'indexsqlite_autoindex_last_synclist_1last_synclist BU 0dvvv'201.22.53.135'31.57.112.164'46.62.209.187)104.152.52.213!2.58.84.67'47.76.240.198'50.207.23.120%3.131.215.38%3.134.148.59)203.16.241.212 %3.137.73.221 !2.58.84.61 '139.59.57.131%188.44.20.25   @ ] 8r  -q' ossec13001i2Exim Auth failed2025-11-17 11:35:18 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:34706: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)103.29.235.441269750h  -_% ossec13001i2Exim Auth failed2025-11-17 11:36:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:53868: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284x  -}' ossec13001i2Exim Auth failed2025-11-17 11:35:35 dovecot_login authenticator failed for 40.55.142.133.rev.iijmobile.jp [133.142.55.40]:41425: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)133.142.55.401861060 W' ossec9708i2Dovecot Aborted Login with empty userNov 17 11:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9ol2QstDarqxV3kv>177.87.121.473469034  -3% ossec13001i2Exim Auth failed2025-11-17 11:35:21 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:55852: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused36.255.98.511668284C  77 ossec502i2Ossec server started.ossec: Ossec started.0  ; ossec9703i2Dovecot is Starting Up.Nov 17 11:35:46 hosting dovecot: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)^  -K% ossec13001i2Exim Auth failed2025-11-17 11:34:54 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:56112: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284p  -m' ossec13001i2Exim Auth failed2025-11-17 11:34:52 dovecot_login authenticator failed for ([10.143.41.218]) [143.244.47.88]:54474: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)143.244.47.886252001D  Gy+ ossec9706i2Dovecot Session Disconnected.Nov 17 11:35:15 hosting dovecot: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=, method=PLAIN, rip=179.163.173.227, lip=200.150.196.245, TLS, session=179.163.173.2273469034T  G!# ossec9706i2Dovecot Session Disconnected.Nov 17 11:35:09 hosting dovecot: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=, method=PLAIN, rip=52.97.42.13, lip=200.150.196.245, TLS: Connection closed, session=<0wacQMtD4Ms0YSoN>52.97.42.133469034`  -Q% ossec13001i2Exim Auth failed2025-11-17 11:35:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:59340: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758V e' ossec9710i2Dovecot Auth failed on disconnected session.Nov 17 11:35:03 hosting dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=45.71.210.237, lip=200.150.196.245, TLS: Connection closed, session=45.71.210.2373469034  W' ossec9708i2Dovecot Aborted Login with empty userNov 17 11:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  G' ossec9706i2Dovecot Session Disconnected.Nov 17 11:34:55 hosting dovecot: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.38, lip=200.150.196.245, TLS, session=<6PRDQMtD7P4jy9Mm>35.203.211.382635167C  77 ossec502i2Ossec server started.ossec: Ossec started. 6 N d r  -u# ossec13001i3 Exim Auth failed2025-11-17 11:36:58 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:42254: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)92.62.74.411527747o  -m% ossec13001i3Exim Auth failed2025-11-17 11:36:52 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:34199: 535 Incorrect authentication data (set_id=compras.ricardo)74.62.20.1706252001e  -Y% ossec13001i3Exim Auth failed2025-11-17 11:36:50 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54661: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284g  -]% ossec13001i3Exim Auth failed2025-11-17 11:37:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:64508: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284  -# ossec13001i2Exim Auth failed2025-11-17 11:35:45 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:38420: 435 Unable to authenticate at present: authentication socket read error or premature eof31.41.84.98798544y  -% ossec13001i2Exim Auth failed2025-11-17 11:35:45 dovecot_login authenticator failed for ([123.121.0.32]) [123.121.0.32]:44254: 435 Unable to authenticate at present: authentication socket read error or premature eof123.121.0.321814991p  -o% ossec13001i2Exim Auth failed2025-11-17 11:35:45 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:60736: 435 Unable to authenticate at present: authentication socket read error or premature eof36.255.98.431668284q  -k+ ossec13001i2Exim Auth failed2025-11-17 11:35:38 dovecot_login authenticator failed for (visaotur.sdr.gvt.net.br) [186.215.245.175]:33635: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)186.215.245.1753469034  -5' ossec13001i2Exim Auth failed2025-11-17 11:35:21 dovecot_login authenticator failed for (ADMIN) [69.164.244.63]:55906: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused69.164.244.636252001p  SE) ossec11000i2Login failed on the cpanel service.[2025-11-17 11:35:16 -0300] info [cpaneld] 152.42.163.119 - OIxlhfZ8< "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified152.42.163.1191880251V  -9' ossec13001i2Exim Auth failed2025-11-17 11:36:06 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:53827: 535 Incorrect authentication data (set_id=contato)222.100.159.21835841^  -K% ossec13001i2Exim Auth failed2025-11-17 11:35:57 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:57839: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284g  -]% ossec13001i2Exim Auth failed2025-11-17 11:35:39 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:57003: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284e  -[# ossec13001i2Exim Auth failed2025-11-17 11:35:44 dovecot_login authenticator failed for ([14.48.112.8]) [14.48.112.8]:2107: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)14.48.112.81835841Z  -A' ossec13001i2Exim Auth failed2025-11-17 11:35:41 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61544: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044j  -a' ossec13001i2Exim Auth failed2025-11-17 11:35:30 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61631: 535 Incorrect authentication data (set_id=rafael)184.57.39.1706252001 !+ L V x _ ~!Z0  -A' ossec13001i3EExim Auth failed2025-11-17 11:37:57 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:59741: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044/  W' ossec9708i3-Dovecot Aborted Login with empty userNov 17 11:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d.  -U' ossec13001i3Exim Auth failed2025-11-17 11:37:16 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:36092: 535 Incorrect authentication data (set_id=adriana)79.160.128.463144096^-  -K% ossec13001i3PExim Auth failed2025-11-17 11:38:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:63274: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284g,  -]% ossec13001i3LExim Auth failed2025-11-17 11:38:03 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:49244: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284+  -# ossec13001i3LExim Auth failed2025-11-17 11:38:03 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:43206: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)50.4.40.2476252001e*  -[% ossec13001i3AExim Auth failed2025-11-17 11:37:53 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:54573: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758`)  -Q% ossec13001i2Exim Auth failed2025-11-17 11:36:22 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49215: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758e(  -[% ossec13001i2Exim Auth failed2025-11-17 11:36:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:50258: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758^'  -K% ossec13001i3Exim Auth failed2025-11-17 11:37:03 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:60033: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284& W' ossec9708i2Dovecot Aborted Login with empty userNov 17 11:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[% -A' ossec13001i2Exim Auth failed2025-11-17 11:36:27 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:58097: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044s$  -s' ossec13001i2Exim Auth failed2025-11-17 11:36:37 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:51736: 535 Incorrect authentication data (set_id=compras.ricardo@maringasoldas.com.br)114.98.235.341814991\#  -G% ossec13001i2Exim Auth failed2025-11-17 11:36:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:59162: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284Z"  -C' ossec13001i3Exim Auth failed2025-11-17 11:37:08 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3236: 535 Incorrect authentication data (set_id=alex.vendas)213.55.85.202337996u!  -w) ossec13001i3Exim Auth failed2025-11-17 11:36:51 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:39726: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)196.188.187.21337996 *  < [ j *\A  -G% ossec13001i3}Exim Auth failed2025-11-17 11:38:52 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:60859: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284l@  -c) ossec13001i3}Exim Auth failed2025-11-17 11:38:53 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:51116: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)123.209.78.1312077456Z?  -A) ossec13001i3wExim Auth failed2025-11-17 11:38:46 dovecot_login authenticator failed for ([196.189.44.177]) [196.190.157.32]:1348: 535 Incorrect authentication data (set_id=financeiro)196.190.157.32337996g>  -]% ossec13001i3Exim Auth failed2025-11-17 11:39:01 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:63957: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284Z=  -A' ossec13001i3qExim Auth failed2025-11-17 11:38:41 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:50095: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044< W' ossec9708i3iDovecot Aborted Login with empty userNov 17 11:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f;  -[% ossec13001i3Exim Auth failed2025-11-17 11:39:00 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:40152: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)36.135.62.831814991e:  -Y% ossec13001i3sExim Auth failed2025-11-17 11:38:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54325: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284v9  -u+ ossec13001i3iExim Auth failed2025-11-17 11:38:32 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [122.166.209.182]:37454: 535 Incorrect authentication data (set_id=administrativo1)122.166.209.1821269750h8  -_% ossec13001i3YExim Auth failed2025-11-17 11:38:17 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:54485: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284n7  -i' ossec13001i3Exim Auth failed2025-11-17 11:39:15 dovecot_login authenticator failed for (dynamic.vdc.vn) [123.24.126.18]:35888: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)123.24.126.181562822^6  -G) ossec13001i3Exim Auth failed2025-11-17 11:39:14 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:51992: 535 Incorrect authentication data (set_id=atualizacoes)122.184.127.861269750`5  -Q% ossec13001i3Exim Auth failed2025-11-17 11:39:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:53920: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758^4  -K% ossec13001i3Exim Auth failed2025-11-17 11:39:07 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:49398: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284]3 -I# ossec13001i3{Exim Auth failed2025-11-17 11:38:50 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:50294: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)84.54.33.702750405{2  -' ossec13001i3iExim Auth failed2025-11-17 11:38:33 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:43008: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)136.56.34.14762520011  k' ossec9709i3LMultiple Dovecot Aborted Logins with empty userNov 17 11:38:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 s*O q X ~ 1V[seR  -Y% ossec13001i3Exim Auth failed2025-11-17 11:40:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:53340: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284xQ  -}' ossec13001i3Exim Auth failed2025-11-17 11:40:30 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:52283: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)111.70.23.2401668284XP  -A# ossec13001i3Exim Auth failed2025-11-17 11:40:26 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:51740: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)84.54.33.702750405hO  -_% ossec13001i3Exim Auth failed2025-11-17 11:40:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:52499: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284ZN  -C% ossec13001i3Exim Auth failed2025-11-17 11:39:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:63716: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284iM  -]) ossec13001i3Exim Auth failed2025-11-17 11:39:26 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:52360: 535 Incorrect authentication data (set_id=contato)223.197.166.781819730L  -' ossec13001i3Exim Auth failed2025-11-17 11:39:21 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:45066: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)88.11.230.1602510769\K  -E' ossec13001i3Exim Auth failed2025-11-17 11:40:07 dovecot_login authenticator failed for (1rfWlBx) [91.92.243.111]:57528: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)91.92.243.1116252001xJ  -{) ossec13001i3Exim Auth failed2025-11-17 11:39:43 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:58054: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)152.52.236.1581269750eI  -[% ossec13001i3Exim Auth failed2025-11-17 11:39:26 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:54350: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758gH  -]% ossec13001i3Exim Auth failed2025-11-17 11:39:58 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:55414: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284eG  -Y% ossec13001i3Exim Auth failed2025-11-17 11:39:40 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:62770: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284WF  -=% ossec13001i3Exim Auth failed2025-11-17 11:39:35 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:48284: 535 Incorrect authentication data (set_id=financeiro)115.77.111.21562822E W' ossec9708i3Dovecot Aborted Login with empty userNov 17 11:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[D -A' ossec13001i3Exim Auth failed2025-11-17 11:39:29 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:54466: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044XC  -C% ossec13001i3Exim Auth failed2025-11-17 11:40:02 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:54184: 535 Incorrect authentication data (set_id=isabellylisboa)65.20.175.7599237SB  -3' ossec13001i3Exim Auth failed2025-11-17 11:39:36 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:38477: 535 Incorrect authentication data (set_id=info)178.68.91.1192017370 d. { c  . )Af|Mdfc  -[% ossec13001i40Exim Auth failed2025-11-17 11:41:51 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:42794: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)45.251.69.121269750,b  e/' ossec9710i4 Dovecot Auth failed on disconnected session.Nov 17 11:41:34 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.82.53.112, lip=200.150.196.245, TLS, session=170.82.53.1123469034ga  -]% ossec13001i44Exim Auth failed2025-11-17 11:41:55 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:56783: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284X`  -;) ossec13001i42Exim Auth failed2025-11-17 11:41:52 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:52522: 535 Incorrect authentication data (set_id=cpfnc2)220.180.204.321814991e_  -[% ossec13001i4.Exim Auth failed2025-11-17 11:41:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:62580: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758`^  -Q% ossec13001i4(Exim Auth failed2025-11-17 11:41:43 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49247: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758]  k' ossec9709i4Multiple Dovecot Aborted Logins with empty userNov 17 11:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\\  -G% ossec13001i4Exim Auth failed2025-11-17 11:41:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:51537: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284Z[  -A' ossec13001i3Exim Auth failed2025-11-17 11:40:58 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:62250: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044dZ  -Q+ ossec13001i4Exim Auth failed2025-11-17 11:41:03 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64838: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651WY  -9) ossec13001i3Exim Auth failed2025-11-17 11:40:54 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:35130: 535 Incorrect authentication data (set_id=rafael)122.184.120.981269750RX  -1' ossec13001i3Exim Auth failed2025-11-17 11:40:39 dovecot_login authenticator failed for (0AB6vTht) [91.92.243.111]:54962: 535 Incorrect authentication data (set_id=marialuiza)91.92.243.1116252001`W  -Q% ossec13001i3Exim Auth failed2025-11-17 11:40:32 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:60464: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758V  W' ossec9708i3Dovecot Aborted Login with empty userNov 17 11:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340U  AU+ ossec10100i4First time user logged in.Nov 17 11:41:11 hosting sshd[17186]: Accepted password for root from 191.243.199.212 port 57884 ssh2191.243.199.2123469034gT  -]% ossec13001i3Exim Auth failed2025-11-17 11:41:00 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:53479: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284eS  -[% ossec13001i3Exim Auth failed2025-11-17 11:41:01 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:52699: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758 q ' ? b 5Rq^t  -I' ossec13001i4rExim Auth failed2025-11-17 11:42:57 dovecot_login authenticator failed for (KAZu4PZVA) [91.92.243.111]:56642: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)91.92.243.1116252001`s  -Q% ossec13001i4lExim Auth failed2025-11-17 11:42:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:54664: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758Vr  -7) ossec13001i4hExim Auth failed2025-11-17 11:42:46 dovecot_login authenticator failed for ([183.237.33.162]) [183.237.33.162]:62064: 535 Incorrect authentication data (set_id=info)183.237.33.1621814991eq  -Y% ossec13001i4\Exim Auth failed2025-11-17 11:42:35 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:59974: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284hp  -_% ossec13001i4LExim Auth failed2025-11-17 11:42:19 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:59966: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284eo  -[% ossec13001i4Exim Auth failed2025-11-17 11:43:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:63913: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758_n  -M% ossec13001i4FExim Auth failed2025-11-17 11:42:12 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:33676: 535 Incorrect authentication data (set_id=contato)117.2.123.191562822m  -' ossec13001i4Exim Auth failed2025-11-17 11:41:33 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:43472: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)73.128.150.676252001_l -E+ ossec13001i4Exim Auth failed2025-11-17 11:41:25 dovecot_login authenticator failed for (brinquelocacoes.com) [111.122.211.212]:55902: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991~k  - ' ossec13001i4Exim Auth failed2025-11-17 11:41:21 dovecot_login authenticator failed for host250.sub-63-47-135.myvzw.com [63.47.135.250]:50513: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)63.47.135.2506252001kj  -c' ossec13001i4DExim Auth failed2025-11-17 11:42:10 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:58974: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)95.220.47.2422017370^i  -K% ossec13001i4DExim Auth failed2025-11-17 11:42:10 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:52776: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284Zh  -A' ossec13001i4.Exim Auth failed2025-11-17 11:41:48 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:57858: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044eg  -Y% ossec13001i4"Exim Auth failed2025-11-17 11:41:37 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:64228: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284Zf  -C% ossec13001i4 Exim Auth failed2025-11-17 11:41:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:59916: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284e W' ossec9708i4Dovecot Aborted Login with empty userNov 17 11:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`d -K' ossec13001i4Exim Auth failed2025-11-17 11:41:30 dovecot_login authenticator failed for (RWf34COSiN) [91.92.243.111]:51160: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)91.92.243.1116252001 #  0  & <Kh[ -A' ossec13001i4Exim Auth failed2025-11-17 11:43:19 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61531: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044f  -W) ossec13001i4Exim Auth failed2025-11-17 11:43:18 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:52740: 535 Incorrect authentication data (set_id=contato)187.126.105.423469034Z  -C% ossec13001i4Exim Auth failed2025-11-17 11:44:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:58234: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284i  -_' ossec13001i4Exim Auth failed2025-11-17 11:44:05 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:52667: 535 Incorrect authentication data (set_id=contato)220.246.36.421819730  k' ossec9709i4Multiple Dovecot Aborted Logins with empty userNov 17 11:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U -5' ossec13001i4Exim Auth failed2025-11-17 11:43:34 dovecot_login authenticator failed for (2xx40lK0ND) [91.92.243.111]:49275: 535 Incorrect authentication data (set_id=marialuiza)91.92.243.1116252001e~  -Y% ossec13001i4Exim Auth failed2025-11-17 11:43:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54763: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284`}  -Q% ossec13001i4Exim Auth failed2025-11-17 11:44:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:63401: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758n|  -g) ossec13001i4Exim Auth failed2025-11-17 11:44:11 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:38144: 535 Incorrect authentication data (set_id=atualizacoes1)221.120.57.1251668284g{  -]% ossec13001i4Exim Auth failed2025-11-17 11:43:56 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:54180: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284oz  -i) ossec13001i4Exim Auth failed2025-11-17 11:43:35 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:56061: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)83.239.171.2262017370y  W' ossec9708i4Dovecot Aborted Login with empty userNov 17 11:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2XQKX8tDquKxV3kv>177.87.121.473469034gx  -]% ossec13001i4vExim Auth failed2025-11-17 11:43:00 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:62144: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284mw  -e) ossec13001i4dExim Auth failed2025-11-17 11:42:43 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:51807: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)177.174.95.2453469034v W' ossec9708i4ZDovecot Aborted Login with empty userNov 17 11:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Zu  -A' ossec13001i4ZExim Auth failed2025-11-17 11:42:32 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:49681: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044  4 I ` F dm W' ossec9708i5 Dovecot Aborted Login with empty userNov 17 11:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0mIxZstDJK+xV3kv>177.87.121.473469034g  -]% ossec13001i5$Exim Auth failed2025-11-17 11:45:55 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:52551: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284^  -K% ossec13001i5Exim Auth failed2025-11-17 11:45:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:51849: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284s  -s' ossec13001i5Exim Auth failed2025-11-17 11:45:38 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:47508: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)36.135.100.481814991\  -G% ossec13001i4Exim Auth failed2025-11-17 11:44:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:57752: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284f  -Y' ossec13001i4Exim Auth failed2025-11-17 11:45:09 dovecot_login authenticator failed for ([112.27.129.78]) [112.27.129.78]:41103: 535 Incorrect authentication data (set_id=ms@maringasoldas.com.br)112.27.129.7818149910  UC) ossec11001i4Deferred login on the cpanel service[2025-11-17 11:45:01 -0300] info [webmaild] 181.77.193.194 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect181.77.193.1943469034h  -_% ossec13001i4Exim Auth failed2025-11-17 11:44:48 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:60545: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284S  -3' ossec13001i4Exim Auth failed2025-11-17 11:44:35 dovecot_login authenticator failed for (fUqb91QF1) [91.92.243.111]:61204: 535 Incorrect authentication data (set_id=marialuiza)91.92.243.1116252001^  -K% ossec13001i4Exim Auth failed2025-11-17 11:44:35 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:64011: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284 W' ossec9708i4Dovecot Aborted Login with empty userNov 17 11:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7mOjYstD2pOxV3kv>177.87.121.473469034e  -Y% ossec13001i4Exim Auth failed2025-11-17 11:44:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:49790: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284g  -]% ossec13001i4Exim Auth failed2025-11-17 11:44:54 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:58240: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284Z  -A' ossec13001i4Exim Auth failed2025-11-17 11:44:45 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61846: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044e  -[% ossec13001i4Exim Auth failed2025-11-17 11:44:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:64905: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758  - ) ossec13001i4Exim Auth failed2025-11-17 11:43:38 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:47666: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)125.19.154.1581269750 & = W s %:QmTrh%  -_% ossec13001i5ZExim Auth failed2025-11-17 11:46:50 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:65044: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284^$  -K% ossec13001i5XExim Auth failed2025-11-17 11:46:47 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:56290: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284#  W' ossec9708i5HDovecot Aborted Login with empty userNov 17 11:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1LbDactDQNCxV3kv>177.87.121.473469034`"  -Q% ossec13001i5DExim Auth failed2025-11-17 11:46:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:53326: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758e!  -[% ossec13001i5tExim Auth failed2025-11-17 11:47:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:50376: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758g  -]% ossec13001i5lExim Auth failed2025-11-17 11:47:08 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:62118: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284Z  -C% ossec13001i5\Exim Auth failed2025-11-17 11:46:51 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:51870: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284e  -Y% ossec13001i5VExim Auth failed2025-11-17 11:46:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:55409: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284[ -A' ossec13001i5:Exim Auth failed2025-11-17 11:46:16 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:57485: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044e  -[% ossec13001i5$Exim Auth failed2025-11-17 11:45:56 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:65248: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758^  -G) ossec13001i5Exim Auth failed2025-11-17 11:45:47 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:54568: 535 Incorrect authentication data (set_id=atualizacoes)152.52.231.2021269750Y  -A% ossec13001i5Exim Auth failed2025-11-17 11:45:19 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:35580: 535 Incorrect authentication data (set_id=ms)85.19.195.123144096`  -Q% ossec13001i5Exim Auth failed2025-11-17 11:45:18 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49781: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758b  -Q) ossec13001i5&Exim Auth failed2025-11-17 11:45:58 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:25322: 535 Incorrect authentication data (set_id=contato)178.150.135.19690791e  -Y% ossec13001i5 Exim Auth failed2025-11-17 11:45:32 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:52486: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284Z  -A' ossec13001i5 Exim Auth failed2025-11-17 11:45:32 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:52968: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044x  -}' ossec13001i5 Exim Auth failed2025-11-17 11:45:31 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:57902: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)111.70.23.2401668284   4 S q W}D[\#)>e[5 -A' ossec13001i5Exim Auth failed2025-11-17 11:48:27 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:58832: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044U4  -7' ossec13001i5Exim Auth failed2025-11-17 11:49:08 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:54666: 535 Incorrect authentication data (set_id=eduardo)182.66.214.701269750g3  -]% ossec13001i5Exim Auth failed2025-11-17 11:49:02 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:49837: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284v2  -y' ossec13001i5Exim Auth failed2025-11-17 11:48:37 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:16912: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)87.103.126.54226439751 UK) ossec11001i5zDeferred login on the cpanel service[2025-11-17 11:47:20 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess8351698287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034{0  -' ossec13001i5vExim Auth failed2025-11-17 11:47:18 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:40809: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)177.159.99.953469034e/  -Y% ossec13001i5Exim Auth failed2025-11-17 11:48:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:56826: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.5116682845.  eC% ossec9710i5Dovecot Auth failed on disconnected session.Nov 17 11:47:56 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=85.248.40.27, lip=200.150.196.245, TLS, session=85.248.40.273057568V-  -;% ossec13001i5Exim Auth failed2025-11-17 11:47:40 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:44972: 535 Incorrect authentication data (set_id=financeiro)1.82.135.1541814991, W' ossec9708i5Dovecot Aborted Login with empty userNov 17 11:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^+  -K% ossec13001i5Exim Auth failed2025-11-17 11:47:40 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:55872: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284]* -I# ossec13001i5|Exim Auth failed2025-11-17 11:47:24 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:33064: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)84.54.33.702750405g)  -]% ossec13001i5Exim Auth failed2025-11-17 11:48:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:51025: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284Z(  -A' ossec13001i5Exim Auth failed2025-11-17 11:47:42 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:50717: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044'  k' ossec9709i5hMultiple Dovecot Aborted Logins with empty userNov 17 11:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\&  -G% ossec13001i5`Exim Auth failed2025-11-17 11:46:54 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:49909: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284  , C U Y lReygE  -]% ossec13001i6Exim Auth failed2025-11-17 11:49:58 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:57829: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284YD  -=) ossec13001i6Exim Auth failed2025-11-17 11:49:53 dovecot_login authenticator failed for ([106.91.215.100]) [106.91.215.100]:57668: 535 Incorrect authentication data (set_id=eduardo)106.91.215.1001814991ZC  -C% ossec13001i6Exim Auth failed2025-11-17 11:49:43 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:60643: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.4316682845B UK) ossec11001i5Deferred login on the cpanel service[2025-11-17 11:48:20 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess8351698287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034XA  -A# ossec13001i5Exim Auth failed2025-11-17 11:49:00 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:60830: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)84.54.33.702750405^@  -K% ossec13001i5Exim Auth failed2025-11-17 11:48:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:58566: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284h?  -_% ossec13001i5Exim Auth failed2025-11-17 11:48:45 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:63945: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284i>  -a' ossec13001i5Exim Auth failed2025-11-17 11:48:34 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:50535: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795= W' ossec9708i5Dovecot Aborted Login with empty userNov 17 11:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i<  -c' ossec13001i5Exim Auth failed2025-11-17 11:48:24 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:55639: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)65.20.167.11799237x;  -{) ossec13001i5Exim Auth failed2025-11-17 11:48:19 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:43213: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)71.208.122.1856252001j:  -_) ossec13001i5Exim Auth failed2025-11-17 11:49:10 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:54803: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)103.174.145.351269750e9  -Y% ossec13001i5Exim Auth failed2025-11-17 11:49:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:60847: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284`8  -Q% ossec13001i5Exim Auth failed2025-11-17 11:48:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:58927: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758Y7  -=) ossec13001i5Exim Auth failed2025-11-17 11:48:42 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:57434: 535 Incorrect authentication data (set_id=contato)191.59.214.16834690346  -'+ ossec13001i5Exim Auth failed2025-11-17 11:49:00 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:35760: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)177.207.248.1413469034 ) L ) E - :2G^~SU  -5% ossec13001i6(Exim Auth failed2025-11-17 11:50:15 dovecot_login authenticator failed for ([111.26.62.46]) [111.26.62.46]:40958: 535 Incorrect authentication data (set_id=adriana)111.26.62.461814991gT  -[' ossec13001i6Exim Auth failed2025-11-17 11:50:05 dovecot_login authenticator failed for ([106.91.215.99]) [106.91.215.99]:45359: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)106.91.215.991814991pS  -m' ossec13001i6 Exim Auth failed2025-11-17 11:49:45 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:53080: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)213.234.8.1142017370zR  -}+ ossec13001i6Exim Auth failed2025-11-17 11:49:35 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:47068: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)213.230.127.2171512440\Q  -G% ossec13001i5Exim Auth failed2025-11-17 11:49:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:52926: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284eP  -Y% ossec13001i6Exim Auth failed2025-11-17 11:50:01 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:59635: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284gO  -[' ossec13001i5Exim Auth failed2025-11-17 11:49:32 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:38200: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)182.95.51.1661269750N  -) ossec13001i6(Exim Auth failed2025-11-17 11:50:15 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:44508: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)58.182.111.1621880251VM  -9' ossec13001i6Exim Auth failed2025-11-17 11:49:44 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:57297: 535 Incorrect authentication data (set_id=contato)5.140.212.1442017370L  W' ossec9708i5Dovecot Aborted Login with empty userNov 17 11:49:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034K  -5' ossec13001i6Exim Auth failed2025-11-17 11:50:03 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:57924: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)125.23.140.541269750`J  -Q% ossec13001i6$Exim Auth failed2025-11-17 11:50:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49558: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758I  k' ossec9709i6Multiple Dovecot Aborted Logins with empty userNov 17 11:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YH  -=) ossec13001i6Exim Auth failed2025-11-17 11:50:02 dovecot_login authenticator failed for ([128.185.166.65]) [182.95.222.118]:52602: 535 Incorrect authentication data (set_id=contato)182.95.222.1181269750jG  -_) ossec13001i5Exim Auth failed2025-11-17 11:49:23 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:34514: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)195.222.57.1903277605eF  -[% ossec13001i5Exim Auth failed2025-11-17 11:49:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:55705: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758 D  ( ? ag~/Dgf  -]% ossec13001i6PExim Auth failed2025-11-17 11:50:56 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:60804: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284he  -_% ossec13001i6FExim Auth failed2025-11-17 11:50:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:64869: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284Zd  -A' ossec13001i6FExim Auth failed2025-11-17 11:50:45 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61108: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044Sc  -7% ossec13001i64Exim Auth failed2025-11-17 11:50:28 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:56738: 535 Incorrect authentication data (set_id=salamuni)5.11.162.163298795^b  -K% ossec13001i6>Exim Auth failed2025-11-17 11:50:37 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:61931: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284_a -G) ossec13001i68Exim Auth failed2025-11-17 11:50:32 dovecot_login authenticator failed for (User) [177.74.174.120]:56190: 535 Incorrect authentication data (set_id=default@inovasite.com.br)177.74.174.1203469034e`  -S+ ossec13001i68Exim Auth failed2025-11-17 11:50:31 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:47552: 535 Incorrect authentication data (set_id=andre.nascimento)177.236.145.1883996063e_  -[% ossec13001i6dExim Auth failed2025-11-17 11:51:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:57701: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758^ W' ossec9708i68Dovecot Aborted Login with empty userNov 17 11:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\]  -A+ ossec13001i6.Exim Auth failed2025-11-17 11:50:21 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:46876: 535 Incorrect authentication data (set_id=contato)123.209.104.1422077456Z\  -A' ossec13001i6Exim Auth failed2025-11-17 11:50:00 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:50921: 535 Incorrect authentication data (set_id=janine@transol.com.br)77.90.185.2312921044e[  -U+ ossec13001i6Exim Auth failed2025-11-17 11:49:42 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:62650: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795VZ  -9' ossec13001i5Exim Auth failed2025-11-17 11:49:26 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:64050: 535 Incorrect authentication data (set_id=eduardo)103.174.34.491269750[Y  -?+ ossec13001i6Exim Auth failed2025-11-17 11:50:00 dovecot_login authenticator failed for ([178.232.116.165]) [178.232.116.165]:33383: 535 Incorrect authentication data (set_id=cpfnc2)178.232.116.1653144096wX  -# ossec13001i6 Exim Auth failed2025-11-17 11:49:47 dovecot_login authenticator failed for (static.38.23.53.80.macminivault.com) [38.23.53.80]:65452: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)38.23.53.806252001gW  -[' ossec13001i5Exim Auth failed2025-11-17 11:49:32 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:38427: 535 Incorrect authentication data (set_id=isabellylisboa)152.231.25.6436861105V UK) ossec11001i5Deferred login on the cpanel service[2025-11-17 11:49:20 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess8351698287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034  * A r X x  gv  -]% ossec13001i6Exim Auth failed2025-11-17 11:52:52 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:57847: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284Zu  -C% ossec13001i6Exim Auth failed2025-11-17 11:52:25 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:61010: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284st  -q) ossec13001i6Exim Auth failed2025-11-17 11:52:22 dovecot_login authenticator failed for ([177.135.64.89]) [177.135.67.189]:49292: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)177.135.67.1893469034ls  -c) ossec13001i6Exim Auth failed2025-11-17 11:53:09 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:42321: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)118.45.101.1591835841\r  -E' ossec13001i6Exim Auth failed2025-11-17 11:52:32 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:36478: 535 Incorrect authentication data (set_id=ferramentaria)188.231.3.2463017382eq  -[% ossec13001i6Exim Auth failed2025-11-17 11:52:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:56177: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.141307585p  eG# ossec9710i6Dovecot Auth failed on disconnected session.Nov 17 11:51:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=89.186.1.86, lip=200.150.196.245, TLS, session=89.186.1.86798544go  -]% ossec13001i6Exim Auth failed2025-11-17 11:51:53 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:54156: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284in  -[+ ossec13001i6Exim Auth failed2025-11-17 11:51:45 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:57880: 535 Incorrect authentication data (set_id=ilumix@ilumix.com.br)121.160.166.1611835841`m  -Q% ossec13001i6Exim Auth failed2025-11-17 11:51:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:56674: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758\l  -G% ossec13001i6zExim Auth failed2025-11-17 11:51:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:64738: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284k W' ossec9708i6vDovecot Aborted Login with empty userNov 17 11:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Kj  -+ ossec13001i6Exim Auth failed2025-11-17 11:52:13 dovecot_login authenticator failed for ([182.252.140.114]) [182.252.140.114]:59937: 535 Incorrect authentication data182.252.140.1141835841ei  -Y% ossec13001i6RExim Auth failed2025-11-17 11:50:58 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:59977: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284ih  -_' ossec13001i6BExim Auth failed2025-11-17 11:50:41 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:52334: 535 Incorrect authentication data (set_id=juridico)71.235.27.1396252001eg  -[# ossec13001i64Exim Auth failed2025-11-17 11:50:27 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:47561: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)221.2.40.101814991 2 o F ] D ! G[,2v  -{% ossec13001i6Exim Auth failed2025-11-17 11:53:35 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:33208: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)121.18.49.141814991`  -Q% ossec13001i7 Exim Auth failed2025-11-17 11:54:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:56961: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758g  -]% ossec13001i6Exim Auth failed2025-11-17 11:53:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:62868: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284e  -Y% ossec13001i6Exim Auth failed2025-11-17 11:53:47 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:51195: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284^  -K% ossec13001i6Exim Auth failed2025-11-17 11:53:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:63691: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284_  -I+ ossec13001i6Exim Auth failed2025-11-17 11:53:44 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:54012: 535 Incorrect authentication data (set_id=vanessalima)185.255.212.178732800l  -c) ossec13001i6Exim Auth failed2025-11-17 11:53:40 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:38842: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)191.59.214.1683469034e  -[% ossec13001i6Exim Auth failed2025-11-17 11:53:38 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:52400: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758U  -7' ossec13001i6Exim Auth failed2025-11-17 11:52:17 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:40120: 535 Incorrect authentication data (set_id=ilumix)49.246.68.2201835841h~  -_% ossec13001i6Exim Auth failed2025-11-17 11:53:02 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:62302: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284V}  -;% ossec13001i6Exim Auth failed2025-11-17 11:52:17 dovecot_login authenticator failed for (letracaixa.art.br) [60.2.243.174]:44234: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991|  k' ossec9709i6Multiple Dovecot Aborted Logins with empty userNov 17 11:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{  W' ossec9708i6Dovecot Aborted Login with empty userNov 17 11:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ez  -Y% ossec13001i6Exim Auth failed2025-11-17 11:52:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:53026: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284%y  e!' ossec9710i6Dovecot Auth failed on disconnected session.Nov 17 11:52:19 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=161.0.186.190, lip=200.150.196.245, TLS, session=161.0.186.1903895114x  3;! ossec11301i6New FTP connection.Nov 17 11:52:20 hosting pure-ftpd: (?@74.82.47.2) [INFO] New connection from 74.82.47.274.82.47.26252001rw  -q' ossec13001i6Exim Auth failed2025-11-17 11:52:58 dovecot_login authenticator failed for (37.98.253.231-FTTB.planeta.tc) [37.98.253.231]:57971: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)37.98.253.2312017370 @! . C O J 0Ne2@n  -g) ossec13001i7Exim Auth failed2025-11-17 11:56:00 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:56456: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)128.185.199.141269750] -I# ossec13001i7{Exim Auth failed2025-11-17 11:55:54 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:41158: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)84.54.33.702750405Z  -C% ossec13001i7]Exim Auth failed2025-11-17 11:55:25 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:65114: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284`  -Q% ossec13001i7]Exim Auth failed2025-11-17 11:55:25 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:62801: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758^  -K% ossec13001i7WExim Auth failed2025-11-17 11:55:18 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:64389: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284e  -[% ossec13001i7%Exim Auth failed2025-11-17 11:54:29 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:62631: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758a  -M) ossec13001i7GExim Auth failed2025-11-17 11:55:02 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:40081: 535 Incorrect authentication data (set_id=administrativo1)212.57.136.1412017370\  -G% ossec13001i7?Exim Auth failed2025-11-17 11:54:55 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:59476: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284e  -Y% ossec13001i79Exim Auth failed2025-11-17 11:54:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:52333: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284^  -K% ossec13001i73Exim Auth failed2025-11-17 11:54:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:59626: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284 W' ossec9708i7)Dovecot Aborted Login with empty userNov 17 11:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001i73Exim Auth failed2025-11-17 11:54:42 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:33585: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)69.112.28.1816252001p  -m' ossec13001i7KExim Auth failed2025-11-17 11:55:06 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:53562: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)182.95.115.381269750g  -]% ossec13001i77Exim Auth failed2025-11-17 11:54:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:52735: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284U  -7' ossec13001i6Exim Auth failed2025-11-17 11:53:18 dovecot_login authenticator failed for ([183.98.68.199]) [183.98.68.199]:58843: 535 Incorrect authentication data (set_id=bianca)183.98.68.1991835841 W' ossec9708i6Dovecot Aborted Login with empty userNov 17 11:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[  -A) ossec13001i7Exim Auth failed2025-11-17 11:54:12 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:64313: 535 Incorrect authentication data (set_id=comercial)111.59.206.2241814991 + B  1  -8]{`(  -Q% ossec13001i7Exim Auth failed2025-11-17 11:56:45 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49933: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758g'  -Y) ossec13001i7Exim Auth failed2025-11-17 11:56:33 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:57504: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)221.209.48.2031814991& W' ossec9708i7Dovecot Aborted Login with empty userNov 17 11:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6duQjctD0NGxV3kv>177.87.121.473469034[%  -?+ ossec13001i7Exim Auth failed2025-11-17 11:57:03 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:35938: 535 Incorrect authentication data (set_id=junior)121.142.165.1111835841\$  -A+ ossec13001i7Exim Auth failed2025-11-17 11:56:52 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:64125: 535 Incorrect authentication data (set_id=alex.vendas)211.169.212.2061835841f#  -W) ossec13001i7Exim Auth failed2025-11-17 11:56:53 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:35532: 535 Incorrect authentication data (set_id=junior)124.167.20.1161814991^"  -K% ossec13001i7Exim Auth failed2025-11-17 11:56:19 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:49922: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284W!  -=) ossec13001i7Exim Auth failed2025-11-17 11:56:09 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42666: 535 Incorrect authentication data (set_id=contato)196.216.81.12649518q  -s# ossec13001i7{Exim Auth failed2025-11-17 11:55:55 dovecot_login authenticator failed for (89.140.17.22.static.user.ono.com) [81.0.54.119]:42641: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)81.0.54.1192510769g  -]% ossec13001i7yExim Auth failed2025-11-17 11:55:52 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:54460: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)36.255.98.531668284  W' ossec9708i7eDovecot Aborted Login with empty userNov 17 11:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -a' ossec13001i7[Exim Auth failed2025-11-17 11:55:23 dovecot_login authenticator failed for (182.239.80.51.hk.chinamobile.com) [182.239.80.51]:42384: 535 Incorrect authentication data (set_id=financeiro)182.239.80.511819730  k' ossec9709i7Multiple Dovecot Aborted Logins with empty userNov 17 11:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -[% ossec13001i7iExim Auth failed2025-11-17 11:55:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:61018: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758e  -Y% ossec13001i7sExim Auth failed2025-11-17 11:55:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54763: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284h  -_% ossec13001i7gExim Auth failed2025-11-17 11:55:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:51006: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284 ;ibovi\OB5UH6|o2%];(sPL? wu)fjYCui]QD7* t g Z M @ 3 &  } p c V I < / "   y l _ R E 8 +    u h [ N A 4 '  ~ q d W J = 0 #  zm`SF9,vi\OB5(reXK>1$ TG:-  1036973+ 1036973 1036973 5 1036973 1036973W 1210997 1168579 1036973 1168579 1036973L 1210997 10369738 1036973 * 1210997 12109978 1168579( 1168579 1036973 1036973 1168579 1168579 1210997 1210997 1168579p 1036973 j 1036973 > 1036973 1168579 1168579 1168579 1168579 1210997 1210997% 1210997!N 1168579 1036973 1210997 1210997 1036973 1210997% 1168579 1036973&_ 1210997) 1168579+ 1168579+ 1036973*h 1036973) 1036973( 1168579' 1168579' 1168579' 1036973'N 1036973& 1168579& 1168579&\/ 1168579// 1168579. 1168579- 1168579- 1168579- 1210997-~ 1210997-y 1168579, 1168579+ 1269750 1269750 1269750 1269750 1269750 1269750 1269750v 1269750u 1269750t 1269750\ 1269750W 1269750H 1269750= 1269750; 12697506 12697502 1269750- 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750u 1269750t 1269750[ 1269750Y 1269750V 1269750S 1269750Q 1269750M 1269750K 1269750G 1269750A 12697501 1269750& 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750t 1269750p 1269750m 1269750i 1269750g 1269750e 1269750\ 1269750Q 12697507 12697505 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750u 1269750q 1269750j 1269750Y 1269750F 1269750C 1269750A 12697501 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750q 1269750m 1269750k 1269750i 1269750^ 1269750Y 1269750H 1269750C 12697503 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750} 1269750v 1269750r 1269750j 1269750g 1269750_ 1269750S 12697503 12697501 1269750& 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750g 1269750_ 1269750S 1269750M 1269750< 1269750/ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750c 1269750Y 1269750J 12697509 12697506 1269750 1210997 1210997 ; 1210997 1210997 1210997$ 1210997a 1168579 , 1168579 2 1168579 1168579 1168579 1168579H 1036973 1036973 1036973 1036973 1036973 1036973? 1036973 1036973 1036973  %+z   uh[NA4' ~qdWJ=0# E8+zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_R~qdWJ=0 1269750 1269750 1269750 1269750 1269750 1269750w 1269750Y 1269750U 1269750S 1269750D 1269750? 12697507 1269750- 1269750 1269750 1269750 1269750 1269750 1269750 f 1269750 a 1269750 S 1269750 K 1269750 G 1269750 D 1269750 9 1269750 8 1269750 1269750 1269750 1269750 1269750| 1269750x 1269750f 1269750Z 1269750W 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750d 1269750V 1269750H 1269750E 12697509 12697505 12697500 1269750. 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750} 1269750j 1269750c 1269750P 1269750F 1269750C 1269750< 12697500 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750v 1269750s 1269750r 1269750m 1269750f 1269750V 1269750O 1269750: 12697501 1269750/ 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750i 1269750T 1269750A 12697502 12697501 1269750* 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750m 1269750U 1269750N 1269750L 1269750E 1269750D 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 k 1269750 \ 1269750 [ 1269750 0 1269750 / 1269750 . 1269750 - 1269750  1269750  1269750  1269750  1269750  1269750  1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750  1269750 s 1269750 I 1269750 9 1269750 * 1269750 ' 1269750  1269750  1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 w 1269750 u 1269750 b 1269750 S 1269750 Q 1269750 P 1269750 F 1269750 D 1269750 C 1269750 + 1269750 ( 1269750  1269750  1269750  1269750 1269750 1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1 1269750 - 1269750  1269750  1269750  1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 y 1269750 w 1269750 V 1269750 S 1269750 6 1269750 ) 1269750  1269750 1269750 1269750 1269750 1269750 H& K D M U x>bH9 W' ossec9708i7Dovecot Aborted Login with empty userNov 17 11:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X8  -A# ossec13001i7Exim Auth failed2025-11-17 11:57:30 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:42762: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)84.54.33.702750405P7  -1# ossec13001i7Exim Auth failed2025-11-17 11:57:31 dovecot_login authenticator failed for ([223.82.86.2]) [223.82.86.2]:12658: 535 Incorrect authentication data (set_id=eliezer)223.82.86.21814991e6  -Y% ossec13001i7Exim Auth failed2025-11-17 11:57:20 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:53900: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284e5  -[% ossec13001i7Exim Auth failed2025-11-17 11:58:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:60376: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758`4  -M' ossec13001i7Exim Auth failed2025-11-17 11:58:02 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:27969: 535 Incorrect authentication data (set_id=carlo)87.103.126.542264397~3  -) ossec13001i7Exim Auth failed2025-11-17 11:57:50 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:40076: 535 Incorrect authentication data (set_id=carlo@89fmjoinville.com.br)195.159.217.713144096\2  -G% ossec13001i7Exim Auth failed2025-11-17 11:57:37 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:49673: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284h1  -_% ossec13001i7Exim Auth failed2025-11-17 11:57:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:56711: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284^0  -K% ossec13001i7Exim Auth failed2025-11-17 11:57:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:54235: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284Y/  -=) ossec13001i7Exim Auth failed2025-11-17 11:56:58 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:45560: 535 Incorrect authentication data (set_id=eliezer)115.241.228.341269750t.  -w% ossec13001i7Exim Auth failed2025-11-17 11:56:24 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:33384: 535 Incorrect authentication data (set_id=junior@ilumix.com.br)137.27.32.706252001s-  -u% ossec13001i7Exim Auth failed2025-11-17 11:57:09 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:46466: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)179.42.49.343469034,  -) ossec13001i7Exim Auth failed2025-11-17 11:56:38 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:32793: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)70.118.112.2306252001W+  -;' ossec13001i7Exim Auth failed2025-11-17 11:56:29 dovecot_login authenticator failed for ([111.53.121.99]) [111.53.121.99]:42378: 535 Incorrect authentication data (set_id=recepcao)111.53.121.991814991e*  -[% ossec13001i7Exim Auth failed2025-11-17 11:56:53 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:61030: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758m)  -g' ossec13001i7Exim Auth failed2025-11-17 11:56:45 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:56696: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)179.185.18.673469034 "1 E \ ~ [ B`HI  -) ossec13001i8|Exim Auth failed2025-11-17 12:00:10 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:55480: 535 Incorrect authentication data212.57.136.1412017370`H  -Q% ossec13001i8bExim Auth failed2025-11-17 11:59:45 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:61185: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758gG  -[' ossec13001i8bExim Auth failed2025-11-17 11:59:44 dovecot_login authenticator failed for ([140.235.89.71]) [162.213.224.4]:36240: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)162.213.224.46252001oF  -i) ossec13001i8`Exim Auth failed2025-11-17 11:59:42 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:38504: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)171.244.61.1371562822E W' ossec9708i8VDovecot Aborted Login with empty userNov 17 11:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034hD  -_% ossec13001i8RExim Auth failed2025-11-17 11:59:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:63223: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284VC  -9' ossec13001i8GExim Auth failed2025-11-17 11:59:18 dovecot_login authenticator failed for ([60.220.241.51]) [60.220.241.50]:48520: 535 Incorrect authentication data (set_id=eduardo)60.220.241.501814991\B  -G% ossec13001i8xExim Auth failed2025-11-17 12:00:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:61008: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284^A  -K% ossec13001i8Exim Auth failed2025-11-17 11:58:36 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:57416: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284@  W' ossec9708i8Dovecot Aborted Login with empty userNov 17 11:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034?  k' ossec9709i87Multiple Dovecot Aborted Logins with empty userNov 17 11:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z>  -C% ossec13001i8,Exim Auth failed2025-11-17 11:58:50 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:49564: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284e=  -Y% ossec13001i8$Exim Auth failed2025-11-17 11:58:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:50978: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)36.255.98.511668284h<  -[) ossec13001i8Exim Auth failed2025-11-17 11:58:36 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:55664: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)103.251.143.141269750m;  -e) ossec13001i87Exim Auth failed2025-11-17 11:59:02 dovecot_login authenticator failed for ([213.183.100.27]) [213.183.100.27]:59146: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)213.183.100.272017370Z:  -A' ossec13001i8,Exim Auth failed2025-11-17 11:58:50 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:32798: 535 Incorrect authentication data (set_id=aureovieira)183.182.99.921655842 7/ D O u # 'I&<P7Z  W' ossec9708i8Dovecot Aborted Login with empty userNov 17 12:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034hY  -_% ossec13001i8Exim Auth failed2025-11-17 12:01:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:64737: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284fX -[% ossec13001i8Exim Auth failed2025-11-17 12:01:24 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:51714: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758W  k' ossec9709i8Multiple Dovecot Aborted Logins with empty userNov 17 12:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ZV  -C% ossec13001i8Exim Auth failed2025-11-17 12:00:59 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:61257: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284^U  -I' ossec13001i8Exim Auth failed2025-11-17 12:00:49 dovecot_login authenticator failed for ([24.144.4.218]) [38.87.177.252]:46222: 535 Incorrect authentication data (set_id=andre.nascimento)38.87.177.2526252001T W' ossec9708i8Dovecot Aborted Login with empty userNov 17 12:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YS  -=) ossec13001i8Exim Auth failed2025-11-17 12:00:41 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:44624: 535 Incorrect authentication data (set_id=contato)122.185.145.541269750^R  -K% ossec13001i8Exim Auth failed2025-11-17 12:00:40 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:62475: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284OQ  --% ossec13001i8Exim Auth failed2025-11-17 12:00:38 dovecot_login authenticator failed for ([183.6.115.88]) [183.6.115.88]:37318: 535 Incorrect authentication data (set_id=adm)183.6.115.881814991`P  -Q% ossec13001i8Exim Auth failed2025-11-17 12:00:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:59746: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758XO  -;) ossec13001i8Exim Auth failed2025-11-17 12:00:27 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:38308: 535 Incorrect authentication data (set_id=xavier)220.179.120.261814991VN  -;% ossec13001i8Exim Auth failed2025-11-17 12:00:25 dovecot_login authenticator failed for ([220.67.139.254]) [221.145.5.14]:36398: 535 Incorrect authentication data (set_id=salamuni)221.145.5.141835841qM  -q% ossec13001i8Exim Auth failed2025-11-17 12:00:25 dovecot_login authenticator failed for ([49.207.15.25]) [49.207.15.25]:53203: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)49.207.15.251269750gL  -_% ossec13001i8Exim Auth failed2025-11-17 12:00:18 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:38767: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)37.34.237.45285570dK  -U' ossec13001i8Exim Auth failed2025-11-17 12:00:16 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:58045: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)219.248.65.301835841eJ  -[% ossec13001i8zExim Auth failed2025-11-17 12:00:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:58517: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)62.60.131.14130758 2- D Y y .L2k W' ossec9708i9FDovecot Aborted Login with empty userNov 17 12:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6sCapstDVpixV3kv>177.87.121.473469034^j  -K% ossec13001i9<Exim Auth failed2025-11-17 12:03:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:54717: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284ci  -W% ossec13001i9<Exim Auth failed2025-11-17 12:03:22 dovecot_login authenticator failed for 89-67-54-224.dynamic.play.pl [89.67.54.224]:52612: 535 Incorrect authentication data (set_id=fabio.vendas)89.67.54.224798544`h  -Q% ossec13001i9hExim Auth failed2025-11-17 12:04:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:58929: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758tg  -s) ossec13001i9Exim Auth failed2025-11-17 12:02:53 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:50284: 535 Incorrect authentication data (set_id=fabio.vendas)122.186.174.351269750rf  -o) ossec13001i9 Exim Auth failed2025-11-17 12:02:35 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:34917: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)118.41.142.1641835841e W' ossec9708i9 Dovecot Aborted Login with empty userNov 17 12:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\d  -G% ossec13001i9Exim Auth failed2025-11-17 12:02:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:65077: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284 c  -' ossec13001i9Exim Auth failed2025-11-17 12:02:24 dovecot_login authenticator failed for (158.229.61.59.broad.qz.fj.dynamic.163data.com.cn) [59.61.229.158]:54101: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)59.61.229.1581814991?b  -# ossec13001i92Exim Auth failed2025-11-17 12:03:14 dovecot_login authenticator failed for ([5.141.80.56]) [5.141.80.56]:48022: 535 Incorrect authentication data5.141.80.562017370`a  -M' ossec13001i9.Exim Auth failed2025-11-17 12:03:10 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:55512: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730``  -Q% ossec13001i9&Exim Auth failed2025-11-17 12:03:00 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:54206: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758\_  -C) ossec13001i9 Exim Auth failed2025-11-17 12:02:56 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:34958: 535 Incorrect authentication data (set_id=atendimento)182.95.176.1301269750g^  -[' ossec13001i9Exim Auth failed2025-11-17 12:02:54 dovecot_login authenticator failed for (18980204017.user.veloxzone.com.br) [189.80.146.46]:44691: 535 Incorrect authentication data (set_id=envios)189.80.146.463469034e]  -Y% ossec13001i9Exim Auth failed2025-11-17 12:02:40 dovecot_login authenticator failed for (noname.vdonsk.ru) [193.111.3.59]:40124: 535 Incorrect authentication data (set_id=envios@comercial.art.br)193.111.3.592017370`\  -Q% ossec13001i8Exim Auth failed2025-11-17 12:01:54 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:50146: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758k[  -_+ ossec13001i8Exim Auth failed2025-11-17 12:01:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57877: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651 5n2q)hM _VD;zcZQ~uHl ? 6 -$ U p L C g y ^ : 1 (    > 5 } t , k b Y P G #    b X N v l &  D   : 0 | r h ^ , " T   J  @ 6 2 ( n    d Z P F < x~tj`VLB8.$zpf\RH>4*  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$ i72 i79 i78 i77 i70 i76 i7- i7% i7/ i7* i7$ i7# i7) i7( i7, i7' i7& i7+ i7. i7" i7! i7 i7 i7{ i7{ i7y i7s i7i i7g i7e i7] i7] i7[ i7W i7K i7G i7? i79 i77 i73 i73 i7) i7% i7 i7  i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6z i6v i6d i6R i6P i6F i6F i6B i6> i68 i68 i68 i64 i64 i6. i6( i6( i6$ i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i6 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5 i5z i5v i5 i5 i5 i5 i5 i5| i5 i5 i5h i5` i5Z i5X i5H i5D i5t i5l i5\ i5V i5: i5$ i5 i5 i5 i5& i5 i5 i5 i5 i5$ i5 i5 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4 i4i4i4~i4}i4|i4{i4zi4yi4vxi4dwi4Zvi4Zui4rti4lsi4hri4\qi4Lpi4oi4Fni4mi4li4ki4Dji4Dii4.hi4"gi4 fi4ei4di40ci4 bi44ai42`i4._i4(^i4]i4\i3[i4Zi3Yi3Xi3Wi3Vi4Ui3Ti3Si3Ri3Qi3Pi3Oi3Ni3Mi3Li3Ki3Ji3Ii3Hi3Gi3Fi3Ei3Di3Ci3Bi3}Ai3}@i3w?i3>i3q=i3i<i3;i3s:i3i9i3Y8i37i36i35i34i3{3i3i2i3L1i3E0i3-/i3.i3P-i3L,i3L+i3A*i2)i2(i3'i2&i2%i2$i2#i3"i3!i3 i3i3i3i2i2i2i2i2i2i2i2i2i2i2i2i2i2i2i2 i2 i2 i2 i2 i2i2i2i2i2i2i2 i2 * ~tj`VLB8.$ z p  f \ R H  vlb0&XND:rh^T|J@6,"PxndZ<2( F~tj`VLB$8.z  fH\>4*RpvD:l0bXN& > 4 * | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~ t j ` V L B 8 . $    zpf\RH>4*   v l b X N D : 0 &    i> i> i> i> i> i> i> i> i>m i>_ i> i> i>1 i>' i>% i>Q i>I i>3 i>1 i= i= i= i= i= i> i> i>  i> i= i= i= i= i= i= i=} i={ i=u i= i= i= i= i= i= i= i= i=A i=; i=7 i=g i=W i=Q i= i=  i= i< i=# i=! i< i< i< i< i< i< i< i< i< i< i< i< i< i<} i i;2 i;, i;$ i;L i;D i;8 i;0 i; i: i: i: i: i; i; i: i: i: i: i: i: i:r i:p i:l i:d i: i:4 i:* i:X i:T i9 i9~ i:} i:| i9{ i9z i9y i9x i9w i9v i9u i9t i9s i9zr i9q i9p i9o i9~n i9hm i9Ll i9Fk i9<j i9<i i9hh i9g i?! i? i> i> i92b i9.a i9&` i9 _ i9^ i9] i8< i8@ i75 i74 i73 iCXa iCX` iC\ iC[ iC] iC T iCW iBV iBZ iBU iBY iBX iBS iBP iBK iBO iBN iBM iBR iBQ iBL iBjJ iB`I iBBH iB,G iB(F iBE iB= iB? iB> iAD iAC iAB iAA iA@ iA< iA9 iA; iA: iA8 iAx7 iAt6 iA\5 iA>4 iA03 iA.2 iA$1 iA0 i@/ i@. i@, i@- i@N+ i@* i@) i@( i@' i@& i?% i?$ i?# i?" i?! i? i? i? i? i? i? i? i? i? i? i?} i?k i?] i?[ i?B i?? i?- iCy^ i9 f i9 e i9d i9c i8W i8\ i8[ i8Z i8Y i8X i8V i8U i8S i8R i8Q i8P i8T i8O i8N i8M i8L i8K i8|I i8zJ i8xB i8bH i8bG i8`F i8VE i8RD i8GC i87? i87; i8,> i8,: i8$= i8A i> z"6 Z A  : XxXrzy W' ossec9708i9Dovecot Aborted Login with empty userNov 17 12:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Zx  -A' ossec13001i9Exim Auth failed2025-11-17 12:05:28 dovecot_login authenticator failed for ([189.8.125.130]) [189.8.125.130]:54488: 535 Incorrect authentication data (set_id=atendimento)189.8.125.1303469034bw  -U# ossec13001i9Exim Auth failed2025-11-17 12:05:18 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:58082: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)8.209.221.71861060Sv  ;'% ossec13008i9Mail Recipient rejected2025-11-17 12:06:12 H=(195.3.134.135) [179.0.178.53]:52396 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:52396 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034Xu  -A# ossec13001i9Exim Auth failed2025-11-17 12:06:07 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:53406: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)84.54.33.702750405it  -c# ossec13001i9Exim Auth failed2025-11-17 12:05:53 dovecot_login authenticator failed for ([59.6.203.38]) [59.6.203.38]:47462: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)59.6.203.381835841\s  -G% ossec13001i9Exim Auth failed2025-11-17 12:05:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:59027: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284^r  -K% ossec13001i9zExim Auth failed2025-11-17 12:04:25 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:57293: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)36.255.98.321668284`q  -Q% ossec13001i9Exim Auth failed2025-11-17 12:05:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:58259: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)62.60.131.87130758p  k' ossec9709i9Multiple Dovecot Aborted Logins with empty userNov 17 12:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o  W' ossec9708i9Dovecot Aborted Login with empty userNov 17 12:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Xn -?# ossec13001i9~Exim Auth failed2025-11-17 12:04:29 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:50718: 535 Incorrect authentication data (set_id=ieqecoville@ieq.com.br)84.54.33.702750405hm  -_% ossec13001i9hExim Auth failed2025-11-17 12:04:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:59031: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284Zl  -C% ossec13001i9LExim Auth failed2025-11-17 12:03:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:61256: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284 "D!AR9Xqh  -_% ossec13001i:lExim Auth failed2025-11-17 12:08:27 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:54238: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284c  -S' ossec13001i:dExim Auth failed2025-11-17 12:08:20 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:58662: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)182.66.214.701269750]  -G) ossec13001i:Exim Auth failed2025-11-17 12:08:52 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:35574: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549  W' ossec9708i:4Dovecot Aborted Login with empty userNov 17 12:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  -c' ossec13001i:*Exim Auth failed2025-11-17 12:07:21 dovecot_login authenticator failed for (brinquelocacoes.com) [61.50.119.110]:58756: 535 Incorrect authentication data (set_id=test@brinquelocacoes.com)61.50.119.1101814991\  -G% ossec13001i:XExim Auth failed2025-11-17 12:08:08 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:60077: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284  k' ossec9709i:TMultiple Dovecot Aborted Logins with empty userNov 17 12:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -C% ossec13001i9Exim Auth failed2025-11-17 12:06:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:65485: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284h~  -_% ossec13001i9Exim Auth failed2025-11-17 12:06:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:58081: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284Z}  -A' ossec13001i:Exim Auth failed2025-11-17 12:06:57 dovecot_login authenticator failed for (brinquelocacoes.com) [61.50.119.110]:54524: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991^|  -G) ossec13001i:Exim Auth failed2025-11-17 12:06:43 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:51287: 535 Incorrect authentication data (set_id=fabio.vendas)12.222.177.1466252001{ W' ossec9708i9Dovecot Aborted Login with empty userNov 17 12:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2adWsctDhu2xV3kv>177.87.121.473469034z  IC ossec5403i9First time user executed sudo.Nov 17 12:06:34 hosting sudo: wp-toolkit : (command continued) user-48=hiperces user-49=observde user-50=cleverso user-51=arksonco user-52=espacopr user-53=compatad user-54=palmetto user-55=schneide user-56=oabsjp user-57=hubopera user-58=joelbuen user-59=eaglebpo user-60=vidaenge user-61=thebesta user-62=fundamen user-63=pmulheres user-64=editora user-65=radiosar user-66=highqual user-67=advguilh user-68=sulindus user-69=persiana user-70=jvscurso user-71=moltrico user-72=singsegu user-73=bethelpa user-74=elotelec user-75=vmaralima user-76=reidaspe user-77=quintalg user-78=eloempre user-79=metalurg user-80=cartazes user-81=raquelas user-82=acqualuz user-83=wwwmagad user-84=vivocons user-85=polloste user-86=shalom user-87=pirajusolucoesco user-88=maringas user-89=proareco user-90=joycesco user-91=lorussoi user-92=salamuni user-93=opsconso user-94=centroga user-95=pousadar user-96=wwfmovei user-97=sinodode user-98=pibtrind user-99=innovati user-100=seventre user-101=projetoc 7   ,7Z  -C% ossec13001i;0Exim Auth failed2025-11-17 12:11:44 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:50947: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284z  -}+ ossec13001i;Exim Auth failed2025-11-17 12:11:24 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:33003: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)180.188.143.1661819730  W' ossec9708i:Dovecot Aborted Login with empty userNov 17 12:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -G% ossec13001i:Exim Auth failed2025-11-17 12:10:27 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54970: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284b  -Q) ossec13001i:Exim Auth failed2025-11-17 12:10:26 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:50568: 535 Incorrect authentication data (set_id=contato)178.150.135.19690791h  -_% ossec13001i:Exim Auth failed2025-11-17 12:10:19 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:55293: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284  k' ossec9709i;Multiple Dovecot Aborted Logins with empty userNov 17 12:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -9' ossec13001i;Exim Auth failed2025-11-17 12:10:56 dovecot_login authenticator failed for ([119.126.90.69]) [119.126.90.69]:41841: 535 Incorrect authentication data (set_id=adriana)119.126.90.691814991r  -s' ossec13001i:Exim Auth failed2025-11-17 12:10:34 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:40046: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)94.207.19.166290557)  e-% ossec9710i:Dovecot Auth failed on disconnected session.Nov 17 12:09:30 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=102.66.2.199, lip=200.150.196.245, TLS, session=102.66.2.199953987l  -e' ossec13001i:Exim Auth failed2025-11-17 12:10:14 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:43642: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)195.24.215.702233387  e' ossec9710i:Dovecot Auth failed on disconnected session.Nov 17 12:10:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.18.166.37, lip=200.150.196.245, TLS, session=103.18.166.371269750Z  -C% ossec13001i:Exim Auth failed2025-11-17 12:09:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:54343: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284 W' ossec9708i:Dovecot Aborted Login with empty userNov 17 12:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4pwHvMtDTtSxV3kv>177.87.121.473469034[  -E% ossec13001i:rExim Auth failed2025-11-17 12:08:33 dovecot_login authenticator failed for n7-c210.client.tomica.ru [78.140.7.210]:50208: 535 Incorrect authentication data (set_id=eliezer)78.140.7.2102017370 W' ossec9708i:pDovecot Aborted Login with empty userNov 17 12:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0OhyuMtD3raxV3kv>177.87.121.473469034  ; ! ' Dc|u&  -s+ ossec13001i;TExim Auth failed2025-11-17 12:12:20 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:55441: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)186.215.245.1753469034X%  -;) ossec13001i;Exim Auth failed2025-11-17 12:13:12 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:46064: 535 Incorrect authentication data (set_id=rafael)223.166.87.1451814991i$  -_' ossec13001i;yExim Auth failed2025-11-17 12:12:56 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:46064: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)101.168.17.202077456i#  -_' ossec13001i;yExim Auth failed2025-11-17 12:12:56 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:45425: 535 Incorrect authentication data (set_id=atualizacoes)42.200.70.1341819730Y"  -?' ossec13001i;dExim Auth failed2025-11-17 12:12:35 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:40082: 535 Incorrect authentication data (set_id=financeiro)120.157.13.612077456\!  -G% ossec13001i;Exim Auth failed2025-11-17 12:13:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:60406: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284n  -k% ossec13001i;hExim Auth failed2025-11-17 12:12:40 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:57736: 535 Incorrect authentication data (set_id=isabellylisboa)61.2.228.1771269750c  -W# ossec13001i;bExim Auth failed2025-11-17 12:12:33 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:47496: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)80.64.28.822017370] -I# ossec13001i;Exim Auth failed2025-11-17 12:13:06 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:59872: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)84.54.33.702750405_  -K' ossec13001i;>Exim Auth failed2025-11-17 12:11:57 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:58058: 535 Incorrect authentication data (set_id=gerson.comercial)103.249.19.341643084_  -K' ossec13001i;2Exim Auth failed2025-11-17 12:11:45 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:33318: 535 Incorrect authentication data (set_id=administrativo1)61.51.184.1941814991  -1) ossec13001i;,Exim Auth failed2025-11-17 12:11:39 dovecot_login authenticator failed for (85-117-228-220.customers.onetek.premierenet.net) [85.117.228.220]:58869: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)85.117.228.2203175395 W' ossec9708i;$Dovecot Aborted Login with empty userNov 17 12:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -G+ ossec13001i;LExim Auth failed2025-11-17 12:12:12 dovecot_login authenticator failed for ([216.193.143.197]) [216.193.143.197]:37006: 535 Incorrect authentication data (set_id=financeiro)216.193.143.1976252001m  -e) ossec13001i;DExim Auth failed2025-11-17 12:12:04 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:55032: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)175.43.184.2021814991m  -g' ossec13001i;8Exim Auth failed2025-11-17 12:11:52 dovecot_login authenticator failed for ([182.79.95.231]) [152.52.244.46]:51412: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)152.52.244.461269750 D @&::Dr6  -o) ossec13001i;Exim Auth failed2025-11-17 12:14:53 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:34289: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)178.232.51.1353144096|5  -' ossec13001i;Exim Auth failed2025-11-17 12:14:37 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:41261: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)60.220.241.501814991X4  -A# ossec13001i;Exim Auth failed2025-11-17 12:14:43 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:33894: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)84.54.33.702750405j3  -_) ossec13001i;Exim Auth failed2025-11-17 12:14:39 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:55206: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)111.59.206.22418149912  e) ossec9710i;Dovecot Auth failed on disconnected session.Nov 17 12:14:34 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.234.132.142, lip=200.150.196.245, TLS, session=91.234.132.14262902521 W' ossec9708i;Dovecot Aborted Login with empty userNov 17 12:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9onmzctDequxV3kv>177.87.121.473469034V0  -9' ossec13001i;Exim Auth failed2025-11-17 12:14:19 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:62754: 535 Incorrect authentication data (set_id=contato)103.161.93.531269750\/  -C) ossec13001i;Exim Auth failed2025-11-17 12:15:08 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:33544: 535 Incorrect authentication data (set_id=formula316)103.147.248.231269750.  W' ossec9708i;Dovecot Aborted Login with empty userNov 17 12:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d-  -Q+ ossec13001i;Exim Auth failed2025-11-17 12:14:11 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50041: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651,  - ) ossec13001i;Exim Auth failed2025-11-17 12:14:08 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:36904: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)187.40.215.1623469034Z+  -C% ossec13001i;Exim Auth failed2025-11-17 12:14:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:53689: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284*  k' ossec9709i;Multiple Dovecot Aborted Logins with empty userNov 17 12:14:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034) W' ossec9708i;`Dovecot Aborted Login with empty userNov 17 12:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8x3HxstDQMqxV3kv>177.87.121.473469034h(  -_% ossec13001i;^Exim Auth failed2025-11-17 12:12:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:61257: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284w'  -{' ossec13001i;XExim Auth failed2025-11-17 12:12:23 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:54878: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)182.95.177.781269750  ;  ,LSuR9H\RF  -7# ossec13001i<Exim Auth failed2025-11-17 12:17:27 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:62193: 535 Incorrect authentication data (set_id=financeiro)194.31.8.12614540hE  -_% ossec13001i<Exim Auth failed2025-11-17 12:17:24 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:52547: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284mD  -g' ossec13001i<}Exim Auth failed2025-11-17 12:17:15 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:53938: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)182.78.144.341269750C  W' ossec9708i, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034B  k' ossec9709i, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ZA  -C% ossec13001i<_Exim Auth failed2025-11-17 12:16:45 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:49572: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284u@ UI+ ossec11001i<]Deferred login on the cpanel service[2025-11-17 12:16:43 -0300] info [webmaild] 186.208.218.149 - priscilasalles@advsalles.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing186.208.218.1493469034\?  -E' ossec13001i  -G% ossec13001i<%Exim Auth failed2025-11-17 12:15:48 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54957: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284^= ;;% ossec13008i<Mail Recipient rejected2025-11-17 12:15:36 H=(localhost) [187.85.88.44]:25003 F= rejected RCPT : Sender verify failed187.85.88.443469034< W' ossec9708i<Dovecot Aborted Login with empty userNov 17 12:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h;  -_% ossec13001i< Exim Auth failed2025-11-17 12:15:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:62893: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)36.255.98.501668284C:  e]' ossec9710i< Dovecot Auth failed on disconnected session.Nov 17 12:15:23 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.84.107.200, lip=200.150.196.245, TLS: Connection closed, session=45.84.107.2002661886[9  ;5' ossec13008i<Mail Recipient rejected2025-11-17 12:15:18 H=([91.92.242.189]) [91.92.242.189]:53173 F= rejected RCPT : Sender verify failed91.92.242.1892750405z8  -% ossec13001i<7Exim Auth failed2025-11-17 12:16:05 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:55474: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.76.71.821269750d7  -W% ossec13001i;Exim Auth failed2025-11-17 12:14:55 dovecot_login authenticator failed for host94.sub-63-47-182.myvzw.com [63.47.182.94]:7764: 535 Incorrect authentication data (set_id=venesselume)63.47.182.946252001  ( : c o8;@U  W' ossec9708i=Dovecot Aborted Login with empty userNov 17 12:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)T  e') ossec9710i<Dovecot Auth failed on disconnected session.Nov 17 12:19:25 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=221.165.172.38, lip=200.150.196.245, TLS, session=<9cwO3stDFJHdpawm>221.165.172.381835841S  k' ossec9709i=#Multiple Dovecot Aborted Logins with empty userNov 17 12:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1Wae4ctDzuuxV3kv>177.87.121.473469034ZR  -A' ossec13001i=!Exim Auth failed2025-11-17 12:20:00 dovecot_login authenticator failed for ([85.236.187.43]) [85.236.187.43]:53554: 535 Incorrect authentication data (set_id=faturamento)85.236.187.432017370WQ  -?# ossec13001i<Exim Auth failed2025-11-17 12:19:10 dovecot_login authenticator failed for ([111.0.81.84]) [111.0.81.84]:56450: 535 Incorrect authentication data (set_id=isabellylisboa)111.0.81.841814991>P  eQ) ossec9710i<Dovecot Auth failed on disconnected session.Nov 17 12:19:00 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=90.160.139.163, lip=200.150.196.245, TLS, session=<8euy3MtDx+paoIuj>90.160.139.1632510769yO  -}) ossec13001i<Exim Auth failed2025-11-17 12:18:52 dovecot_login authenticator failed for ([222.128.15.132]) [222.128.15.132]:39456: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)222.128.15.13218149913N  eA# ossec9710i<Dovecot Auth failed on disconnected session.Nov 17 12:18:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=46.101.9.55, lip=200.150.196.245, session=46.101.9.552635167M W' ossec9708i<Dovecot Aborted Login with empty userNov 17 12:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9x023MtD8ryxV3kv>177.87.121.473469034VL  -9' ossec13001i<Exim Auth failed2025-11-17 12:18:23 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:54207: 535 Incorrect authentication data (set_id=eliezer)222.117.0.2531835841SK  -5% ossec13001i<Exim Auth failed2025-11-17 12:18:52 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:30248: 535 Incorrect authentication data (set_id=loopert)111.63.42.761814991jJ  -a' ossec13001i<Exim Auth failed2025-11-17 12:18:38 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:18000: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)14.161.31.1721562822\I  -G% ossec13001i<Exim Auth failed2025-11-17 12:18:09 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54287: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284ZH  -I! ossec13001i<Exim Auth failed2025-11-17 12:18:08 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:57163: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)5.30.78.23290557G W' ossec9708i<Dovecot Aborted Login with empty userNov 17 12:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2zep2MtDrJ6xV3kv>177.87.121.473469034 3 V d p tSt{ne  -g) ossec13001i=Exim Auth failed2025-11-17 12:22:04 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:54562: 535 Incorrect authentication data (set_id=financeiro)116.48.150.1151819730ld  -g% ossec13001i=Exim Auth failed2025-11-17 12:21:55 dovecot_login authenticator failed for ([60.18.139.82]) [60.18.139.82]:49704: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)60.18.139.8218149913c  e=' ossec9710i=Dovecot Auth failed on disconnected session.Nov 17 12:21:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=171.7.112.130, lip=200.150.196.245, TLS, session=171.7.112.1301605651Xb -?# ossec13001i=Exim Auth failed2025-11-17 12:21:44 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:46014: 535 Incorrect authentication data (set_id=ieqecoville@ieq.com.br)84.54.33.702750405ua  -s+ ossec13001i=Exim Auth failed2025-11-17 12:22:12 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:52066: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)119.160.166.2371820814i`  -c# ossec13001i=Exim Auth failed2025-11-17 12:21:50 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:47869: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)61.32.68.661835841[_  -E% ossec13001i=Exim Auth failed2025-11-17 12:21:42 dovecot_login authenticator failed for ([111.26.62.45]) [111.26.62.46]:43334: 535 Incorrect authentication data (set_id=administrativo1)111.26.62.461814991^  e) ossec9710i=Dovecot Auth failed on disconnected session.Nov 17 12:22:14 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=221.167.21.148, lip=200.150.196.245, TLS, session=221.167.21.1481835841] W' ossec9708i=ADovecot Aborted Login with empty userNov 17 12:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034~\  -) ossec13001i=;Exim Auth failed2025-11-17 12:20:27 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:33098: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)182.76.228.2341269750\[  -G% ossec13001i=7Exim Auth failed2025-11-17 12:20:22 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:62082: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284pZ  -i+ ossec13001i=gExim Auth failed2025-11-17 12:21:10 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:63845: 535 Incorrect authentication data (set_id=venesselume)223.197.153.1351819730nY  -i' ossec13001i=WExim Auth failed2025-11-17 12:20:53 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:46154: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)37.79.255.1042017370YX  -?' ossec13001i=QExim Auth failed2025-11-17 12:20:48 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:35826: 535 Incorrect authentication data (set_id=formula316)193.95.24.1172464461ZW  -C% ossec13001i=Exim Auth failed2025-11-17 12:19:43 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:62455: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284kV  -e% ossec13001i= Exim Auth failed2025-11-17 12:19:36 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:48578: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)111.26.67.361814991  % -  % JiFSeu W' ossec9708i=Dovecot Aborted Login with empty userNov 17 12:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\t  -G% ossec13001i=Exim Auth failed2025-11-17 12:23:22 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54599: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284Xs  -A# ossec13001i=Exim Auth failed2025-11-17 12:23:21 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:46148: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)84.54.33.702750405\r  -A+ ossec13001i>Exim Auth failed2025-11-17 12:24:07 dovecot_login authenticator failed for (letracaixa.art.br) [111.122.211.212]:40308: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991Vq  -?% ossec13001i>Exim Auth failed2025-11-17 12:24:07 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:34572: 535 Incorrect authentication data (set_id=fabio.vendas)65.20.175.7599237jp  -]+ ossec13001i> Exim Auth failed2025-11-17 12:23:54 dovecot_login authenticator failed for ([212.164.233.215]) [212.164.233.215]:52216: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)212.164.233.2152017370oo  -k' ossec13001i>Exim Auth failed2025-11-17 12:23:49 dovecot_login authenticator failed for ([187.58.241.90]) [187.58.241.90]:43489: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)187.58.241.903469034n  k' ossec9709i=Multiple Dovecot Aborted Logins with empty userNov 17 12:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]m  -E) ossec13001i=Exim Auth failed2025-11-17 12:22:52 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:45360: 535 Incorrect authentication data (set_id=vendas.luiz)220.67.122.2301835841Wl  -=% ossec13001i=Exim Auth failed2025-11-17 12:22:48 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:39694: 535 Incorrect authentication data (set_id=alex.vendas)45.251.69.121269750kk  -e% ossec13001i=Exim Auth failed2025-11-17 12:22:37 dovecot_login authenticator failed for ([36.135.62.94]) [36.135.62.95]:54872: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)36.135.62.951814991j  W' ossec9708i=Dovecot Aborted Login with empty userNov 17 12:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Zi  -C% ossec13001i=Exim Auth failed2025-11-17 12:22:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:50840: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284h W' ossec9708i=}Dovecot Aborted Login with empty userNov 17 12:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wg  -y) ossec13001i={Exim Auth failed2025-11-17 12:21:30 dovecot_login authenticator failed for ([116.234.68.221]) [116.234.68.221]:12584: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)116.234.68.2211814991\f  -E) ossec13001i=uExim Auth failed2025-11-17 12:21:24 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:57488: 535 Incorrect authentication data (set_id=venesselume)85.159.165.216294640  -  # $ F o"  -M+ ossec13001i>Exim Auth failed2025-11-17 12:26:16 dovecot_login authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:64788: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)204.236.249.1116252001\  -G% ossec13001i>Exim Auth failed2025-11-17 12:26:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:49722: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)36.255.98.521668284  k' ossec9709i>Multiple Dovecot Aborted Logins with empty userNov 17 12:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708i>mDovecot Aborted Login with empty userNov 17 12:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  -e% ossec13001i>_Exim Auth failed2025-11-17 12:25:18 dovecot_login authenticator failed for (89.20.106.40.permonline.ru) [89.20.106.40]:58013: 535 Incorrect authentication data (set_id=andressa.financeiro)89.20.106.402017370#  3K) ossec11301i>New FTP connection.Nov 17 12:26:15 hosting pure-ftpd: (?@198.235.24.180) [INFO] New connection from 198.235.24.180198.235.24.1806252001"  -M+ ossec13001i>Exim Auth failed2025-11-17 12:26:10 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:64788: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)204.236.249.1116252001V~  -5+ ossec13001i>1Exim Auth failed2025-11-17 12:24:33 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:58680: 535 Incorrect authentication data (set_id=ti)186.238.247.2383469034i}  -]) ossec13001i>'Exim Auth failed2025-11-17 12:24:22 dovecot_login authenticator failed for ([186.227.91.154]) [186.227.91.154]:60716: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)186.227.91.1543469034S|  -5% ossec13001i>%Exim Auth failed2025-11-17 12:24:20 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:57456: 535 Incorrect authentication data (set_id=contato)111.26.63.871814991Z{  -C% ossec13001i>QExim Auth failed2025-11-17 12:25:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:51663: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284{z  -+ ossec13001i>IExim Auth failed2025-11-17 12:24:56 dovecot_login authenticator failed for ([185.205.184.169]) [185.205.184.169]:58736: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)185.205.184.169146669ly  -a+ ossec13001i>3Exim Auth failed2025-11-17 12:24:34 dovecot_login authenticator failed for (letracaixa.art.br) [111.122.211.212]:45082: 535 Incorrect authentication data (set_id=admin@letracaixa.art.br)111.122.211.2121814991x W' ossec9708i>1Dovecot Aborted Login with empty userNov 17 12:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\w  -I% ossec13001i=Exim Auth failed2025-11-17 12:23:38 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58000: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758ov  -k' ossec13001i=Exim Auth failed2025-11-17 12:23:38 dovecot_login authenticator failed for ([119.206.62.88]) [119.206.62.88]:52350: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)119.206.62.881835841 y " & *L3@;!Xy[  -?+ ossec13001i?}Exim Auth failed2025-11-17 12:30:05 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:54552: 535 Incorrect authentication data (set_id=xavier)123.209.104.1422077456E  -' ossec13001i?kExim Auth failed2025-11-17 12:29:46 dovecot_login authenticator failed for ([183.171.4.144]) [183.171.4.144]:50872: 535 Incorrect authentication data183.171.4.1441733045 W' ossec9708i?]Dovecot Aborted Login with empty userNov 17 12:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -I' ossec13001i?BExim Auth failed2025-11-17 12:29:04 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:42124: 535 Incorrect authentication data (set_id=paulinho.vendas)140.249.20.141814991  k' ossec9709i??Multiple Dovecot Aborted Logins with empty userNov 17 12:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o  -m% ossec13001i?-Exim Auth failed2025-11-17 12:28:44 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:46462: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)111.26.63.871814991  W' ossec9708i?!Dovecot Aborted Login with empty userNov 17 12:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -G% ossec13001i>Exim Auth failed2025-11-17 12:27:56 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:56165: 535 Incorrect authentication data (set_id=ieqcampocomprido)65.20.250.6399237m  -e) ossec13001i>Exim Auth failed2025-11-17 12:27:42 dovecot_login authenticator failed for ([14.194.128.158]) [14.194.128.158]:60792: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)14.194.128.1581269750m  -e) ossec13001i>Exim Auth failed2025-11-17 12:27:37 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:54716: 535 Incorrect authentication data (set_id=comercial)195.159.217.713144096 W' ossec9708i>Dovecot Aborted Login with empty userNov 17 12:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x  -}' ossec13001i>Exim Auth failed2025-11-17 12:27:24 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34776: 535 Incorrect authentication data (set_id=comercial@inovasite.net)76.132.238.436252001Z  -C% ossec13001i?Exim Auth failed2025-11-17 12:28:03 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:60209: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284o  -g+ ossec13001i>Exim Auth failed2025-11-17 12:26:56 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:37898: 535 Incorrect authentication data (set_id=xavier)187.115.144.1033469034 W' ossec9708i>Dovecot Aborted Login with empty userNov 17 12:26:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8WHf+MtDkOGxV3kv>177.87.121.473469034o  -i) ossec13001i>Exim Auth failed2025-11-17 12:26:31 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:59850: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)27.128.162.1461814991  1  9 H " Hew%  k' ossec9709i?Multiple Dovecot Aborted Logins with empty userNov 17 12:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^$  -K' ossec13001i?Exim Auth failed2025-11-17 12:32:01 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:60130: 535 Incorrect authentication data (set_id=info)91.219.196.17690791#  -) ossec13001i?Exim Auth failed2025-11-17 12:31:58 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:50805: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)179.83.134.1013469034u"  -y% ossec13001i?Exim Auth failed2025-11-17 12:31:56 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54510: 535 Incorrect authentication data (set_id=envios@comercial.art.br)71.62.34.2166252001U!  -=! ossec13001i?Exim Auth failed2025-11-17 12:31:46 dovecot_login authenticator failed for (h81-61-59-6.seed.net.tw) [61.59.6.81]:55653: 535 Incorrect authentication data (set_id=info)61.59.6.811668284  W' ossec9708i?Dovecot Aborted Login with empty userNov 17 12:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n  -g) ossec13001i?Exim Auth failed2025-11-17 12:31:18 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:48063: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)210.219.232.341835841_ -G) ossec13001i?Exim Auth failed2025-11-17 12:31:17 dovecot_login authenticator failed for (User) [177.74.174.120]:57064: 535 Incorrect authentication data (set_id=default@inovasite.com.br)177.74.174.1203469034_ -G) ossec13001i?Exim Auth failed2025-11-17 12:31:01 dovecot_login authenticator failed for (User) [177.74.174.120]:57064: 535 Incorrect authentication data (set_id=default@inovasite.com.br)177.74.174.1203469034V  -9' ossec13001i?Exim Auth failed2025-11-17 12:31:00 dovecot_login authenticator failed for ([46.149.34.226]) [46.149.34.226]:59494: 535 Incorrect authentication data (set_id=contato)46.149.34.2262017370"  e) ossec9710i?Dovecot Auth failed on disconnected session.Nov 17 12:30:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=188.124.79.130, lip=200.150.196.245, TLS, session=<6UVzB8xDx8K8fE+C>188.124.79.130732800m  -e) ossec13001i?Exim Auth failed2025-11-17 12:30:46 dovecot_login authenticator failed for ([111.26.106.117]) [111.26.106.117]:38648: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)111.26.106.1171814991Z  -C% ossec13001i?Exim Auth failed2025-11-17 12:30:33 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:51636: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)36.255.98.431668284 W' ossec9708i?Dovecot Aborted Login with empty userNov 17 12:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X -?# ossec13001i?Exim Auth failed2025-11-17 12:30:23 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:56616: 535 Incorrect authentication data (set_id=ieqecoville@ieq.com.br)84.54.33.702750405o  -i) ossec13001i?[Exim Auth failed2025-11-17 12:29:30 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:41019: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)106.245.246.261835841 x# xQ7Jgx4  W' ossec9708iA>Dovecot Aborted Login with empty userNov 17 12:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034R3  -3% ossec13001iA0Exim Auth failed2025-11-17 12:37:20 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:51912: 535 Incorrect authentication data (set_id=envios)45.118.49.181269750_2 -G) ossec13001iA.Exim Auth failed2025-11-17 12:37:16 dovecot_login authenticator failed for (User) [177.74.174.120]:59697: 535 Incorrect authentication data (set_id=default@inovasite.com.br)177.74.174.1203469034i1  -]) ossec13001iA$Exim Auth failed2025-11-17 12:37:07 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:37436: 535 Incorrect authentication data (set_id=envios@comercial.art.br)182.95.177.11812697500 W' ossec9708iADovecot Aborted Login with empty userNov 17 12:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#/  e% ossec9710i@Dovecot Auth failed on disconnected session.Nov 17 12:36:20 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=41.139.10.60, lip=200.150.196.245, TLS, session=<1JvWGsxD2uApiwo8>41.139.10.602300660. W' ossec9708i@Dovecot Aborted Login with empty userNov 17 12:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-  W' ossec9708i@Dovecot Aborted Login with empty userNov 17 12:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  k' ossec9709i@Multiple Dovecot Aborted Logins with empty userNov 17 12:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+ W' ossec9708i@NDovecot Aborted Login with empty userNov 17 12:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l*  -a+ ossec13001i@Exim Auth failed2025-11-17 12:32:42 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57862: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651) W' ossec9708i@Dovecot Aborted Login with empty userNov 17 12:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V(  -9' ossec13001i@Exim Auth failed2025-11-17 12:32:22 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:35608: 535 Incorrect authentication data (set_id=contato)161.8.241.1712077456S'  ;'% ossec13008i@Mail Recipient rejected2025-11-17 12:32:22 H=(195.3.134.135) [179.0.178.53]:57221 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57221 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034Y&  -=) ossec13001i@Exim Auth failed2025-11-17 12:32:16 dovecot_login authenticator failed for ([122.185.152.199]) [182.95.178.158]:57772: 535 Incorrect authentication data (set_id=envios)182.95.178.1581269750 }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0UI=1 1269750 1269750Q 1269750, 1269750* 1269750) 1269750( 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750z 1269750d 1269750Q 1269750P 1269750H 1269750@ 12697502 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750W 1269750Q 1269750J 1269750G 1269750< 1269750: 1269750. 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750{ 1269750z 1269750N 1269750G 12697505 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750| 1269750` 1269750W 1269750P 1269750N 1269750A 1269750? 12697504 1269750" 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750t 1269750d 1269750W 1269750L 12697504 1269750/ 1269750( 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750Z 1269750Y 1269750I 1269750A 12697509 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750} 1269750Z 1269750D 1269750@ 12697507 1269750+ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750r 1269750i 1269750] 1269750S 1269750O 1269750< 12697505 12697500 1269750* 1269750$ 1269750" 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750s 1269750b 1269750] 1269750\ 1269750[ 1269750O 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750j 1269750S 1269750C 1269750; 1269750% 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750y 1269750r 1269750c 1269750W    }C  -' ossec13001iAExim Auth failed2025-11-17 12:40:42 dovecot_login authenticator failed for (95.105.52.153.static.str.ufanet.ru) [95.105.52.153]:51480: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)95.105.52.1532017370B  W' ossec9708iADovecot Aborted Login with empty userNov 17 12:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^A ;=# ossec13008iAMail Recipient rejected2025-11-17 12:40:29 H=(localhost) [177.74.82.7]:49408 F= rejected RCPT <0B1HiE5MzUtf5HG@seventreinamentos.com.br>: Sender verify failed177.74.82.73469034@  -+ ossec13001iAExim Auth failed2025-11-17 12:40:27 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:50388: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)201.173.216.1333996063|?  -% ossec13001iBExim Auth failed2025-11-17 12:40:49 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:52707: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)75.80.65.2146252001h>  -Y+ ossec13001iBExim Auth failed2025-11-17 12:40:48 dovecot_login authenticator failed for ([189.59.210.1]) [186.215.245.175]:47139: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)186.215.245.1753469034=  k' ossec9709iBMultiple Dovecot Aborted Logins with empty userNov 17 12:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5IOxLMxD3ICxV3kv>177.87.121.473469034j<  -a' ossec13001iAExim Auth failed2025-11-17 12:40:17 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:42160: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)88.84.205.1042017370X;  -?% ossec13001iAExim Auth failed2025-11-17 12:39:31 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:52255: 535 Incorrect authentication data (set_id=junior.gomes)102.38.3.1772215636t:  -q+ ossec13001iAExim Auth failed2025-11-17 12:39:17 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:45881: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)200.149.213.24234690349 W' ossec9708iADovecot Aborted Login with empty userNov 17 12:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+w5XJ8xDjL+xV3kv>177.87.121.473469034V8  -9' ossec13001iAExim Auth failed2025-11-17 12:38:52 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:44644: 535 Incorrect authentication data (set_id=contato)102.22.27.14623006607 W' ossec9708iAxDovecot Aborted Login with empty userNov 17 12:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p6  -k+ ossec13001iAtExim Auth failed2025-11-17 12:38:27 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:36551: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)185.255.212.1787328005  k' ossec9709iA\Multiple Dovecot Aborted Logins with empty userNov 17 12:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 n9 Y ? T } c~fKnYS  -?' ossec13001iBExim Auth failed2025-11-17 12:44:22 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:60146: 535 Incorrect authentication data (set_id=assessoria)182.95.54.1941269750R  S) ossec11000iBLogin failed on the cpanel service.[2025-11-17 12:43:38 -0300] info [cpaneld] 146.190.96.173 - mecanicodeelite "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mecanicodeelite (has_cpuser_file failed)146.190.96.1731880251Q  W' ossec9708iBDovecot Aborted Login with empty userNov 17 12:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034P  - ) ossec13001iBExim Auth failed2025-11-17 12:44:13 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:43082: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)172.91.113.2486252001O  k' ossec9709iBMultiple Dovecot Aborted Logins with empty userNov 17 12:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jN  -a' ossec13001iBExim Auth failed2025-11-17 12:44:00 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:37760: 535 Incorrect authentication data (set_id=recepcao)74.218.95.1546252001|M  -) ossec13001iBExim Auth failed2025-11-17 12:44:00 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:51806: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)188.81.132.1142264397fL  -]# ossec13001iBExim Auth failed2025-11-17 12:43:20 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:50404: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)46.8.240.262017370aK  -O' ossec13001iBExim Auth failed2025-11-17 12:44:11 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58139: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730J W' ossec9708iBjDovecot Aborted Login with empty userNov 17 12:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034SI  -3' ossec13001iB`Exim Auth failed2025-11-17 12:42:23 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:56511: 535 Incorrect authentication data (set_id=bqtz)37.79.255.1042017370gH  -[' ossec13001iBBExim Auth failed2025-11-17 12:41:53 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:43386: 535 Incorrect authentication data (set_id=bqtz@iemif.com)103.148.92.291168579G W' ossec9708iB,Dovecot Aborted Login with empty userNov 17 12:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<84p3LsxDAI2xV3kv>177.87.121.473469034\F  -G% ossec13001iB(Exim Auth failed2025-11-17 12:41:27 dovecot_login authenticator failed for (ip28.net52.ivn.ttksever.ru) [46.160.52.28]:57860: 535 Incorrect authentication data (set_id=info)46.160.52.282017370_E  -I+ ossec13001iBExim Auth failed2025-11-17 12:41:13 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:58232: 535 Incorrect authentication data (set_id=aureovieira)102.215.188.195192950`D  -M' ossec13001iAExim Auth failed2025-11-17 12:40:46 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:38942: 535 Incorrect authentication data (set_id=contato)152.231.25.643686110 5 # 13 5]c  -G) ossec13001iCExim Auth failed2025-11-17 12:47:23 dovecot_login authenticator failed for ([87.200.226.113]) [87.200.226.113]:34857: 535 Incorrect authentication data (set_id=junior.gomes)87.200.226.113290557eb  -[# ossec13001iCExim Auth failed2025-11-17 12:48:03 dovecot_login authenticator failed for (adsl-5-141-80-56.salekhard.ru) [5.141.80.56]:35482: 535 Incorrect authentication data (set_id=junior.gomes)5.141.80.562017370oa SC' ossec11000iCXLogin failed on the cpanel service.[2025-11-17 12:46:31 -0300] info [cpaneld] 103.55.146.14 - OIxlhfZ8< "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified103.55.146.141210997`  W' ossec9708iCXDovecot Aborted Login with empty userNov 17 12:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -' ossec13001iCExim Auth failed2025-11-17 12:47:09 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:42424: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)49.249.76.2211269750^  k' ossec9709iCyMultiple Dovecot Aborted Logins with empty userNov 17 12:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4Q8uQsxD4MmxV3kv>177.87.121.473469034`]  -I+ ossec13001iCExim Auth failed2025-11-17 12:45:20 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:41916: 535 Incorrect authentication data (set_id=aureovieira)220.189.196.1341814991\ W' ossec9708iCDovecot Aborted Login with empty userNov 17 12:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3L7QPMxDHp6xV3kv>177.87.121.473469034e[  -S+ ossec13001iCExim Auth failed2025-11-17 12:45:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56653: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651kZ  -e% ossec13001iBExim Auth failed2025-11-17 12:44:40 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:64572: 535 Incorrect authentication data (set_id=compras)60.40.45.2231861060Y W' ossec9708iBDovecot Aborted Login with empty userNov 17 12:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034eX  -W' ossec13001iBExim Auth failed2025-11-17 12:44:22 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:59288: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)121.73.163.612186224bW  -O) ossec13001iCExim Auth failed2025-11-17 12:45:11 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:36384: 535 Incorrect authentication data (set_id=noreplay.vendas3)221.10.226.1961814991xV  -y+ ossec13001iBExim Auth failed2025-11-17 12:44:49 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:41820: 535 Incorrect authentication data (set_id=noreplay.vendas3@singseguros.com.br)209.115.177.2126251999ZU  -A' ossec13001iBExim Auth failed2025-11-17 12:44:40 dovecot_login authenticator failed for ([70.91.135.181]) [70.91.135.181]:52677: 535 Incorrect authentication data (set_id=aureovieira)70.91.135.18162520010T  UC) ossec11001iC Deferred login on the cpanel service[2025-11-17 12:45:16 -0300] info [webmaild] 181.77.193.245 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect181.77.193.2453469034  =P^qjs  - ) ossec13001iDGExim Auth failed2025-11-17 12:50:31 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:45244: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)83.227.140.1252661886Yr  -?' ossec13001iDEExim Auth failed2025-11-17 12:50:27 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:33600: 535 Incorrect authentication data (set_id=assessoria)182.95.51.1661269750q  -) ossec13001iDmExim Auth failed2025-11-17 12:51:07 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:57502: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)178.140.95.2212017370ip  -_' ossec13001iDeExim Auth failed2025-11-17 12:51:00 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:60801: 535 Incorrect authentication data (set_id=compras)35.130.111.986252001no  -g+ ossec13001iDYExim Auth failed2025-11-17 12:50:48 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:42342: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)196.189.124.229337996in  -_' ossec13001iDYExim Auth failed2025-11-17 12:50:48 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:40856: 535 Incorrect authentication data (set_id=junior.gomes)119.92.76.2101694008m  3?# ossec11301iDYNew FTP connection.Nov 17 12:50:47 hosting pure-ftpd: (?@71.6.232.24) [INFO] New connection from 71.6.232.2471.6.232.246252001l  k' ossec9709iD+Multiple Dovecot Aborted Logins with empty userNov 17 12:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ik  -_' ossec13001iD)Exim Auth failed2025-11-17 12:50:00 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:42156: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)36.37.181.1811831722sj  -o+ ossec13001iDExim Auth failed2025-11-17 12:49:40 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:34488: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)122.185.144.1501269750i  W' ossec9708iD Dovecot Aborted Login with empty userNov 17 12:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`h  -K+ ossec13001iD Exim Auth failed2025-11-17 12:49:27 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:51094: 535 Incorrect authentication data (set_id=vendas.pedro)102.215.188.195192950rg  -o) ossec13001iD3Exim Auth failed2025-11-17 12:50:10 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:53752: 535 Incorrect authentication data (set_id=assessoria)152.52.236.1581269750sf  -q) ossec13001iCExim Auth failed2025-11-17 12:49:04 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:43186: 535 Incorrect authentication data (set_id=vendas.pedro@maringasoldas.com.br)67.213.230.1226252001e W' ossec9708iCDovecot Aborted Login with empty userNov 17 12:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d W' ossec9708iCDovecot Aborted Login with empty userNov 17 12:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 8 $ *<A(8X  -;) ossec13001iDExim Auth failed2025-11-17 12:52:51 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:51474: 535 Incorrect authentication data (set_id=rafael)112.161.26.1251835841n  -o# ossec13001iDExim Auth failed2025-11-17 12:52:27 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:39994: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)89.67.5.135798544{  -' ossec13001iDExim Auth failed2025-11-17 12:53:05 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:57904: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)177.159.99.953469034  k' ossec9709iDMultiple Dovecot Aborted Logins with empty userNov 17 12:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2HygV8xDqKKxV3kv>177.87.121.473469034  W' ossec9708iDDovecot Aborted Login with empty userNov 17 12:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w~  -y) ossec13001iDExim Auth failed2025-11-17 12:52:15 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:48986: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)182.227.214.331835841j}  -a' ossec13001iDExim Auth failed2025-11-17 12:53:07 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:56416: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)182.66.214.701269750i|  -_' ossec13001iDExim Auth failed2025-11-17 12:52:36 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:36582: 535 Incorrect authentication data (set_id=escritura1)188.122.151.62661886m{  -e) ossec13001iDyExim Auth failed2025-11-17 12:51:20 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:58748: 535 Incorrect authentication data (set_id=leandro)107.175.76.1466252001ez  -U) ossec13001iDExim Auth failed2025-11-17 12:51:36 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:49327: 535 Incorrect authentication data (set_id=andressa.financeiro)212.57.136.1412017370y W' ossec9708iDDovecot Aborted Login with empty userNov 17 12:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{x  S[) ossec11000iDLogin failed on the cpanel service.[2025-11-17 12:51:29 -0300] info [webmaild] 216.26.237.116 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect216.26.237.1166252001w W' ossec9708iDIDovecot Aborted Login with empty userNov 17 12:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ov  -g+ ossec13001iD;Exim Auth failed2025-11-17 12:50:17 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:37718: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)160.191.124.2011269750ku  -c) ossec13001iDMExim Auth failed2025-11-17 12:50:35 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:56168: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)196.189.59.226337996vt  -y' ossec13001iDoExim Auth failed2025-11-17 12:51:10 dovecot_login authenticator failed for ([218.1.150.242]) [218.1.150.242]:38020: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)218.1.150.2421814991 '  A O W w  W' ossec9708iEuDovecot Aborted Login with empty userNov 17 12:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  k' ossec9709iEMultiple Dovecot Aborted Logins with empty userNov 17 12:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n  -i' ossec13001iEUExim Auth failed2025-11-17 12:55:01 dovecot_login authenticator failed for ([221.206.7.126]) [221.206.7.126]:42473: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)221.206.7.1261814991v  -w) ossec13001iEMExim Auth failed2025-11-17 12:54:52 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:42234: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)121.171.95.1121835841n  -i' ossec13001iE[Exim Auth failed2025-11-17 12:55:05 dovecot_login authenticator failed for ([95.220.33.115]) [95.220.33.115]:58150: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)95.220.33.1152017370i  -[+ ossec13001iE[Exim Auth failed2025-11-17 12:55:05 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:56206: 535 Incorrect authentication data (set_id=adriana)175.100.107.2381831722 W' ossec9708iE9Dovecot Aborted Login with empty userNov 17 12:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1I75XMxDAs2xV3kv>177.87.121.473469034Z  -A' ossec13001iE5Exim Auth failed2025-11-17 12:54:29 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:34154: 535 Incorrect authentication data (set_id=alex.vendas)159.75.92.1361814991`  -I+ ossec13001iEcExim Auth failed2025-11-17 12:55:14 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:38754: 535 Incorrect authentication data (set_id=alex.vendas)111.171.127.1901835841\  -E' ossec13001iE_Exim Auth failed2025-11-17 12:55:11 dovecot_login authenticator failed for (ADMIN) [187.45.103.11]:61213: 535 Incorrect authentication data (set_id=comercial@inovasite.com)187.45.103.113469034t  -q+ ossec13001iEMExim Auth failed2025-11-17 12:54:53 dovecot_login authenticator failed for ([223.197.153.143]) [223.197.153.143]:50066: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)223.197.153.1431819730n  -i' ossec13001iE;Exim Auth failed2025-11-17 12:54:34 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:39804: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)147.92.66.1886251999Y  -;+ ossec13001iDExim Auth failed2025-11-17 12:53:24 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:44270: 535 Incorrect authentication data (set_id=contato)222.108.177.1101835841k  -e% ossec13001iE Exim Auth failed2025-11-17 12:53:49 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:45329: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)58.16.201.521814991 W' ossec9708iDDovecot Aborted Login with empty userNov 17 12:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -7' ossec13001iDExim Auth failed2025-11-17 12:53:24 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:56468: 535 Incorrect authentication data (set_id=gerson)152.89.135.302017370   ( ( QQ#  k' ossec9709iFGMultiple Dovecot Aborted Logins with empty userNov 17 12:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]"  -M! ossec13001iFAExim Auth failed2025-11-17 12:58:56 dovecot_login authenticator failed for host-89-243-7-4.as13285.net [89.243.7.4]:45480: 535 Incorrect authentication data (set_id=financeiro)89.243.7.42635167!  W' ossec9708iF)Dovecot Aborted Login with empty userNov 17 12:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -?% ossec13001iF'Exim Auth failed2025-11-17 12:58:31 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:53298: 535 Incorrect authentication data (set_id=atualizacoes)84.54.115.461512440h  -]' ossec13001iFExim Auth failed2025-11-17 12:57:58 dovecot_login authenticator failed for (18980204017.user.veloxzone.com.br) [189.80.146.46]:58344: 535 Incorrect authentication data (set_id=contato)189.80.146.463469034q  -o' ossec13001iEExim Auth failed2025-11-17 12:57:44 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:40042: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)84.213.189.273144096 W' ossec9708iEDovecot Aborted Login with empty userNov 17 12:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 3C% ossec11301iENew FTP connection.Nov 17 12:57:31 hosting pure-ftpd: (?@3.131.215.38) [INFO] New connection from 3.131.215.383.131.215.386252001|  -+ ossec13001iEExim Auth failed2025-11-17 12:57:29 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:46042: 535 Incorrect authentication data (set_id=andressa.financeiro)166.195.195.1696252001S  -7# ossec13001iEExim Auth failed2025-11-17 12:57:24 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:37770: 535 Incorrect authentication data (set_id=financeiro)39.74.74.441814991|  -+ ossec13001iEExim Auth failed2025-11-17 12:57:10 dovecot_login authenticator failed for ([113.160.171.125]) [113.160.171.125]:56158: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)113.160.171.1251562822m  -g' ossec13001iEExim Auth failed2025-11-17 12:57:03 dovecot_login authenticator failed for ([27.202.37.119]) [27.202.37.119]:49162: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)27.202.37.1191814991l  -e' ossec13001iEExim Auth failed2025-11-17 12:56:58 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:56442: 535 Incorrect authentication data (set_id=administrativo1)79.160.128.463144096w  -y) ossec13001iEExim Auth failed2025-11-17 12:56:39 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:36022: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)103.147.248.441269750 W' ossec9708iEDovecot Aborted Login with empty userNov 17 12:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -G) ossec13001iEExim Auth failed2025-11-17 12:55:43 dovecot_login authenticator failed for ([93.157.254.194]) [93.157.254.194]:45932: 535 Incorrect authentication data (set_id=junior.gomes)93.157.254.1942017370    : 5  9N@]Cjoy\3  -C) ossec13001iFExim Auth failed2025-11-17 13:01:37 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:41710: 535 Incorrect authentication data (set_id=escritura1)186.97.203.16536861102  W' ossec9708iFDovecot Aborted Login with empty userNov 17 13:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y1  -?' ossec13001iFExim Auth failed2025-11-17 13:01:24 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:52032: 535 Incorrect authentication data (set_id=escritura1)83.136.176.122510769w0  -y) ossec13001iFExim Auth failed2025-11-17 13:01:01 dovecot_login authenticator failed for ([186.227.91.154]) [186.227.91.154]:50341: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)186.227.91.1543469034U/  -7' ossec13001iFExim Auth failed2025-11-17 13:00:44 dovecot_login authenticator failed for ([27.214.141.53]) [27.214.141.53]:56674: 535 Incorrect authentication data (set_id=rafael)27.214.141.531814991. W' ossec9708iFDovecot Aborted Login with empty userNov 17 13:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_-  -I) ossec13001iFExim Auth failed2025-11-17 13:00:31 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:63110: 535 Incorrect authentication data (set_id=memaagostinho)111.61.177.1881814991 ,  -!' ossec13001iFExim Auth failed2025-11-17 13:00:22 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.64.170]:48662: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)50.171.64.1706252001g+  -_# ossec13001iFExim Auth failed2025-11-17 13:00:22 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:53596: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)60.174.86.41814991^*  -K% ossec13001iFeExim Auth failed2025-11-17 12:59:32 dovecot_login authenticator failed for (dns58.online.tj.cn) [218.69.234.4]:17601: 535 Incorrect authentication data (set_id=isabellylisboa)218.69.234.41814991) W' ossec9708iFeDovecot Aborted Login with empty userNov 17 12:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  -' ossec13001iFUExim Auth failed2025-11-17 12:59:16 dovecot_login authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:55250: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)89.101.36.1592963597['  -C' ossec13001iFExim Auth failed2025-11-17 13:00:04 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:35914: 535 Incorrect authentication data (set_id=misterthomas)93.119.19.1722510769p&  -k) ossec13001iFwExim Auth failed2025-11-17 12:59:51 dovecot_login authenticator failed for ([181.64.123.166]) [181.64.123.166]:37614: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)181.64.123.1663932488x%  -% ossec13001iF!Exim Auth failed2025-11-17 12:58:24 dovecot_login authenticator failed for 98.193.60.94.rev.vodafone.pt [94.60.193.98]:40628: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)94.60.193.982264397s$  -{ ossec13001iFExim Auth failed2025-11-17 12:58:17 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:51044: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)81.43.3.12510769  &MqWvqC  SE+ ossec11000iGLogin failed on the cpanel service.[2025-11-17 13:04:15 -0300] info [whostmgrd] 124.198.131.107 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect124.198.131.1076252001TB  -7% ossec13001iGtExim Auth failed2025-11-17 13:04:03 dovecot_login authenticator failed for ([220.67.138.254]) [221.145.5.14]:55442: 535 Incorrect authentication data (set_id=gerson)221.145.5.141835841VA  -9' ossec13001iGnExim Auth failed2025-11-17 13:03:56 dovecot_login authenticator failed for ([119.220.16.46]) [119.220.16.46]:54275: 535 Incorrect authentication data (set_id=contato)119.220.16.461835841]@  -G) ossec13001iGdExim Auth failed2025-11-17 13:03:47 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:41144: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549? W' ossec9708iGUDovecot Aborted Login with empty userNov 17 13:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X>  -A# ossec13001iGtExim Auth failed2025-11-17 13:04:03 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:52543: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999U=  -7' ossec13001iG^Exim Auth failed2025-11-17 13:03:40 dovecot_login authenticator failed for ([117.57.205.31]) [117.57.205.31]:48864: 535 Incorrect authentication data (set_id=gerson)117.57.205.311814991[<  -?+ ossec13001iGMExim Auth failed2025-11-17 13:03:24 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:42046: 535 Incorrect authentication data (set_id=gerson)197.219.228.2421036973l;  -c) ossec13001iGIExim Auth failed2025-11-17 13:03:21 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:33902: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)128.185.199.141269750: W' ossec9708iGDovecot Aborted Login with empty userNov 17 13:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<96qYecxDWOOxV3kv>177.87.121.473469034c9  -W# ossec13001iG Exim Auth failed2025-11-17 13:02:18 dovecot_login authenticator failed for ([61.37.150.6]) [61.37.150.6]:43112: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)61.37.150.61835841m8  -e) ossec13001iGAExim Auth failed2025-11-17 13:03:13 dovecot_login authenticator failed for ([95.105.113.109]) [95.105.113.109]:40146: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)95.105.113.1092017370k7  -_+ ossec13001iG0Exim Auth failed2025-11-17 13:02:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:54884: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651S6  -5% ossec13001iG$Exim Auth failed2025-11-17 13:02:43 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:50238: 535 Incorrect authentication data (set_id=contato)60.166.8.1741814991,5  e/' ossec9710iGDovecot Auth failed on disconnected session.Nov 17 13:02:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.197.8.136, lip=200.150.196.245, TLS, session=185.197.8.13631753954  k' ossec9709iFMultiple Dovecot Aborted Logins with empty userNov 17 13:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  * ~ t j ` V L B 8 . $    z p f \  v l b X N D : 0 &    | 4 * R H >   vbXlND:0&^|rh@T6J,"xndZPF<2( ~tj`VLB8.$zpf4* \RH >vl:0&bXND r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*  iN[ iN Z iN Y iNX iMW iMV iMU iMT iMS iMR iMQ iMP iMO iMN iMmM iMcL iMK iMJ iMmI iMwH iMeG iMF iM1E iM#D iM!C iM[B iMOA iMK@ iMC? iM> iM= iL< iL; iL: iL9 iM 8 iM7 iL6 iL5 iL4 iL3 iL2 iL1 iL0 iL}/ iL. iL- iL, iLo+ iLM* iLA) iL( iL' iK& iK% iK$ iK# iK" iK! iK iK iK iK iK iK iKo iKU iKK iKE iKE iKu iKS iKQ iK5 iK) iK iK9 iK' iK iK iK  iJ iJ iJ iJ iJ iJ~ iJj iJb iJT iJ. iJ& iJ  iI iI iI iI iI iI iI iI iI iI iI iIx iIp iId iI iI iI iI iI6 iI* iIH iI6 iH iI$ iI iI iI iH iH iH iH| iHx iHr iH iH iHx iHx iHt iHr iHf iHd iHX iHR iHF iH$ iH iH  iG iG iG iG iG iG iG iG iG iG iG iG iG iGt iGn iGd iGU iGt iG^ iGM iGI iG iG  iGA iG0 iG$ iD iD iD iD} iD iD iD iD| iD iD iD~ iDz iDy iDx iDy{ iDot iDmq iDep iDYo iDYn iDYm iDMu iDIw iDGs iDEr iD;v iD3g iD+l iD)k iDj iD i iD h iCf iCe iCb iCd iCc iPb iP\ iPP iPJ iP> iP> iP< iP" iP  iP iP iO iO| iO~ iO} iO{ iOly iOhx iONz iO:w iO.v iOu iNt iNp iNm iNl iNk iNo iNn iNs iNr iNq iNyj iNgi iNah iN]g iNOf iNK` iNI_ iNA^ iN7] iN%\ iN!e iG iF iF iF iF iF iF iF iF iF iF iF iFw iFe iFe iFU iFG iFA iF) iF' iF! iF iF iE iE iE iE iE iE iE iE iE iE iE iE iEu iEc iE_ iE[ iE[ iEU iEMr iPb iEM iE; iE9 iE5 iE  iN!d iNc iNb iNa & PR  -/% ossec13001iH$Exim Auth failed2025-11-17 13:06:58 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:44885: 535 Incorrect authentication data (set_id=maia)61.73.190.981835841Q  -+ ossec13001iHExim Auth failed2025-11-17 13:06:49 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:52462: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)122.187.228.2281269750P W' ossec9708iH Dovecot Aborted Login with empty userNov 17 13:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034O W' ossec9708iGDovecot Aborted Login with empty userNov 17 13:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oN  -i) ossec13001iGExim Auth failed2025-11-17 13:05:18 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:39722: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)121.73.169.1962186224\M  -A+ ossec13001iGExim Auth failed2025-11-17 13:05:47 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:55910: 535 Incorrect authentication data (set_id=contato)103.158.138.1791269750dL  -U' ossec13001iGExim Auth failed2025-11-17 13:04:29 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:39164: 535 Incorrect authentication data (set_id=gerson)111.70.23.2401668284oK  -k' ossec13001iGExim Auth failed2025-11-17 13:04:24 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:34642: 535 Incorrect authentication data (set_id=bqtz@iemif.com)73.128.150.676252001jJ  -_) ossec13001iGExim Auth failed2025-11-17 13:05:12 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:56375: 535 Incorrect authentication data (set_id=assessoria)124.167.20.1161814991tI  -u' ossec13001iGExim Auth failed2025-11-17 13:04:37 dovecot_login authenticator failed for (abts-kk-dynamic-152.24.48.171.airtelbroadband.in) [171.48.24.152]:55498: 535 Incorrect authentication data (set_id=bqtz)171.48.24.1521269750H  W' ossec9708iGDovecot Aborted Login with empty userNov 17 13:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034G  k' ossec9709iGMultiple Dovecot Aborted Logins with empty userNov 17 13:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034SF  ;'% ossec13008iGMail Recipient rejected2025-11-17 13:04:31 H=(195.3.134.135) [179.0.178.53]:52224 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:52224 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034eE  -U+ ossec13001iGExim Auth failed2025-11-17 13:05:10 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:50441: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795mD  -i% ossec13001iGExim Auth failed2025-11-17 13:05:05 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:36577: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)61.73.190.981835841 FB d ~ b9!cI/Fed  -Y) ossec13001iIExim Auth failed2025-11-17 13:10:42 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:46530: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)185.255.47.19099237c W' ossec9708iHDovecot Aborted Login with empty userNov 17 13:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b W' ossec9708iHDovecot Aborted Login with empty userNov 17 13:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034:a  gG' ossec11307iHMultiple connection attempts from same sourceNov 17 13:08:30 hosting pure-ftpd: (?@139.59.57.131) [INFO] New connection from 139.59.57.131139.59.57.1311269750`  -1+ ossec13001iH|Exim Auth failed2025-11-17 13:08:26 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:57008: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)212.120.163.1102017370^_  -G) ossec13001iHxExim Auth failed2025-11-17 13:08:23 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:35622: 535 Incorrect authentication data (set_id=atualizacoes)195.222.57.18332776057^ Ae' ossec11302iHrFTP Authentication failed.Nov 17 13:08:16 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]139.59.57.1311269750:]  Ie' ossec11331iH Stealth FTP brute force attackNov 17 13:08:39 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]139.59.57.1311269750k\  -_+ ossec13001iHExim Auth failed2025-11-17 13:08:38 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:31634: 535 Incorrect authentication data (set_id=contato)128.106.196.1501880251[[  e' ossec11321iHxActive Response. FTP brute force attack (Port 21 is protected)Nov 17 13:08:22 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]139.59.57.1311269750Z  S' ossec211321iHxPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 139.59.57.131139.59.57.1311269750UY  -5) ossec13001iHtExim Auth failed2025-11-17 13:08:18 dovecot_login authenticator failed for dhcp-011-143.coonvalley.mwt.net [216.226.80.143]:55312: 535 Incorrect authentication data216.226.80.1436252001!X 3G' ossec11301iHrNew FTP connection.Nov 17 13:08:17 hosting pure-ftpd: (?@139.59.57.131) [INFO] New connection from 139.59.57.131139.59.57.1311269750bW  -U# ossec13001iHfExim Auth failed2025-11-17 13:08:05 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:4541: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)218.76.73.41814991V  k' ossec9709iHdMultiple Dovecot Aborted Logins with empty userNov 17 13:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347U Ae' ossec11302iHXFTP Authentication failed.Nov 17 13:07:51 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]139.59.57.1311269750!T 3G' ossec11301iHRNew FTP connection.Nov 17 13:07:44 hosting pure-ftpd: (?@139.59.57.131) [INFO] New connection from 139.59.57.131139.59.57.1311269750S  W' ossec9708iHFDovecot Aborted Login with empty userNov 17 13:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  [iu[Ws  -?# ossec13001iIxExim Auth failed2025-11-17 13:12:40 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:53217: 535 Incorrect authentication data (set_id=jose.comercial)77.34.2.1792017370r W' ossec9708iIpDovecot Aborted Login with empty userNov 17 13:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3o5TncxD2rqxV3kv>177.87.121.473469034q  -) ossec13001iIdExim Auth failed2025-11-17 13:12:20 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:54504: 535 Incorrect authentication data (set_id=jose.comercial@sulindustrial.com)172.91.113.2486252001fp  -]# ossec13001iIExim Auth failed2025-11-17 13:13:14 dovecot_login authenticator failed for 111-70-32-7.emome-ip.hinet.net [111.70.32.7]:57413: 535 Incorrect authentication data (set_id=isabellylisboa)111.70.32.71668284no  -g) ossec13001iIExim Auth failed2025-11-17 13:13:10 dovecot_login authenticator failed for ([176.194.76.194]) [176.194.76.194]:58096: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)176.194.76.1942017370+n  -_+ ossec13001iIExim Auth failed2025-11-17 13:13:09 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:56114: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)200.105.141.1723923057xm  -}) ossec13001iIExim Auth failed2025-11-17 13:12:59 dovecot_login authenticator failed for ([196.190.43.138]) [196.190.41.137]:31195: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)196.190.41.137337996-l  e1) ossec9710iI6Dovecot Auth failed on disconnected session.Nov 17 13:11:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=178.216.29.159, lip=200.150.196.245, TLS, session=178.216.29.159798544\k  -A+ ossec13001iI*Exim Auth failed2025-11-17 13:11:20 dovecot_login authenticator failed for ([121.202.146.144]) [121.202.146.144]:59124: 535 Incorrect authentication data (set_id=doninha)121.202.146.1441819730j  e' ossec9710iIHDovecot Auth failed on disconnected session.Nov 17 13:11:51 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=37.203.49.121, lip=200.150.196.245, TLS, session=<47DcmcxDmYAlyzF5>37.203.49.1212963597i W' ossec9708iI6Dovecot Aborted Login with empty userNov 17 13:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  W' ossec9708iHDovecot Aborted Login with empty userNov 17 13:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}g  -) ossec13001iI$Exim Auth failed2025-11-17 13:11:16 dovecot_login authenticator failed for (94x181x191x152.static-business.penza.ertelecom.ru) [94.181.191.152]:44778: 535 Incorrect authentication data (set_id=financeiro)94.181.191.1522017370f  k' ossec9709iIMultiple Dovecot Aborted Logins with empty userNov 17 13:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034me  -g' ossec13001iIExim Auth failed2025-11-17 13:10:55 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:60665: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)74.196.184.786252001    A  #206 UK+ ossec11001iJTDeferred login on the cpanel service[2025-11-17 13:16:20 -0300] info [webmaild] 167.250.152.145 - vendas@brinquelocacoes.com "GET /cpsess9119813859/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect167.250.152.1453469034d  -Q+ ossec13001iJ.Exim Auth failed2025-11-17 13:15:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63047: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651 W' ossec9708iJ&Dovecot Aborted Login with empty userNov 17 13:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  -g' ossec13001iJ Exim Auth failed2025-11-17 13:15:07 dovecot_login authenticator failed for 226.red-83-58-188.dynamicip.rima-tde.net [83.58.188.226]:44202: 535 Incorrect authentication data (set_id=adriana)83.58.188.2262510769[~  -C' ossec13001iIExim Auth failed2025-11-17 13:14:51 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:11406: 535 Incorrect authentication data (set_id=marialuiza)58.49.113.1381814991j}  -]+ ossec13001iIExim Auth failed2025-11-17 13:14:42 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:49553: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)121.168.116.1501835841| W' ossec9708iIDovecot Aborted Login with empty userNov 17 13:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v{  -w) ossec13001iIExim Auth failed2025-11-17 13:14:32 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:52316: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)195.222.57.19032776059z  eK' ossec9710iIDovecot Auth failed on disconnected session.Nov 17 13:14:19 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=128.127.94.53, lip=200.150.196.245, TLS, session=128.127.94.53798544Ry  -3% ossec13001iIExim Auth failed2025-11-17 13:13:28 dovecot_login authenticator failed for ([58.20.76.243]) [58.20.87.113]:48439: 535 Incorrect authentication data (set_id=wesley)58.20.87.1131814991[x  -E% ossec13001iIExim Auth failed2025-11-17 13:14:05 dovecot_login authenticator failed for (37.61.176.53.svttk.ru) [37.61.176.53]:53350: 535 Incorrect authentication data (set_id=eleicoes)37.61.176.532017370w  k' ossec9709iIMultiple Dovecot Aborted Logins with empty userNov 17 13:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6ka1osxDbuaxV3kv>177.87.121.473469034^v  -G) ossec13001iIExim Auth failed2025-11-17 13:13:37 dovecot_login authenticator failed for ([113.108.88.121]) [113.108.88.121]:57666: 535 Incorrect authentication data (set_id=misterthomas)113.108.88.1211814991u  W' ossec9708iIDovecot Aborted Login with empty userNov 17 13:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7hryoMxDdNmxV3kv>177.87.121.473469034ht  -]) ossec13001iIExim Auth failed2025-11-17 13:13:31 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:37495: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)185.101.16.250272103  ]  -G' ossec13001iK)Exim Auth failed2025-11-17 13:19:52 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:34354: 535 Incorrect authentication data (set_id=ferramentaria)125.19.216.581269750  W' ossec9708iKDovecot Aborted Login with empty userNov 17 13:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -_% ossec13001iK9Exim Auth failed2025-11-17 13:20:08 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:59938: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)31.173.2.1822017370r  -q' ossec13001iK'Exim Auth failed2025-11-17 13:19:50 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:41101: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)50.123.92.1306252001\  ;5) ossec13008iKMail Recipient rejected2025-11-17 13:19:40 H=(200.150.196.245) [222.59.173.105]:19368 F= rejected RCPT : "JunkMail rejected - (200.150.196.245) [222.59.173.105]:19368 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/222.59.173.105"222.59.173.1051814991  - % ossec13001iKExim Auth failed2025-11-17 13:19:31 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:34679: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)91.126.40.542510769t  -s) ossec13001iK Exim Auth failed2025-11-17 13:19:21 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:41134: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)121.73.163.2322186224>  [[) ossec5706iJSSH insecure connection attempt (scan).Nov 17 13:18:38 hosting sshd[540]: Did not receive identification string from 162.216.149.83 port 61648162.216.149.836252001 W' ossec9708iJDovecot Aborted Login with empty userNov 17 13:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -=% ossec13001iJExim Auth failed2025-11-17 13:17:49 dovecot_login authenticator failed for ([31.56.60.121]) [31.56.60.121]:43130: 535 Incorrect authentication data (set_id=aureovieira)31.56.60.121298795 W' ossec9708iJDovecot Aborted Login with empty userNov 17 13:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t  -u' ossec13001iJExim Auth failed2025-11-17 13:17:32 dovecot_login authenticator failed for 64.85.222.240.reverse.socket.net [64.85.222.240]:36446: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)64.85.222.2406252001  k' ossec9709iJ~Multiple Dovecot Aborted Logins with empty userNov 17 13:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  So% ossec11000iJjLogin failed on the cpanel service.[2025-11-17 13:16:40 -0300] info [cpaneld] 157.66.54.66 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password157.66.54.661643084  W' ossec9708iJbDovecot Aborted Login with empty userNov 17 13:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  ?A'`  -I+ ossec13001iKExim Auth failed2025-11-17 13:22:31 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:38641: 535 Incorrect authentication data (set_id=alex.vendas)180.168.100.2301814991=  eU# ossec9710iKDovecot Auth failed on disconnected session.Nov 17 13:22:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=5.196.95.34, lip=200.150.196.245, TLS: Connection closed, session=5.196.95.343017382 -5) ossec13001iKExim Auth failed2025-11-17 13:21:45 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:60604: 535 Incorrect authentication data (set_id=contabilidade@maringasoldas.com.br)200.219.123.973469034* U7' ossec11001iKDeferred login on the cpanel service[2025-11-17 13:21:40 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034 W' ossec9708iKDovecot Aborted Login with empty userNov 17 13:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z  -' ossec13001iKExim Auth failed2025-11-17 13:21:23 dovecot_login authenticator failed for (16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:54234: 535 Incorrect authentication data (set_id=financeiro)125.67.190.161814991[  -E% ossec13001iKoExim Auth failed2025-11-17 13:21:01 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:46736: 535 Incorrect authentication data (set_id=administrativo1)175.206.1.601835841X  -A' ossec13001iKUExim Auth failed2025-11-17 13:20:35 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:44170: 535 Incorrect authentication data (set_id=alex.vendas)62.201.212.5299237  - ) ossec13001iKKExim Auth failed2025-11-17 13:20:26 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:35033: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)75.152.225.1546251999]  -I' ossec13001iKEExim Auth failed2025-11-17 13:20:20 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:37692: 535 Incorrect authentication data (set_id=paulinho.vendas)91.239.23.149458258]  -I% ossec13001iKEExim Auth failed2025-11-17 13:20:19 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:50374: 535 Incorrect authentication data (set_id=brizola)103.90.27.831643084~  -+ ossec13001iKuExim Auth failed2025-11-17 13:21:07 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:65047: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)207.200.180.1746252001}  - ' ossec13001iKSExim Auth failed2025-11-17 13:20:33 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:54800: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)85.29.246.199453733 W' ossec9708iKQDovecot Aborted Login with empty userNov 17 13:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  k' ossec9709iK5Multiple Dovecot Aborted Logins with empty userNov 17 13:20:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7fkyuMxD+MexV3kv>177.87.121.473469034 #   ( /  W' ossec9708iL}Dovecot Aborted Login with empty userNov 17 13:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6xTay8xDKK+xV3kv>177.87.121.473469034x.  -y+ ossec13001iLExim Auth failed2025-11-17 13:26:10 dovecot_login authenticator failed for ([221.149.233.246]) [221.149.233.246]:56959: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)221.149.233.2461835841q-  -m+ ossec13001iLExim Auth failed2025-11-17 13:26:08 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11980: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)195.142.106.177298795,  k' ossec9709iLMultiple Dovecot Aborted Logins with empty userNov 17 13:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j+  wA ossec6070iLoAttempt to upload malware through cPanel file managerNov 17 13:25:18 hosting.inovasite.com.br cpanel_fileman_hook[10146]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user fourpsco* -)) ossec13001iLMExim Auth failed2025-11-17 13:24:43 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:49624: 535 Incorrect authentication data (set_id=contabilidade@transol.com.br)200.219.123.973469034) W' ossec9708iLADovecot Aborted Login with empty userNov 17 13:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9/dIyMxD3o+xV3kv>177.87.121.473469034`(  -M' ossec13001iLExim Auth failed2025-11-17 13:23:54 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:65151: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730' W' ossec9708iLDovecot Aborted Login with empty userNov 17 13:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&  W' ossec9708iKDovecot Aborted Login with empty userNov 17 13:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s%  -u% ossec13001iKExim Auth failed2025-11-17 13:22:29 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:37158: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)76.151.32.996252001t$  -q+ ossec13001iKExim Auth failed2025-11-17 13:22:19 dovecot_login authenticator failed for ([119.197.178.198]) [119.197.178.198]:45347: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)119.197.178.1981835841e#  U/' ossec11001iKDeferred login on the cpanel service[2025-11-17 13:23:11 -0300] info [webmaild] 201.24.236.41 - vendas@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing201.24.236.413469034"  k' ossec9709iKMultiple Dovecot Aborted Logins with empty userNov 17 13:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<85/pwsxDlsexV3kv>177.87.121.473469034Y!  -=) ossec13001iKExim Auth failed2025-11-17 13:22:48 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:39828: 535 Incorrect authentication data (set_id=contato)125.17.233.2461269750 ^  + T _ tz`t^*? U7' ossec11001iMCDeferred login on the cpanel service[2025-11-17 13:28:50 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034d>  -Y# ossec13001iMExim Auth failed2025-11-17 13:28:02 dovecot_login authenticator failed for 111-70-51-5.emome-ip.hinet.net [111.70.51.5]:55683: 535 Incorrect authentication data (set_id=junior.gomes)111.70.51.51668284h=  -]' ossec13001iMExim Auth failed2025-11-17 13:27:50 dovecot_login authenticator failed for (adsl-ull-158-20.40-151.wind.it) [151.40.20.158]:32816: 535 Incorrect authentication data (set_id=marialuiza)151.40.20.1583175395< W' ossec9708iLDovecot Aborted Login with empty userNov 17 13:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340; UA) ossec11001iLDeferred login on the cpanel service[2025-11-17 13:27:33 -0300] info [webmaild] 170.254.126.16 - design@ferramentasfranca.com.br "GET /cpsess2511887540/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect170.254.126.163469034k:  -c' ossec13001iLExim Auth failed2025-11-17 13:27:31 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:60978: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)106.0.165.21916056519  - + ossec13001iLExim Auth failed2025-11-17 13:27:15 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:40128: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)185.183.103.1212635167\8  -A+ ossec13001iM Exim Auth failed2025-11-17 13:27:52 dovecot_login authenticator failed for ([211.198.128.204]) [211.198.128.204]:49056: 535 Incorrect authentication data (set_id=contato)211.198.128.2041835841n7  -k% ossec13001iMExim Auth failed2025-11-17 13:27:44 dovecot_login authenticator failed for (187.95.21.18.netjacarei.NipCable.com) [187.95.21.18]:48316: 535 Incorrect authentication data (set_id=junior.gomes)187.95.21.183469034g6  -Y) ossec13001iLExim Auth failed2025-11-17 13:27:36 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:55674: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)221.10.226.1961814991q5  -m) ossec13001iLExim Auth failed2025-11-17 13:27:35 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:59451: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)220.178.39.1061814991S4  -5% ossec13001iLExim Auth failed2025-11-17 13:26:59 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:38982: 535 Incorrect authentication data (set_id=contato)58.16.201.521814991X3  -;) ossec13001iLExim Auth failed2025-11-17 13:26:43 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:60680: 535 Incorrect authentication data (set_id=xavier)182.95.222.1781269750d2  -Y# ossec13001iLExim Auth failed2025-11-17 13:26:40 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:41530: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)1.180.62.411814991s1  -q) ossec13001iLExim Auth failed2025-11-17 13:26:35 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:49801: 535 Incorrect authentication data (set_id=paulinho.vendas)220.246.47.14518197300 W' ossec9708iLDovecot Aborted Login with empty userNov 17 13:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 /   5  '58!D /WO  -;) ossec13001iMExim Auth failed2025-11-17 13:30:38 dovecot_login authenticator failed for ([78.101.217.177]) [78.101.217.177]:55348: 535 Incorrect authentication data (set_id=envios)78.101.217.177289688nN  -g) ossec13001iMExim Auth failed2025-11-17 13:30:37 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:62124: 535 Incorrect authentication data (set_id=formula316)220.246.66.2091819730M W' ossec9708iMmDovecot Aborted Login with empty userNov 17 13:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*L U7' ossec11001iMcDeferred login on the cpanel service[2025-11-17 13:29:22 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034YK  -G! ossec13001iMExim Auth failed2025-11-17 13:30:14 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:56495: 535 Incorrect authentication data (set_id=eleicoes)89.67.37.8798544bJ  -Y ossec13001iMExim Auth failed2025-11-17 13:29:53 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:32918: 535 Incorrect authentication data (set_id=sec.geral)81.43.3.12510769-I U9+ ossec11001iMmDeferred login on the cpanel service[2025-11-17 13:29:33 -0300] info [webmaild] 167.250.152.145 - vendas@brinquelocacoes.com "GET /cpsess0017617181/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect167.250.152.1453469034yH  -' ossec13001iMwExim Auth failed2025-11-17 13:29:43 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:46494: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)182.95.57.1581269750nG  -g) ossec13001iMeExim Auth failed2025-11-17 13:29:24 dovecot_login authenticator failed for ([113.108.191.82]) [113.108.191.82]:37840: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)113.108.191.821814991qF  -q% ossec13001iMExim Auth failed2025-11-17 13:29:59 dovecot_login authenticator failed for c77-218-36-28.bredband.tele2.se [77.218.36.28]:56640: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)77.218.36.282661886E  W' ossec9708iM1Dovecot Aborted Login with empty userNov 17 13:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YD  -?' ossec13001iM#Exim Auth failed2025-11-17 13:28:19 dovecot_login authenticator failed for ([27.24.141.105]) [27.24.141.105]:52316: 535 Incorrect authentication data (set_id=marialuiza)27.24.141.1051814991zC  -' ossec13001iM!Exim Auth failed2025-11-17 13:28:17 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:45308: 535 Incorrect authentication data (set_id=junior.gomes)61.95.192.1581269750 B  3G' ossec11301iM[New FTP connection.Nov 17 13:29:15 hosting pure-ftpd: (?@205.210.31.29) [INFO] New connection from 205.210.31.29205.210.31.296252001A  k' ossec9709iMOMultiple Dovecot Aborted Logins with empty userNov 17 13:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%@  e!' ossec9710iMKDovecot Auth failed on disconnected session.Nov 17 13:28:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=187.120.73.83, lip=200.150.196.245, TLS, session=187.120.73.833469034 H4/" w j ] P C 6 )    s f Y L ? 2 %  ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   yl_RE8+uh[^QD7*tgZM@3& xkN}pc!AVI;.4<|obth\PD8, xl`TH 1269750) 1269750)K 1269750( 1269750&L 1269750&@ 1269750&3 1269750&1 1269750&+ 1269750&% 1269750& 1269750& 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750%y 1269750%u 1269750%n 1269750%k 1269750%a 1269750%\ 1269750%L 1269750%C 1269750%= 1269750%< 1269750%& 1269750%" 1269750% 1269750$ 1269750$ 1269750$ 1269750$ 12697505 12697504 1269750) 1269750)^ 1269750)L 1269750) 1269750( 1269750( 1269750( 1269750( 1269750( 1269750( 1269750(z 1269750(s 1269750' 1269750' 1269750' 1269750' 1269750' 1269750' 1269750' 1269750'l 1269750'i 1269750'H 1269750'> 1269750'; 1269750'* 1269750'' 1269750' 1269750' 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750&y 1269750&x 1269750&M 1269750(_ 1269750(R 1269750(7 1269750(- 1269750(, 1269750( 1269750' 1269750' 1269750( 1269750( 1269750( 1269750)I 1269750)G 1269750)% 1269750) 1269750)s 1269750)n 1269750*] 1269750*W 1269750*= 1269750*+ 1269750*) 1269750* 1269750* 1269750* 1269750) 1269750) 1269750) 1269750) 1269750 1269750 1269750 q 1269750 J 1269750 G 1269750 F 1269750 9 1269750 ) 1269750 % 1269750  1269750  1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750Y 1269750I 1269750> 1269750$ 1269750$ 1269750$ 1269750$ 1269750$ 1269750$ 1269750$y 1269750$w 1269750$Y 1269750$R 1269750$M 1269750$K 1269750$E 1269750$3 1269750$* 1269750$ 1269750$ 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750#S 1269750#O 1269750#@ 1269750#: 1269750#& 1269750#" 1269750# 1269750# 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750"s 1269750"m 1269750"d 1269750"c 1269750"[ 1269750"W 1269750"G 1269750"@ 1269750"? 1269750"= 1269750"4 1269750"2 1269750" 1269750" 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750!w 1269750!q 1269750!m 1269750!l 1269750![ 1269750!K 1269750!< 1269750!8 1269750!5 1269750!0 1269750!- 1269750! 1269750! 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 d3 ) 9  / &(Jdb_  -O) ossec13001iNIExim Auth failed2025-11-17 13:33:13 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:49550: 535 Incorrect authentication data (set_id=marcelo.pinheiro)190.223.36.1083932488Z^  -?) ossec13001iNAExim Auth failed2025-11-17 13:33:05 dovecot_login authenticator failed for ([122.185.152.199]) [182.95.178.158]:43372: 535 Incorrect authentication data (set_id=eduardo)182.95.178.1581269750s]  -q) ossec13001iN7Exim Auth failed2025-11-17 13:32:54 dovecot_login authenticator failed for (static.vnpt.vn) [14.232.239.231]:56738: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)14.232.239.2311562822m\  -e) ossec13001iN%Exim Auth failed2025-11-17 13:32:37 dovecot_login authenticator failed for ([219.128.55.254]) [219.128.55.254]:37600: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)219.128.55.2541814991[ --) ossec13001iNExim Auth failed2025-11-17 13:32:22 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:49581: 535 Incorrect authentication data (set_id=contato@administrarmais.com.br)200.219.123.973469034rZ  -u# ossec13001iN Exim Auth failed2025-11-17 13:32:13 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:58074: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)2.37.223.583175395lY  -e' ossec13001iN Exim Auth failed2025-11-17 13:32:08 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:48418: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)182.78.159.821269750X  k' ossec9709iNMultiple Dovecot Aborted Logins with empty userNov 17 13:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W  3G' ossec11301iMNew FTP connection.Nov 17 13:31:43 hosting pure-ftpd: (?@194.164.107.5) [INFO] New connection from 194.164.107.5194.164.107.56252001V  W' ossec9708iMDovecot Aborted Login with empty userNov 17 13:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/U UA' ossec11001iMDeferred login on the cpanel service[2025-11-17 13:31:19 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "POST /cpsess9230285596/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034T W' ossec9708iMDovecot Aborted Login with empty userNov 17 13:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lS  -i% ossec13001iMExim Auth failed2025-11-17 13:30:25 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:41147: 535 Incorrect authentication data (set_id=envios@comercial.art.br)46.10.56.170732800R  -+ ossec13001iMExim Auth failed2025-11-17 13:30:16 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:34324: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)201.183.225.1563658394`Q  -Q% ossec13001iMExim Auth failed2025-11-17 13:31:03 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:58092: 535 Incorrect authentication data (set_id=aureovieira)77.85.43.156732800eP  -W' ossec13001iMExim Auth failed2025-11-17 13:30:52 dovecot_login authenticator failed for ([181.93.60.253]) [181.93.60.253]:58145: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)181.93.60.2533865483   -3@V{@o  [_) ossec5706iNSSH insecure connection attempt (scan).Nov 17 13:34:32 hosting sshd[27320]: Did not receive identification string from 162.216.149.79 port 64126162.216.149.796252001n  W' ossec9708iNDovecot Aborted Login with empty userNov 17 13:34:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8TEP7MxDRJSxV3kv>177.87.121.473469034Pm  -1# ossec13001iNExim Auth failed2025-11-17 13:34:56 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:49058: 535 Incorrect authentication data (set_id=compras)103.69.9.161269750]l  -E) ossec13001iNExim Auth failed2025-11-17 13:34:49 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:40233: 535 Incorrect authentication data (set_id=aureovieira)115.141.143.581835841Wk  -;' ossec13001iNExim Auth failed2025-11-17 13:34:38 dovecot_login authenticator failed for ([125.22.221.129]) [125.17.28.138]:53850: 535 Incorrect authentication data (set_id=compras)125.17.28.1381269750fj  -[% ossec13001iNyExim Auth failed2025-11-17 13:34:00 dovecot_login authenticator failed for ([114.98.63.18]) [114.98.63.18]:58604: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)114.98.63.181814991oi  -g+ ossec13001iNgExim Auth failed2025-11-17 13:33:42 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:34959: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)103.194.243.1871269750\h  -E' ossec13001iNaExim Auth failed2025-11-17 13:33:36 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:43595: 535 Incorrect authentication data (set_id=vendas.dilson)89.101.36.1592963597g W' ossec9708iN]Dovecot Aborted Login with empty userNov 17 13:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034hf  -[) ossec13001iNOExim Auth failed2025-11-17 13:33:18 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:51034: 535 Incorrect authentication data (set_id=contato)94.255.208.1692661886Te  -5) ossec13001iN!Exim Auth failed2025-11-17 13:32:32 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:44302: 535 Incorrect authentication data (set_id=adm)102.23.242.223953987d W' ossec9708iN!Dovecot Aborted Login with empty userNov 17 13:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034pc  -o% ossec13001iNExim Auth failed2025-11-17 13:32:30 dovecot_login authenticator failed for ([36.135.62.84]) [36.135.62.85]:39666: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)36.135.62.851814991Vb  -9' ossec13001iNExim Auth failed2025-11-17 13:32:24 dovecot_login authenticator failed for ([121.147.74.67]) [121.147.74.67]:51498: 535 Incorrect authentication data (set_id=contato)121.147.74.671835841/a UA' ossec11001iNDeferred login on the cpanel service[2025-11-17 13:32:20 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "POST /cpsess9230285596/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034p`  -o' ossec13001iNKExim Auth failed2025-11-17 13:33:14 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:51973: 535 Incorrect authentication data (set_id=vendas.dilson@maringasoldas.com.br)46.210.96.232294640  ]:!' l~  -e' ossec13001iOExim Auth failed2025-11-17 13:39:38 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:55227: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)15.218.135.586252001} W' ossec9708iODovecot Aborted Login with empty userNov 17 13:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+p7s/cxDIsKxV3kv>177.87.121.473469034\|  -E' ossec13001iOExim Auth failed2025-11-17 13:39:50 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:52876: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001{ W' ossec9708iODovecot Aborted Login with empty userNov 17 13:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0WVW+sxDfKGxV3kv>177.87.121.473469034z  W' ossec9708iONDovecot Aborted Login with empty userNov 17 13:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y  k' ossec9709iOlMultiple Dovecot Aborted Logins with empty userNov 17 13:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x  3C% ossec11301iOhNew FTP connection.Nov 17 13:37:59 hosting pure-ftpd: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991Zw  -?) ossec13001iO:Exim Auth failed2025-11-17 13:37:12 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:35602: 535 Incorrect authentication data (set_id=mauricio)190.117.96.1743932488hv  -Y+ ossec13001iO.Exim Auth failed2025-11-17 13:37:01 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:46990: 535 Incorrect authentication data (set_id=mauricio@mag.adv.br)154.144.255.2082542007u W' ossec9708iODovecot Aborted Login with empty userNov 17 13:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t W' ossec9708iNDovecot Aborted Login with empty userNov 17 13:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9xWU78xDNrSxV3kv>177.87.121.473469034~s  -) ossec13001iNExim Auth failed2025-11-17 13:34:27 dovecot_login authenticator failed for broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:33456: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)109.173.39.1032017370kr  -_+ ossec13001iNExim Auth failed2025-11-17 13:34:25 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50978: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651lq  -c) ossec13001iNExim Auth failed2025-11-17 13:34:20 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46983: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)103.248.30.2051269750p  k' ossec9709iNMultiple Dovecot Aborted Logins with empty userNov 17 13:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 | !   hV^s~|  -3) ossec13001iPExim Auth failed2025-11-17 13:42:49 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:52458: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)14.140.218.2101269750i  -[+ ossec13001iPExim Auth failed2025-11-17 13:42:40 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:50762: 535 Incorrect authentication data (set_id=contato)218.212.140.1711880251y  -}) ossec13001iPrExim Auth failed2025-11-17 13:42:26 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:50946: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)89.242.182.1592635167q  -o' ossec13001iPPExim Auth failed2025-11-17 13:41:52 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:59951: 535 Incorrect authentication data (set_id=administrativo1)24.97.253.2466252001g  -[' ossec13001iPJExim Auth failed2025-11-17 13:41:44 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:55168: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)222.76.248.541814991t  -u' ossec13001iP>Exim Auth failed2025-11-17 13:41:33 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:52864: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)121.73.163.612186224 -%) ossec13001iP<Exim Auth failed2025-11-17 13:41:31 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54233: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)200.219.123.973469034#  3K) ossec11301iPbNew FTP connection.Nov 17 13:42:08 hosting pure-ftpd: (?@147.185.132.97) [INFO] New connection from 147.185.132.97147.185.132.976252001d  -W% ossec13001iPbExim Auth failed2025-11-17 13:42:08 dovecot_login authenticator failed for ([193.111.3.59]) [193.111.3.59]:56232: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)193.111.3.592017370m  -g' ossec13001iP\Exim Auth failed2025-11-17 13:42:04 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:53629: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)192.34.164.136252001 W' ossec9708iP>Dovecot Aborted Login with empty userNov 17 13:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -) ossec13001iPExim Auth failed2025-11-17 13:40:34 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:39858: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)110.25.105.2231668284  W' ossec9708iPDovecot Aborted Login with empty userNov 17 13:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034M  --! ossec13001iOExim Auth failed2025-11-17 13:40:28 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:33752: 535 Incorrect authentication data (set_id=contato)59.51.87.91814991g  -[' ossec13001iP"Exim Auth failed2025-11-17 13:41:06 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:51121: 535 Incorrect authentication data (set_id=adriana)95.31.209.1022017370  k' ossec9709iP Multiple Dovecot Aborted Logins with empty userNov 17 13:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   0 1 RT@I/Xth_  -I) ossec13001iPExim Auth failed2025-11-17 13:43:51 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:59246: 535 Incorrect authentication data (set_id=atualizacoes1)121.73.161.1432186224  W' ossec9708iPDovecot Aborted Login with empty userNov 17 13:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o -k% ossec13001iPExim Auth failed2025-11-17 13:44:09 dovecot_plain authenticator failed for ([2.58.200.173]) [2.58.200.173]:51864: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)2.58.200.1736252001`  -K) ossec13001iPExim Auth failed2025-11-17 13:43:00 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:49041: 535 Incorrect authentication data (set_id=isabellylisboa)190.114.243.873625428S  -7# ossec13001iPExim Auth failed2025-11-17 13:42:45 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:43442: 535 Incorrect authentication data (set_id=financeiro)1.180.62.411814991 W' ossec9708iPzDovecot Aborted Login with empty userNov 17 13:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s  -q) ossec13001iPrExim Auth failed2025-11-17 13:42:25 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:51305: 535 Incorrect authentication data (set_id=formula316)203.174.182.382077456 -)) ossec13001iPExim Auth failed2025-11-17 13:43:01 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54720: 535 Incorrect authentication data (set_id=contato@calcautomacao.com.br)200.219.123.973469034z  -% ossec13001iPExim Auth failed2025-11-17 13:42:54 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:53412: 535 Incorrect authentication data (set_id=vendas.pedro)146.4.81.2062658434[  -C' ossec13001iPExim Auth failed2025-11-17 13:42:40 dovecot_login authenticator failed for ([123.163.52.74]) [123.163.52.74]:48254: 535 Incorrect authentication data (set_id=atualizacoes)123.163.52.741814991{  -% ossec13001iPxExim Auth failed2025-11-17 13:42:31 dovecot_login authenticator failed for (170-83-41-60.swtelecom.com.br) [170.83.41.60]:60557: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)170.83.41.603469034l  -c) ossec13001iPnExim Auth failed2025-11-17 13:42:22 dovecot_login authenticator failed for ([221.235.182.76]) [61.184.128.210]:44056: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)61.184.128.2101814991m  -e) ossec13001iPExim Auth failed2025-11-17 13:43:12 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:48021: 535 Incorrect authentication data (set_id=compras)67.241.128.1976252001y  -# ossec13001iP~Exim Auth failed2025-11-17 13:42:37 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:56759: 535 Incorrect authentication data (set_id=vendas.pedro@maringasoldas.com.br)58.27.253.61168579\  -C) ossec13001iPlExim Auth failed2025-11-17 13:42:20 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:39730: 535 Incorrect authentication data (set_id=financeiro)125.19.253.1541269750  -)' ossec13001iPExim Auth failed2025-11-17 13:42:56 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.64.170]:36672: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)50.171.64.1706252001   ) ; L ) .Tl Y.  -=) ossec13001iQExim Auth failed2025-11-17 13:45:14 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:54870: 535 Incorrect authentication data (set_id=contato)122.184.120.981269750[-  -?+ ossec13001iQExim Auth failed2025-11-17 13:45:09 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:57720: 535 Incorrect authentication data (set_id=design)183.167.193.1271814991v,  -u+ ossec13001iQ Exim Auth failed2025-11-17 13:44:58 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:45262: 535 Incorrect authentication data (set_id=design@inovasite.com)165.220.130.1602510769i+  -_' ossec13001iQ Exim Auth failed2025-11-17 13:44:57 dovecot_login authenticator failed for ([223.210.0.110]) [111.48.77.157]:22489: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)111.48.77.1571814991X*  -;) ossec13001iQExim Auth failed2025-11-17 13:44:53 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:45466: 535 Incorrect authentication data (set_id=mecati)221.234.48.1471814991s)  -o+ ossec13001iQExim Auth failed2025-11-17 13:44:49 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:49642: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)128.185.235.1101269750f(  -W) ossec13001iPExim Auth failed2025-11-17 13:44:40 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:51004: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)220.93.167.1441835841d'  -U' ossec13001iQExim Auth failed2025-11-17 13:44:50 dovecot_login authenticator failed for ([111.53.131.79]) [111.53.131.79]:54134: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)111.53.131.791814991V&  -;% ossec13001iQExim Auth failed2025-11-17 13:45:08 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:41493: 535 Incorrect authentication data (set_id=marialuiza)180.165.1.711814991w%  -w+ ossec13001iQExim Auth failed2025-11-17 13:45:01 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:35264: 535 Incorrect authentication data (set_id=junior.gomes)122.185.176.1261269750$  k' ossec9709iPMultiple Dovecot Aborted Logins with empty userNov 17 13:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k#  -a) ossec13001iPExim Auth failed2025-11-17 13:43:34 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:60080: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)182.95.224.1021269750j"  -a' ossec13001iPExim Auth failed2025-11-17 13:43:17 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:33630: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)61.133.10.2041814991h!  -[) ossec13001iPExim Auth failed2025-11-17 13:44:16 dovecot_login authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:51165: 535 Incorrect authentication data (set_id=anderson)124.167.20.1301814991h  -]' ossec13001iPExim Auth failed2025-11-17 13:44:14 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:57324: 535 Incorrect authentication data (set_id=rafael)59.144.79.1021269750{  -) ossec13001iPExim Auth failed2025-11-17 13:44:06 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:46318: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)57.132.150.1626252001  ! j=  -c% ossec13001iRExim Auth failed2025-11-17 13:49:07 dovecot_login authenticator failed for ([59.16.192.32]) [59.16.192.32]:34898: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)59.16.192.321835841[<  -C' ossec13001iQExim Auth failed2025-11-17 13:48:15 dovecot_login authenticator failed for ([218.13.214.18]) [218.13.214.18]:39982: 535 Incorrect authentication data (set_id=atualizacoes)218.13.214.181814991v;  -w) ossec13001iQExim Auth failed2025-11-17 13:48:10 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:46312: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)125.19.154.1581269750e:  -S+ ossec13001iQExim Auth failed2025-11-17 13:47:48 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53953: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651l9  -c) ossec13001iQExim Auth failed2025-11-17 13:47:41 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:35628: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.227.214.3318358418 -1) ossec13001iQExim Auth failed2025-11-17 13:47:34 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:63335: 535 Incorrect authentication data (set_id=contato@compensadosparana.com.br)200.219.123.9734690347 W' ossec9708iQDovecot Aborted Login with empty userNov 17 13:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3LCKGs1DnoOxV3kv>177.87.121.4734690346  k' ossec9709iQMultiple Dovecot Aborted Logins with empty userNov 17 13:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345  W' ossec9708iQjDovecot Aborted Login with empty userNov 17 13:46:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y4  -=) ossec13001iQ^Exim Auth failed2025-11-17 13:46:22 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:42678: 535 Incorrect authentication data (set_id=contato)190.67.106.2213686110o3  -k) ossec13001iQLExim Auth failed2025-11-17 13:46:04 dovecot_login authenticator failed for ([185.250.240.220]) [88.249.175.243]:58091: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)88.249.175.243298795U2  -7' ossec13001iQ:Exim Auth failed2025-11-17 13:45:45 dovecot_login authenticator failed for ([113.57.108.79]) [183.92.116.88]:3705: 535 Incorrect authentication data (set_id=contato)183.92.116.8818149911 W' ossec9708iQ.Dovecot Aborted Login with empty userNov 17 13:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034~0  -) ossec13001iQ*Exim Auth failed2025-11-17 13:45:29 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:41212: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)94.124.225.1592017370/ W' ossec9708iPDovecot Aborted Login with empty userNov 17 13:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 i % ; `=\cJ[t|iM  -)) ossec13001iRYExim Auth failed2025-11-17 13:50:32 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:48422: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)122.185.187.301269750L W' ossec9708iRYDovecot Aborted Login with empty userNov 17 13:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ZK  -A' ossec13001iRUExim Auth failed2025-11-17 13:50:28 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:61588: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001cJ  -O+ ossec13001iRiExim Auth failed2025-11-17 13:50:48 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:34084: 535 Incorrect authentication data (set_id=isabellylisboa)121.131.220.1441835841kI  -_+ ossec13001iRExim Auth failed2025-11-17 13:49:32 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:56113: 535 Incorrect authentication data (set_id=financeiro)121.202.140.1111819730H  W' ossec9708iRDovecot Aborted Login with empty userNov 17 13:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034uG  -u) ossec13001iRExim Auth failed2025-11-17 13:49:25 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:43268: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)92.126.223.1752017370]F  -C+ ossec13001iRExim Auth failed2025-11-17 13:49:21 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:51005: 535 Incorrect authentication data (set_id=anderson)218.146.133.1171835841E  k' ossec9709iR;Multiple Dovecot Aborted Logins with empty userNov 17 13:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034WD  -9) ossec13001iR(Exim Auth failed2025-11-17 13:49:43 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:52366: 535 Incorrect authentication data (set_id=bruno)121.73.168.2342186224fC  -[% ossec13001iQExim Auth failed2025-11-17 13:48:57 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:57055: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)175.206.1.601835841SB  -5' ossec13001iQExim Auth failed2025-11-17 13:48:38 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:55964: 535 Incorrect authentication data (set_id=contato)102.221.51.50953987eA  -W' ossec13001iR Exim Auth failed2025-11-17 13:49:12 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:36384: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)41.216.169.122328926a@  -M) ossec13001iRExim Auth failed2025-11-17 13:49:07 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:35828: 535 Incorrect authentication data (set_id=flavio.oliveira)212.57.136.1412017370? -9) ossec13001iRExim Auth failed2025-11-17 13:49:03 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:61175: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)200.219.123.973469034> W' ossec9708iQDovecot Aborted Login with empty userNov 17 13:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 i emi^  - ) ossec13001iStExim Auth failed2025-11-17 13:55:15 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:58002: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)213.33.204.1302017370t]  -u' ossec13001iSlExim Auth failed2025-11-17 13:55:06 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:36737: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)92.100.39.1802017370-\  e-+ ossec9710iSDovecot Auth failed on disconnected session.Nov 17 13:53:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001[ W' ossec9708iSDovecot Aborted Login with empty userNov 17 13:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iZ  -]) ossec13001iS Exim Auth failed2025-11-17 13:53:30 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:52309: 535 Incorrect authentication data (set_id=bianca.user.admin)158.181.132.861527747CY  77 ossec502iS Ossec server started.ossec: Ossec started.\X  -E' ossec13001iRExim Auth failed2025-11-17 13:52:26 dovecot_login authenticator failed for ([111.57.17.171]) [111.57.17.171]:46562: 535 Incorrect authentication data (set_id=mailer-daemon)111.57.17.1711814991`W  -O' ossec13001iRExim Auth failed2025-11-17 13:52:23 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:51678: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795tV  -u' ossec13001iRExim Auth failed2025-11-17 13:53:09 dovecot_login authenticator failed for ([61.185.30.170]) [61.185.30.170]:45919: 535 Incorrect authentication data (set_id=bianca.user.admin@globalmedica.com.br)61.185.30.1701814991U W' ossec9708iRDovecot Aborted Login with empty userNov 17 13:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0SllLM1D0N6xV3kv>177.87.121.473469034wT  -w+ ossec13001iRExim Auth failed2025-11-17 13:51:20 dovecot_login authenticator failed for ([203.147.89.38]) [117.197.206.134]:50700: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)117.197.206.1341269750|S  -) ossec13001iRExim Auth failed2025-11-17 13:51:55 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:40230: 535 Incorrect authentication data (set_id=adriana)122.180.249.321269750xR  -{) ossec13001iRExim Auth failed2025-11-17 13:51:45 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:60136: 535 Incorrect authentication data (set_id=mailer-daemon@hosting.inovasite.com.br)190.110.36.1273508796Q  -) ossec13001iRExim Auth failed2025-11-17 13:51:39 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:53828: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)220.246.66.2091819730P  W' ossec9708iRDovecot Aborted Login with empty userNov 17 13:52:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bO  -O) ossec13001iRExim Auth failed2025-11-17 13:51:53 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:39346: 535 Incorrect authentication data (set_id=marcelo.pinheiro)112.162.18.1501835841CN  77 ossec502iROssec server started.ossec: Ossec started. r "  % 0 P" >IrSo  -5% ossec13001iSExim Auth failed2025-11-17 13:56:25 dovecot_login authenticator failed for ([111.26.67.36]) [111.26.67.36]:36866: 535 Incorrect authentication data (set_id=contato)111.26.67.361814991qn  -m) ossec13001iSExim Auth failed2025-11-17 13:56:25 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:51839: 535 Incorrect authentication data (set_id=alex.vendas)75.183.102.1896252001Em  -' ossec13001iSExim Auth failed2025-11-17 13:57:11 dovecot_login authenticator failed for ([178.232.65.99]) [178.232.65.99]:41353: 535 Incorrect authentication data178.232.65.993144096el  -[# ossec13001iSExim Auth failed2025-11-17 13:57:00 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:22724: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)218.76.73.41814991Sk  -5% ossec13001iSExim Auth failed2025-11-17 13:56:47 dovecot_login authenticator failed for ([111.26.62.46]) [111.26.62.46]:49904: 535 Incorrect authentication data (set_id=compras)111.26.62.461814991Cj  77 ossec502iSOssec server started.ossec: Ossec started.ti  -q+ ossec13001iSExim Auth failed2025-11-17 13:56:15 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:46075: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)103.146.233.2001269750vh  -w) ossec13001iSExim Auth failed2025-11-17 13:56:07 dovecot_login authenticator failed for (ip-178-46-128-225.dsl.surnet.ru) [178.46.128.225]:44363: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)178.46.128.2252017370g  k' ossec9709iSMultiple Dovecot Aborted Logins with empty userNov 17 13:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*f  e/# ossec9710iSDovecot Auth failed on disconnected session.Nov 17 13:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<5SqIOM1DFsUXXz9j>23.95.63.996252001\e  -C) ossec13001iSExim Auth failed2025-11-17 13:55:37 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:50572: 535 Incorrect authentication data (set_id=financeiro)209.66.120.2376252001Xd  -A# ossec13001iSExim Auth failed2025-11-17 13:55:37 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:54805: 535 Incorrect authentication data (set_id=administrativo1)80.64.28.822017370c  W' ossec9708iSDovecot Aborted Login with empty userNov 17 13:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_b  -K' ossec13001iSdExim Auth failed2025-11-17 13:54:58 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:50308: 535 Incorrect authentication data (set_id=paulo.user.admin)213.234.8.1142017370a W' ossec9708iSJDovecot Aborted Login with empty userNov 17 13:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3DmIM81DzMKxV3kv>177.87.121.473469034c` -M+ ossec13001iSFExim Auth failed2025-11-17 13:54:29 dovecot_login authenticator failed for (fernandabrumoficial.com) [111.122.211.212]:28658: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991s_  -s' ossec13001iSBExim Auth failed2025-11-17 13:54:24 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:35948: 535 Incorrect authentication data (set_id=paulo.user.admin@louvoreterno.com.br)209.23.72.1446252001 + +Y  -=) ossec13001iSExim Auth failed2025-11-17 13:57:24 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:34422: 535 Incorrect authentication data (set_id=rodrigo)61.184.176.2521814991j~  -a' ossec13001iSExim Auth failed2025-11-17 13:57:20 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:9602: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)41.219.149.782328926c}  -U' ossec13001iT Exim Auth failed2025-11-17 13:58:07 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:58785: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795j|  -_) ossec13001iTExim Auth failed2025-11-17 13:58:04 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:42211: 535 Incorrect authentication data (set_id=xavier)177.174.95.2453469034{ W' ossec9708iSDovecot Aborted Login with empty userNov 17 13:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'z  e#) ossec9710iSDovecot Auth failed on disconnected session.Nov 17 13:57:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841ry  -q' ossec13001iTExim Auth failed2025-11-17 13:57:43 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:58000: 535 Incorrect authentication data (set_id=ieqcampocomprido)220.246.40.631819730ux  -u) ossec13001iSExim Auth failed2025-11-17 13:57:28 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:50938: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)46.212.127.1283144096yw  -' ossec13001iTExim Auth failed2025-11-17 13:57:53 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:37066: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)68.193.149.886252001jv  -c% ossec13001iSExim Auth failed2025-11-17 13:56:27 dovecot_login authenticator failed for ([111.26.63.82]) [111.26.63.83]:54188: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)111.26.63.831814991ku  -c' ossec13001iSExim Auth failed2025-11-17 13:56:26 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:60828: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)83.136.176.122510769]t  -G) ossec13001iSExim Auth failed2025-11-17 13:57:07 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:46584: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549~s  -) ossec13001iSExim Auth failed2025-11-17 13:56:52 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:46006: 535 Incorrect authentication data (set_id=sec.geral)122.160.51.1091269750r W' ossec9708iSDovecot Aborted Login with empty userNov 17 13:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1pOyOs1DFp+xV3kv>177.87.121.473469034lq  -e' ossec13001iSExim Auth failed2025-11-17 13:56:35 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:38370: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)182.95.115.3812697506p  eA) ossec9710iSDovecot Auth failed on disconnected session.Nov 17 13:56:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<8/VTOs1DioFA44h6>64.227.136.1221269750   7 U 2 T!"- W' ossec9708iTDovecot Aborted Login with empty userNov 17 14:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  -m) ossec13001iTExim Auth failed2025-11-17 14:01:16 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:57392: 535 Incorrect authentication data (set_id=contato)93.121.175.2203579143w  -w+ ossec13001iTExim Auth failed2025-11-17 14:01:14 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:42296: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)121.202.138.1811819730  - ) ossec13001iTExim Auth failed2025-11-17 14:01:03 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:36694: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)116.98.104.1381562822q  -o' ossec13001iTExim Auth failed2025-11-17 14:00:52 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:51819: 535 Incorrect authentication data (set_id=comercial.user.admin@inovasite.com)147.92.66.1886251999j S;% ossec11000iTLogin failed on the cpanel service.[2025-11-17 14:00:47 -0300] info [cpaneld] 103.82.65.48 - 1075fm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified103.82.65.482077456  W' ossec9708iTDovecot Aborted Login with empty userNov 17 14:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1/84R81DIrOxV3kv>177.87.121.4734690343  e9+ ossec9710iTDovecot Auth failed on disconnected session.Nov 17 14:00:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001Z  -A' ossec13001iTExim Auth failed2025-11-17 13:59:42 dovecot_login authenticator failed for ([187.51.252.236]) [186.201.54.90]:48581: 535 Incorrect authentication data (set_id=marialuiza)186.201.54.903469034  k' ossec9709iTtMultiple Dovecot Aborted Logins with empty userNov 17 13:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -M# ossec13001iTfExim Auth failed2025-11-17 13:59:18 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:49114: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)103.69.9.161269750Y  -=) ossec13001iTZExim Auth failed2025-11-17 13:59:05 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:43382: 535 Incorrect authentication data (set_id=contato)183.171.53.2361733045m  -g' ossec13001iT:Exim Auth failed2025-11-17 13:58:33 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:48602: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)51.75.142.1573017382 W' ossec9708iT:Dovecot Aborted Login with empty userNov 17 13:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034] -C) ossec13001iT,Exim Auth failed2025-11-17 13:58:19 dovecot_login authenticator failed for (User) [177.74.174.120]:62560: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)177.74.174.1203469034 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p 4 * f \ R H >   bXvl:N0&D|rJ@6h,^"Txnd2ZPF<( ~tj`V.$LB8zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& iX6 iX  iX iX iX iX iW iW iW iW iW iW iW~ iW} iW| iW{ iWz iWy iWx iWw iWv iWu iWt iWs iWr iWQq iWIp iWAo iW;n iW7m iWol iWck iW]j iWEi iW3h iW)g iW!f iVe iW1d iW c iW b iWa iV` iV_ iW3^ iW)] iV\ iV[ iVZ iVY iVX iVW iVV iVU iVT iVS iVR iVQ iVP iVO iVKN iVEM iVL iVuK iVkJ iVkI iVUH iV?G iV5F iV1E iV'D iV%C iVB iVA iV@ iV ? iV/> iV= iV< iU; iU: iU9 iV8 iU7 iU6 iU5 iU4 iU3 iU2 iU1 iU0 iU/ iU. iU- iU, iU+ iUi* iUe) iU_( iU]' iUo& iU_% iU/$ iU# iUE" iUA! iU1 iU iU% iU iUG iU) iU) iU! iUE iT iU iU iT iT iU iT iT iT iT iT iT iT iT iT iT iT iT iTt iTf iTZ iT: iT: iT, iT  iT iT iT iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iS iSt iSl iY iY iY iY iY iY iY iY iY iYr iYr iYb iYb iY2 iY, iY( iY& iY$ iY iY iY iY iY iY iY iX iX iX iX iX iX iX iX iX iX iX iX iX iX iX iXr iXl iXD iSd iSJ iSF iSB iS iS iS  iS  iR iR iR iR iR iR iR iR iR iR iR iRi iRY iRY iRU iR; iR( iR iR iR iR iR  iR iR iR iQ iQ iQ iQ iQ iQ iQ iQ iQ iY iQ iQj iQ^ iQL iQ: iQ. iQ* iQ iQ iQ iQ iQ  iQ  iQ iQ iQ iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP iP~ iPz iPx iPr iPr iPn 7 o ~ z!" /7t  -s) ossec13001iU%Exim Auth failed2025-11-17 14:02:28 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:26098: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)111.61.175.1181814991V  -9' ossec13001iUExim Auth failed2025-11-17 14:02:19 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:36640: 535 Incorrect authentication data (set_id=sociais)211.223.41.901835841  W' ossec9708iUGDovecot Aborted Login with empty userNov 17 14:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001iU)Exim Auth failed2025-11-17 14:02:31 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:56226: 535 Incorrect authentication data (set_id=gerson)121.189.198.601835841  k' ossec9709iU)Multiple Dovecot Aborted Logins with empty userNov 17 14:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i  -_' ossec13001iU!Exim Auth failed2025-11-17 14:02:23 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:32924: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)125.20.224.1012697509 E ossec2501iUEUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127V  -7) ossec13001iTExim Auth failed2025-11-17 14:01:32 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:57712: 535 Incorrect authentication data (set_id=edna)190.223.36.1083932488`  -M' ossec13001iUExim Auth failed2025-11-17 14:02:16 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:57975: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.721819730m  -c+ ossec13001iUExim Auth failed2025-11-17 14:02:09 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:44668: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)125.139.124.1201835841 W' ossec9708iTDovecot Aborted Login with empty userNov 17 14:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f  -W) ossec13001iTExim Auth failed2025-11-17 14:01:21 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:57924: 535 Incorrect authentication data (set_id=comercial.user.admin)190.114.243.873625428m  S=+ ossec11000iULogin failed on the cpanel service.[2025-11-17 14:01:51 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect124.198.131.10762520017  eE' ossec9710iTDovecot Auth failed on disconnected session.Nov 17 14:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822*  e+' ossec9710iTDovecot Auth failed on disconnected session.Nov 17 14:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084$  e) ossec9710iTDovecot Auth failed on disconnected session.Nov 17 14:00:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841 H <joU",RbH. W' ossec9708iUDovecot Aborted Login with empty userNov 17 14:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5UFLV81DpIqxV3kv>177.87.121.473469034l-  -a+ ossec13001iUExim Auth failed2025-11-17 14:04:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51049: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.2311605651V,  -9' ossec13001iUExim Auth failed2025-11-17 14:05:13 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:47186: 535 Incorrect authentication data (set_id=rodrigo)39.125.67.1091835841r+  -m+ ossec13001iUExim Auth failed2025-11-17 14:05:05 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:42385: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)203.172.213.1661605651/*  U?+ ossec11001iUiDeferred login on the cpanel service[2025-11-17 14:03:36 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "GET /cpsess8984365187/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect200.140.240.1843469034) W' ossec9708iUeDovecot Aborted Login with empty userNov 17 14:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w( SO+ ossec11000iU_Login failed on the cpanel service.[2025-11-17 14:03:26 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect200.140.240.1843469034'  3?# ossec11301iU]New FTP connection.Nov 17 14:03:24 hosting pure-ftpd: (?@3.130.96.91) [INFO] New connection from 3.130.96.913.130.96.9162520010&  e5) ossec9710iUoDovecot Auth failed on disconnected session.Nov 17 14:03:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.19322333879% E ossec2501iU_User authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127b$  -S% ossec13001iU/Exim Auth failed2025-11-17 14:02:37 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:32850: 535 Incorrect authentication data (set_id=flavio.oliveira)202.84.34.851210997j#  -a' ossec13001iUExim Auth failed2025-11-17 14:02:22 dovecot_login authenticator failed for ([183.98.68.199]) [183.98.68.199]:42343: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)183.98.68.1991835841w" SO+ ossec11000iUELogin failed on the cpanel service.[2025-11-17 14:02:59 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect200.140.240.18434690340! U?+ ossec11001iUADeferred login on the cpanel service[2025-11-17 14:02:55 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "GET /cpsess8984365187/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect200.140.240.1843469034o  -i) ossec13001iU1Exim Auth failed2025-11-17 14:02:39 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:61268: 535 Incorrect authentication data (set_id=jotadeschamps)223.197.226.511819730  -#) ossec13001iUExim Auth failed2025-11-17 14:02:22 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:53458: 535 Incorrect authentication data (set_id=contato@fottolegal.com.br)200.219.123.973469034    'y=  -# ossec13001iVExim Auth failed2025-11-17 14:06:36 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:59072: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)113.28.86.11819730<  -' ossec13001iVExim Auth failed2025-11-17 14:06:31 dovecot_login authenticator failed for (177-174-15-69.user.vivozap.com.br) [177.174.15.69]:43474: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)177.174.15.693469034^; ;;% ossec13008iUMail Recipient rejected2025-11-17 14:05:41 H=(195.3.134.135) [179.0.178.53]:53331 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:53331 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034:  --) ossec13001iUExim Auth failed2025-11-17 14:05:34 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:41248: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)50.127.177.1946252001k9  -_+ ossec13001iUExim Auth failed2025-11-17 14:05:31 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:52627: 535 Incorrect authentication data (set_id=contato)201.173.216.1333996063p8  -k) ossec13001iVExim Auth failed2025-11-17 14:06:08 dovecot_login authenticator failed for ([183.99.158.244]) [183.99.158.244]:52046: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)183.99.158.2441835841e7  -[# ossec13001iUExim Auth failed2025-11-17 14:06:06 dovecot_login authenticator failed for ([111.61.97.5]) [111.61.97.5]:58892: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)111.61.97.518149916  W' ossec9708iUDovecot Aborted Login with empty userNov 17 14:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c5  -Q+ ossec13001iUExim Auth failed2025-11-17 14:05:46 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:59424: 535 Incorrect authentication data (set_id=adriana)151.237.115.206732800w4  -y) ossec13001iUExim Auth failed2025-11-17 14:05:55 dovecot_login authenticator failed for ([95.191.196.220]) [95.191.196.220]:48801: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)95.191.196.22020173703  k' ossec9709iUMultiple Dovecot Aborted Logins with empty userNov 17 14:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V2  -9' ossec13001iUExim Auth failed2025-11-17 14:05:23 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:57567: 535 Incorrect authentication data (set_id=rodrigo)83.136.176.122510769Z1  -=+ ossec13001iUExim Auth failed2025-11-17 14:06:04 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:48834: 535 Incorrect authentication data (set_id=adriana)128.185.254.1621269750.0  e1) ossec9710iUDovecot Auth failed on disconnected session.Nov 17 14:04:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841/  -' ossec13001iUExim Auth failed2025-11-17 14:04:50 dovecot_login authenticator failed for broadband-95-84-131-125.ip.moscow.rt.ru [95.84.131.125]:58670: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)95.84.131.1252017370 =WtgZM@3& }pcVI</"uh[NA4' ~qdJzm`SF9, = ~qdWJ  f Y L 2 %  |ob.!xk^QDUH;   { a G : -  w j ] P_RE8+ C  T n v i \ O B 5 (=   r e X K > 1 yl7* ? s 6 ) $    0#0 1814991 1814991 1814991 1814991 1814991 1814991 1814991 q 1814991 n 1814991 l 1814991 e 1814991 ^ 1814991 \ 1814991 Z 1814991 Q 1814991 P 1814991 N 1814991 H 1814991 : 1814991 6 1814991 3 1814991 2 1814991 ) 1814991 ( 1814991 % 1814991 " 1814991 1814991 1814991  1814991  1814991  1814991  1814991 1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991[ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 m 1814991 b 1814991 a 1814991 R 1814991 H 1814991 - 1814991 , 1814991 # 1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 y 1814991 v 1814991 1814991 1814991 a 1814991 _ 1814991 X 1814991 V 1814991 6 1814991 5 1814991 2 1814991 ! 1814991  1814991  1814991 1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 ? 1814991 1814991 1814991 t 1814991 r 1814991 q 1814991 p 1814991 h 1814991 g 1814991 a 1814991 ` s 1814991 ] 1814991 R 1814991 O ) 1814991 D 1814991 B 1814991 ; 1814991 : 1814991 6 1814991 4 1814991 / 1814991 . 1814991 - 1814991 " 1814991  1814991 1814991  1814991! 1814991 1814991 1814991 1814991 1814991& 1814991 18149916 1814991 1814991 1814991 18149917 1814991 1814991} 1814991z 1814991D 1814991v 1814991t 1814991r 1814991p 1814991e 1814991s 1814991K 1814991} 1814991B 1814991 18149917 18149913 1814991% 1814991 1814991 1814991 1814991 1814991u 1814991e 1814991c  1814991` 1814991^ 1814991\ 1814991Q 1814991L 1814991D 1814991$ 1814991 1814991 u 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 I 1814991 > 1814991 < 1814991 ; 1814991 8 1814991 7 1814991 % 1814991  1814991  1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991  1814991 1814991 # 1814991 1814991 1814991 { 1814991 y 1814991 x 1814991 s 1814991 i 1814991 V 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 "K [ ~ d {XM  -;) ossec13001iVEExim Auth failed2025-11-17 14:07:15 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:52776: 535 Incorrect authentication data (set_id=rafael)121.171.95.1121835841hL  -[) ossec13001iVExim Auth failed2025-11-17 14:08:14 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:53503: 535 Incorrect authentication data (set_id=contato)187.161.136.183996063bK  -S% ossec13001iVuExim Auth failed2025-11-17 14:08:05 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:36828: 535 Incorrect authentication data (set_id=lu)137.27.32.706252001hJ  -]' ossec13001iVkExim Auth failed2025-11-17 14:07:55 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:38363: 535 Incorrect authentication data (set_id=lu@interlubfiltros.com.br)83.239.84.1302017370iI  -a% ossec13001iVkExim Auth failed2025-11-17 14:07:54 dovecot_login authenticator failed for (noname.vdonsk.ru) [193.111.3.59]:43368: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)193.111.3.592017370H W' ossec9708iVUDovecot Aborted Login with empty userNov 17 14:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'G  e%' ossec9710iV?Dovecot Auth failed on disconnected session.Nov 17 14:07:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822F  -+ ossec13001iV5Exim Auth failed2025-11-17 14:07:01 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:41284: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)122.187.221.1301269750YE  -?' ossec13001iV1Exim Auth failed2025-11-17 14:06:57 dovecot_login authenticator failed for (bethelpainting.com) [112.122.54.54]:19820: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991VD  -9' ossec13001iV'Exim Auth failed2025-11-17 14:06:47 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:37172: 535 Incorrect authentication data (set_id=contato)110.77.148.871605651`C  -K) ossec13001iV%Exim Auth failed2025-11-17 14:06:45 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:54026: 535 Incorrect authentication data (set_id=isabellylisboa)103.147.248.441269750B W' ossec9708iVDovecot Aborted Login with empty userNov 17 14:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YA  -?' ossec13001iVExim Auth failed2025-11-17 14:06:24 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:59854: 535 Incorrect authentication data (set_id=financeiro)182.95.54.1941269750l@  -c) ossec13001iVExim Auth failed2025-11-17 14:06:23 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:45481: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)186.97.203.1653686110S?  -5% ossec13001iV Exim Auth failed2025-11-17 14:06:18 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:36088: 535 Incorrect authentication data (set_id=rodrigo)111.61.177.21814991Z>  -?) ossec13001iV/Exim Auth failed2025-11-17 14:06:55 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.186.93]:38108: 535 Incorrect authentication data (set_id=financeiro)113.160.186.931562822 e # '  |e\  -1) ossec13001iVExim Auth failed2025-11-17 14:10:10 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54403: 535 Incorrect authentication data (set_id=contato@innovationbanking.com.br)200.219.123.973469034[  W) ossec9708iVDovecot Aborted Login with empty userNov 17 14:09:28 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.162, lip=200.150.196.245, TLS, session=87.236.176.1622635167~Z  - % ossec13001iVExim Auth failed2025-11-17 14:09:56 dovecot_login authenticator failed for 116-59-11-85.emome-ip.hinet.net [116.59.11.85]:52101: 535 Incorrect authentication data (set_id=noreplay.vendas3@singseguros.com.br)116.59.11.851668284)Y  e') ossec9710iVDovecot Auth failed on disconnected session.Nov 17 14:09:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<35RHas1DFtBA44h6>64.227.136.1221269750fX  -W) ossec13001iVExim Auth failed2025-11-17 14:09:37 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:36629: 535 Incorrect authentication data (set_id=atualizacoes)222.252.21.2401562822W W' ossec9708iVDovecot Aborted Login with empty userNov 17 14:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+V  e-' ossec9710iVDovecot Auth failed on disconnected session.Nov 17 14:09:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9ieraM1DSMNn9M4G>103.244.206.61643084hU  -[) ossec13001iVExim Auth failed2025-11-17 14:09:22 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:59632: 535 Incorrect authentication data (set_id=alex.vendas)179.185.29.2333469034T  - ' ossec13001iVExim Auth failed2025-11-17 14:09:02 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:38252: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)87.103.126.542264397yS  -% ossec13001iVExim Auth failed2025-11-17 14:09:05 dovecot_login authenticator failed for (5.189.59.238-FTTB.planeta.tc) [5.189.59.238]:57736: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)5.189.59.2382017370R  W' ossec9708iVDovecot Aborted Login with empty userNov 17 14:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Q  k' ossec9709iVMultiple Dovecot Aborted Logins with empty userNov 17 14:08:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034xP  -y+ ossec13001iVExim Auth failed2025-11-17 14:09:15 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39023: 535 Incorrect authentication data (set_id=administrativo1)188.219.104.2103175395fO  -[% ossec13001iVExim Auth failed2025-11-17 14:09:11 dovecot_login authenticator failed for ([95.53.245.92]) [95.53.245.92]:46838: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)95.53.245.922017370oN  -k' ossec13001iVKExim Auth failed2025-11-17 14:07:22 dovecot_login authenticator failed for (bethelpainting.com) [112.122.54.54]:46308: 535 Incorrect authentication data (set_id=postmaster@bethelpainting.com)112.122.54.541814991 0 "# 0Vl  -9' ossec13001iWoExim Auth failed2025-11-17 14:12:15 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:48951: 535 Incorrect authentication data (set_id=eliezer)114.30.180.581835841k  W' ossec9708iWcDovecot Aborted Login with empty userNov 17 14:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Xj  -;) ossec13001iW]Exim Auth failed2025-11-17 14:11:56 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:57722: 535 Incorrect authentication data (set_id=eliezer)128.185.214.781269750i  k' ossec9709iWEMultiple Dovecot Aborted Logins with empty userNov 17 14:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`h  -K) ossec13001iW3Exim Auth failed2025-11-17 14:11:15 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:39907: 535 Incorrect authentication data (set_id=isabellylisboa)220.67.122.2301835841Yg  -?' ossec13001iW)Exim Auth failed2025-11-17 14:11:05 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:59260: 535 Incorrect authentication data (set_id=financeiro)120.157.13.612077456{f  -+ ossec13001iW!Exim Auth failed2025-11-17 14:10:57 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:1825: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)154.118.162.1942453866e  -1) ossec13001iVExim Auth failed2025-11-17 14:10:16 dovecot_login authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54403: 535 Incorrect authentication data (set_id=contato@innovationbanking.com.br)200.219.123.973469034bd  -U# ossec13001iW1Exim Auth failed2025-11-17 14:11:13 dovecot_login authenticator failed for ([177.215.153.215]) [189.56.0.19]:59157: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)189.56.0.193469034gc  -Y) ossec13001iW Exim Auth failed2025-11-17 14:10:34 dovecot_login authenticator failed for ([118.69.133.140]) [118.69.133.140]:61488: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)118.69.133.1401562822b W' ossec9708iW Dovecot Aborted Login with empty userNov 17 14:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|a  -' ossec13001iWExim Auth failed2025-11-17 14:10:48 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:38632: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)211.20.26.2011668284`  - ) ossec13001iVExim Auth failed2025-11-17 14:10:18 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:49985: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)185.40.122.2502629691b_  -O) ossec13001iVExim Auth failed2025-11-17 14:10:18 dovecot_login authenticator failed for ([222.191.243.91]) [222.191.243.91]:59715: 535 Incorrect authentication data (set_id=noreplay.vendas3)222.191.243.9118149913^  e?% ossec9710iW3Dovecot Auth failed on disconnected session.Nov 17 14:11:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382v]  -u+ ossec13001iW)Exim Auth failed2025-11-17 14:11:05 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:55722: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)121.202.195.1941819730 ' ? b Ugq|wZ|  -A' ossec13001iWExim Auth failed2025-11-17 14:13:47 dovecot_login authenticator failed for ([36.135.107.56]) [36.135.107.57]:40508: 535 Incorrect authentication data (set_id=alex.vendas)36.135.107.571814991[{  -A) ossec13001iWExim Auth failed2025-11-17 14:13:45 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:41486: 535 Incorrect authentication data (set_id=fabio.vendas)201.15.149.2543469034cz -S% ossec13001iWExim Auth failed2025-11-17 14:13:39 dovecot_plain authenticator failed for ([2.58.200.173]) [2.58.200.173]:57372: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)2.58.200.1736252001y W' ossec9708iWDovecot Aborted Login with empty userNov 17 14:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gx  -]' ossec13001iWExim Auth failed2025-11-17 14:13:02 dovecot_login authenticator failed for 188-197-29-85.dyn.estpak.ee [85.29.197.188]:49316: 535 Incorrect authentication data (set_id=administrativo1)85.29.197.188453733 w  -) ossec13001iWExim Auth failed2025-11-17 14:12:50 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:34032: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)76.136.164.1576252001dv  -W% ossec13001iWExim Auth failed2025-11-17 14:12:43 dovecot_login authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:37796: 535 Incorrect authentication data (set_id=eliezer)217.209.44.92661886ru  -o) ossec13001iWExim Auth failed2025-11-17 14:12:30 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:50619: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)103.174.145.351269750jt  -g% ossec13001iWExim Auth failed2025-11-17 14:13:13 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:59758: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)65.20.130.9599237+s  e+) ossec9710iWDovecot Auth failed on disconnected session.Nov 17 14:13:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841Zr  -A' ossec13001iWExim Auth failed2025-11-17 14:12:58 dovecot_login authenticator failed for ([218.25.233.2]) [218.25.233.22]:55752: 535 Incorrect authentication data (set_id=fabio.vendas)218.25.233.221814991Yq  -?' ossec13001iWQExim Auth failed2025-11-17 14:11:44 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:53886: 535 Incorrect authentication data (set_id=marialuiza)182.95.52.2061269750Hp  -) ossec13001iWIExim Auth failed2025-11-17 14:11:37 dovecot_login authenticator failed for ([75.109.212.222]) [75.109.212.222]:56497: 535 Incorrect authentication data75.109.212.2226252001ho  -[) ossec13001iWAExim Auth failed2025-11-17 14:11:29 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:36806: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)216.194.174.276252001,n  e-) ossec9710iW;Dovecot Auth failed on disconnected session.Nov 17 14:11:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044Um  -;# ossec13001iW7Exim Auth failed2025-11-17 14:11:19 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:32983: 535 Incorrect authentication data189.56.0.193469034 ) HeL],)e  -U+ ossec13001iXDExim Auth failed2025-11-17 14:15:47 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:54230: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795 W' ossec9708iX6Dovecot Aborted Login with empty userNov 17 14:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8TGqfs1DmoaxV3kv>177.87.121.473469034-  e-+ ossec9710iX Dovecot Auth failed on disconnected session.Nov 17 14:15:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822k  -a) ossec13001iXExim Auth failed2025-11-17 14:15:05 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:45004: 535 Incorrect authentication data (set_id=info.user.admin)197.219.210.861036973  W' ossec9708iXDovecot Aborted Login with empty userNov 17 14:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -O# ossec13001iXExim Auth failed2025-11-17 14:14:53 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:33852: 535 Incorrect authentication data (set_id=andre.nascimento.admin)8.209.221.718610607  eE' ossec9710iXDovecot Auth failed on disconnected session.Nov 17 14:14:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084y  -}) ossec13001iWExim Auth failed2025-11-17 14:14:37 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:60978: 535 Incorrect authentication data (set_id=info.user.admin@lixadoracuritiba.com.br)210.219.232.341835841  k' ossec9709iWMultiple Dovecot Aborted Logins with empty userNov 17 14:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z  -' ossec13001iWExim Auth failed2025-11-17 14:14:08 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:34262: 535 Incorrect authentication data (set_id=andre.nascimento.admin@calcautomacao.com.br)5.140.212.14420173704  e?' ossec9710iWDovecot Auth failed on disconnected session.Nov 17 14:14:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991y  -}) ossec13001iWExim Auth failed2025-11-17 14:13:34 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:32873: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)46.212.127.1283144096 W' ossec9708iWDovecot Aborted Login with empty userNov 17 14:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2px9d81Dpq6xV3kv>177.87.121.473469034Y~  -?' ossec13001iWExim Auth failed2025-11-17 14:13:30 dovecot_login authenticator failed for ([222.71.159.58]) [222.68.153.96]:53446: 535 Incorrect authentication data (set_id=financeiro)222.68.153.961814991/}  e1+ ossec9710iWDovecot Auth failed on disconnected session.Nov 17 14:13:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841 | |+  e)+ ossec9710iYDovecot Auth failed on disconnected session.Nov 17 14:19:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<7LWEi81DxrF9gnHM>125.130.113.2041835841  k' ossec9709iXMultiple Dovecot Aborted Logins with empty userNov 17 14:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -S# ossec13001iXExim Auth failed2025-11-17 14:17:21 dovecot_login authenticator failed for (pool-5-79-144-75.is74.ru) [5.79.144.75]:58192: 535 Incorrect authentication data (set_id=vendas.dilson)5.79.144.752017370h  -[) ossec13001iXExim Auth failed2025-11-17 14:17:43 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:49767: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)103.168.241.321269750  e' ossec9710iXDovecot Auth failed on disconnected session.Nov 17 14:17:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=124.67.121.58, lip=200.150.196.245, TLS, session=<9fmGhM1Dwux8Q3k6>124.67.121.581814991g  -a% ossec13001iXExim Auth failed2025-11-17 14:17:22 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:60953: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)65.20.187.4799237t  -u' ossec13001iXExim Auth failed2025-11-17 14:18:11 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:60826: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)200.33.171.653996063  W' ossec9708iXDovecot Aborted Login with empty userNov 17 14:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -I) ossec13001iXExim Auth failed2025-11-17 14:18:01 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:46156: 535 Incorrect authentication data (set_id=leandro.cesar)220.77.245.22718358411  e5+ ossec9710iXDovecot Auth failed on disconnected session.Nov 17 14:18:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822t  -s) ossec13001iXExim Auth failed2025-11-17 14:17:45 dovecot_login authenticator failed for ([116.114.84.246]) [116.114.84.246]:41352: 535 Incorrect authentication data (set_id=leandro.cesar@maringasoldas.com.br)116.114.84.2461814991h  -[) ossec13001iXExim Auth failed2025-11-17 14:17:35 dovecot_login authenticator failed for h95-155-222-149.cust.bredband2.com [95.155.222.149]:41839: 535 Incorrect authentication data (set_id=xavier)95.155.222.1492661886l  -k% ossec13001iXExim Auth failed2025-11-17 14:17:02 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:46441: 535 Incorrect authentication data (set_id=vendas.dilson@maringasoldas.com.br)65.20.191.9799237 W' ossec9708iXrDovecot Aborted Login with empty userNov 17 14:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690348  eC+ ossec9710iXlDovecot Auth failed on disconnected session.Nov 17 14:16:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001 #  5 * U' )  k' ossec9709iYbMultiple Dovecot Aborted Logins with empty userNov 17 14:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_(  -K' ossec13001iY(Exim Auth failed2025-11-17 14:19:35 dovecot_login authenticator failed for ([59.46.193.187]) [59.46.193.187]:39747: 535 Incorrect authentication data (set_id=marcelo.pinheiro)59.46.193.1871814991' W' ossec9708iY&Dovecot Aborted Login with empty userNov 17 14:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&&  e!) ossec9710iY$Dovecot Auth failed on disconnected session.Nov 17 14:19:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<8ka1jM1DqpKl0iHB>165.210.33.1932233387m%  -g' ossec13001iYExim Auth failed2025-11-17 14:19:18 dovecot_login authenticator failed for ([78.25.127.206]) [78.25.127.206]:48722: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)78.25.127.2062017370s$  -o+ ossec13001iY2Exim Auth failed2025-11-17 14:19:45 dovecot_login authenticator failed for ([193.228.164.236]) [193.228.164.236]:52156: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)193.228.164.2362017370##  e!# ossec9710iY,Dovecot Auth failed on disconnected session.Nov 17 14:19:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001*"  e)) ossec9710iYDovecot Auth failed on disconnected session.Nov 17 14:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750Q!  -1% ossec13001iYExim Auth failed2025-11-17 14:19:19 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:60782: 535 Incorrect authentication data (set_id=edna)115.77.111.21562822  -' ossec13001iYExim Auth failed2025-11-17 14:19:00 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:38079: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)81.62.212.1422658434d  -Q+ ossec13001iYExim Auth failed2025-11-17 14:18:57 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59511: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651h  -[+ ossec13001iXExim Auth failed2025-11-17 14:18:35 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.132.212]:47292: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)154.177.132.212357994 W' ossec9708iXDovecot Aborted Login with empty userNov 17 14:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -G' ossec13001iXExim Auth failed2025-11-17 14:18:23 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:49894: 535 Incorrect authentication data (set_id=contato)51.68.226.1713017382x  -y+ ossec13001iYExim Auth failed2025-11-17 14:19:16 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:44669: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)103.165.174.2341269750 8; _ F 'R89 W' ossec9708iYDovecot Aborted Login with empty userNov 17 14:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Q8 -1% ossec13001iYExim Auth failed2025-11-17 14:22:22 dovecot_login authenticator failed for (4ARngn) [141.98.11.48]:54258: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427m7  -k# ossec13001iYExim Auth failed2025-11-17 14:22:17 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:52815: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)103.50.5.941269750g6  -Y) ossec13001iYExim Auth failed2025-11-17 14:23:00 dovecot_login authenticator failed for ([188.231.51.202]) [188.231.51.202]:60341: 535 Incorrect authentication data (set_id=pharmacyusa-bestdeals)188.231.51.2023017382b5  -W% ossec13001iYExim Auth failed2025-11-17 14:22:28 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:50732: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)65.20.175.7599237\4  -A+ ossec13001iYExim Auth failed2025-11-17 14:22:28 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:55134: 535 Incorrect authentication data (set_id=contato)197.219.228.2501036973n3  -i' ossec13001iYExim Auth failed2025-11-17 14:22:25 dovecot_login authenticator failed for ([78.111.147.32]) [78.111.147.32]:60554: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)78.111.147.3220173702 W' ossec9708iYDovecot Aborted Login with empty userNov 17 14:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U1 -9% ossec13001iYExim Auth failed2025-11-17 14:21:21 dovecot_login authenticator failed for (fz2NrvVbZr) [141.98.11.48]:53202: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427-0  e1' ossec9710iYDovecot Auth failed on disconnected session.Nov 17 14:22:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.103.168.32, lip=200.150.196.245, session=14.103.168.321814991)/  e-# ossec9710iYDovecot Auth failed on disconnected session.Nov 17 14:21:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.9962520016.  eA) ossec9710iYDovecot Auth failed on disconnected session.Nov 17 14:22:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<9IuAls1DnIFnOJRs>103.56.148.1081643084-  W' ossec9708iYDovecot Aborted Login with empty userNov 17 14:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X,  -;) ossec13001iYrExim Auth failed2025-11-17 14:20:50 dovecot_login authenticator failed for ([111.26.167.240]) [111.26.167.240]:41346: 535 Incorrect authentication data (set_id=envios)111.26.167.2401814991T+ -7% ossec13001iYrExim Auth failed2025-11-17 14:20:50 dovecot_login authenticator failed for (liIKnuLet) [141.98.11.48]:58577: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427i*  -]) ossec13001iYbExim Auth failed2025-11-17 14:20:34 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:41718: 535 Incorrect authentication data (set_id=envios@comercial.art.br)111.26.177.2161814991  / 7  1\BmrI 7% ossec13006iZActive Response. SMTP brute force attack (SMTP ports are protected)2025-11-17 14:25:44 dovecot_login authenticator failed for (WnEd9Tqrg) [141.98.11.48]:56646: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427RH -3% ossec13001iZExim Auth failed2025-11-17 14:25:35 dovecot_login authenticator failed for (gLXuVC6) [141.98.11.48]:56590: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427wG  -w+ ossec13001iZdExim Auth failed2025-11-17 14:24:51 dovecot_login authenticator failed for ([103.174.193.42]) [103.214.202.161]:47940: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)103.214.202.1611210997QF -1% ossec13001iZRExim Auth failed2025-11-17 14:24:34 dovecot_login authenticator failed for (4r9Y71) [141.98.11.48]:61617: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427E W' ossec9708iZPDovecot Aborted Login with empty userNov 17 14:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034QD -1% ossec13001iZ(Exim Auth failed2025-11-17 14:23:51 dovecot_login authenticator failed for (DNdJSS) [141.98.11.48]:61824: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427#C  3K) ossec11301iZ&New FTP connection.Nov 17 14:23:48 hosting pure-ftpd: (?@147.185.132.84) [INFO] New connection from 147.185.132.84147.185.132.846252001]B -C) ossec13001iZExim Auth failed2025-11-17 14:23:40 dovecot_login authenticator failed for (User) [177.74.174.120]:61589: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)177.74.174.1203469034A  W' ossec9708iZ2Dovecot Aborted Login with empty userNov 17 14:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034@  -) ossec13001iZ*Exim Auth failed2025-11-17 14:23:54 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:53030: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)187.50.194.18234690347?  eA+ ossec9710iZ&Dovecot Auth failed on disconnected session.Nov 17 14:23:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822>  k' ossec9709iZMultiple Dovecot Aborted Logins with empty userNov 17 14:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t=  -s) ossec13001iZ:Exim Auth failed2025-11-17 14:24:09 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:59680: 535 Incorrect authentication data (set_id=marcelo.pinheiro)35.130.111.1466252001X<  -=' ossec13001iZ:Exim Auth failed2025-11-17 14:24:09 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:46048: 535 Incorrect authentication data (set_id=novamanha)193.46.192.202510769u;  -u) ossec13001iZ*Exim Auth failed2025-11-17 14:23:54 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:52169: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)46.212.127.1283144096x:  -}' ossec13001iYExim Auth failed2025-11-17 14:22:41 dovecot_login authenticator failed for ([218.56.121.58]) [221.2.140.230]:38934: 535 Incorrect authentication data (set_id=pharmacyusa-bestdeals@inovasiteweb.com.br)221.2.140.2301814991  4  {XX -=% ossec13001i[Exim Auth failed2025-11-17 14:27:46 dovecot_login authenticator failed for (calcautomation.com) [60.2.243.174]:36834: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991$W  e' ossec9710i[Dovecot Auth failed on disconnected session.Nov 17 14:27:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991V W' ossec9708i[Dovecot Aborted Login with empty userNov 17 14:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034TU -7% ossec13001iZExim Auth failed2025-11-17 14:27:19 dovecot_login authenticator failed for (yeSXtGDy3) [141.98.11.48]:54011: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427-T  e/) ossec9710iZDovecot Auth failed on disconnected session.Nov 17 14:26:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387S  k' ossec9709iZMultiple Dovecot Aborted Logins with empty userNov 17 14:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4ZsDps1D3suxV3kv>177.87.121.473469034*R  e+' ossec9710iZDovecot Auth failed on disconnected session.Nov 17 14:26:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<+YnMpc1Dhqc7GIXF>59.24.133.1971835841RQ -3% ossec13001iZExim Auth failed2025-11-17 14:26:28 dovecot_login authenticator failed for (Ujg6a5E) [141.98.11.48]:50071: 535 Incorrect authentication data (set_id=contabilidade)141.98.11.48597427P  W' ossec9708iZDovecot Aborted Login with empty userNov 17 14:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^O  -G+ ossec13001iZExim Auth failed2025-11-17 14:26:56 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:31291: 535 Incorrect authentication data (set_id=assessoria)197.255.227.180921929.N  e3' ossec9710iZDovecot Auth failed on disconnected session.Nov 17 14:25:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991M W' ossec9708iZDovecot Aborted Login with empty userNov 17 14:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[L  -E% ossec13001iZ~Exim Auth failed2025-11-17 14:25:18 dovecot_login authenticator failed for ([36.135.62.96]) [36.135.62.97]:45788: 535 Incorrect authentication data (set_id=paulinho.vendas)36.135.62.971814991pK  -m' ossec13001iZExim Auth failed2025-11-17 14:26:10 dovecot_login authenticator failed for ([116.233.83.90]) [116.233.83.90]:35582: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)116.233.83.901814991uJ  -u+ ossec13001iZExim Auth failed2025-11-17 14:25:55 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:28837: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)197.255.227.180921929 h4 $ 6   $DHh\h  -C) ossec13001i[Exim Auth failed2025-11-17 14:30:36 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:45332: 535 Incorrect authentication data (set_id=financeiro)121.73.169.2032186224xg  -{) ossec13001i[Exim Auth failed2025-11-17 14:31:09 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:58268: 535 Incorrect authentication data (set_id=isabellylisboa)61.245.141.2252077456\f  -C) ossec13001i[Exim Auth failed2025-11-17 14:30:52 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:45068: 535 Incorrect authentication data (set_id=financeiro)175.206.113.911835841te  -q+ ossec13001i[Exim Auth failed2025-11-17 14:30:51 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:51825: 535 Incorrect authentication data (set_id=atualizacoes)201.234.106.2153865483{d  -' ossec13001i[Exim Auth failed2025-11-17 14:29:53 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:39317: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)181.129.31.423686110qc  -s# ossec13001i[Exim Auth failed2025-11-17 14:29:42 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:43816: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)61.12.86.901269750ub  -u) ossec13001i[Exim Auth failed2025-11-17 14:29:33 dovecot_login authenticator failed for ([111.26.167.166]) [111.26.167.166]:36138: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)111.26.167.1661814991qa  -o' ossec13001i[Exim Auth failed2025-11-17 14:29:59 dovecot_login authenticator failed for (49-158-167-58.dynamic.elinx.com.tw) [49.158.167.58]:48544: 535 Incorrect authentication data (set_id=paulinho.vendas)49.158.167.581668284`  W' ossec9708i[Dovecot Aborted Login with empty userNov 17 14:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^_  -I' ossec13001i[Exim Auth failed2025-11-17 14:30:02 dovecot_login authenticator failed for ([183.237.166.2]) [183.237.166.2]:47370: 535 Incorrect authentication data (set_id=administrativo1)183.237.166.21814991^  k' ossec9709i[}Multiple Dovecot Aborted Logins with empty userNov 17 14:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034] W' ossec9708iDovecot Aborted Login with empty userNov 17 14:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2dMfrc1D4qCxV3kv>177.87.121.473469034j\  -a' ossec13001iExim Auth failed2025-11-17 14:29:11 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:33962: 535 Incorrect authentication data (set_id=adriana)24.207.66.1546251999 [  -#) ossec13001iExim Auth failed2025-11-17 14:28:54 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:56304: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)122.185.187.301269750XZ  -E! ossec13001i[1Exim Auth failed2025-11-17 14:28:16 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:37467: 535 Incorrect authentication data (set_id=contato)89.67.37.2798544lY  -e' ossec13001i[%Exim Auth failed2025-11-17 14:28:03 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:53630: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)75.108.42.2416252001  w  k' ossec9709i\1Multiple Dovecot Aborted Logins with empty userNov 17 14:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  W' ossec9708i\ODovecot Aborted Login with empty userNov 17 14:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lu  -e' ossec13001i\?Exim Auth failed2025-11-17 14:32:45 dovecot_login authenticator failed for 40.ip-217-182-65.eu [217.182.65.40]:59202: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)217.182.65.403017382lt  -c) ossec13001i[Exim Auth failed2025-11-17 14:31:37 dovecot_login authenticator failed for ([103.251.31.154]) [103.251.31.154]:47260: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)103.251.31.1541269750s W' ossec9708i[Dovecot Aborted Login with empty userNov 17 14:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qr  -m) ossec13001i\Exim Auth failed2025-11-17 14:32:09 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:60152: 535 Incorrect authentication data (set_id=jose.comercial)81.233.235.2032661886Xq  -;) ossec13001i\Exim Auth failed2025-11-17 14:32:04 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:41400: 535 Incorrect authentication data (set_id=rafael)182.151.45.1361814991)p U5' ossec11001i\Deferred login on the cpanel service[2025-11-17 14:31:59 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "GET /cpsess6743383222/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034*o  e'+ ossec9710i[Dovecot Auth failed on disconnected session.Nov 17 14:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991un  -s+ ossec13001i[Exim Auth failed2025-11-17 14:30:51 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:43039: 535 Incorrect authentication data (set_id=jose.comercial@sulindustrial.com)200.149.213.2423469034um  -s+ ossec13001i[Exim Auth failed2025-11-17 14:30:34 dovecot_login authenticator failed for ([119.198.191.180]) [119.198.191.180]:39998: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)119.198.191.1801835841l W' ossec9708i[Dovecot Aborted Login with empty userNov 17 14:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 k  -%' ossec13001i[Exim Auth failed2025-11-17 14:30:21 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:53284: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)201.61.40.1173469034yj  -}) ossec13001i[Exim Auth failed2025-11-17 14:30:54 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:50684: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)115.241.228.341269750xi  -{) ossec13001i[Exim Auth failed2025-11-17 14:30:34 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:60046: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)203.128.10.1381168579 & /  e1+ ossec9710i]Dovecot Auth failed on disconnected session.Nov 17 14:36:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001  W' ossec9708i]Dovecot Aborted Login with empty userNov 17 14:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  -g' ossec13001i\Exim Auth failed2025-11-17 14:35:50 dovecot_login authenticator failed for ([176.111.64.38]) [176.111.64.38]:40070: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)176.111.64.382017370k  -_+ ossec13001i\Exim Auth failed2025-11-17 14:35:13 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:58133: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651u  -u) ossec13001i\Exim Auth failed2025-11-17 14:35:06 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:40555: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)177.135.67.1893469034 W' ossec9708i\Dovecot Aborted Login with empty userNov 17 14:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034B  -% ossec13001i\Exim Auth failed2025-11-17 14:34:25 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:33934: 535 Incorrect authentication data208.69.161.76252001{  -) ossec13001i\{Exim Auth failed2025-11-17 14:33:45 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:46438: 535 Incorrect authentication data (set_id=compras.ricardo)195.142.25.183298795t~  -w) ossec13001i\mExim Auth failed2025-11-17 14:33:31 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:32970: 535 Incorrect authentication data (set_id=compras.ricardo@maringasoldas.com.br)185.255.47.19099237k}  -a) ossec13001i\Exim Auth failed2025-11-17 14:33:58 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:63896: 535 Incorrect authentication data (set_id=leandro)220.246.42.2221819730.|  e3' ossec9710i\Dovecot Auth failed on disconnected session.Nov 17 14:34:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822j{  -a' ossec13001i\uExim Auth failed2025-11-17 14:33:41 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:56605: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)117.6.226.1221562822z W' ossec9708i\mDovecot Aborted Login with empty userNov 17 14:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5gsKv81D1oOxV3kv>177.87.121.473469034ay  ;?) ossec13008i\OMail Recipient rejected2025-11-17 14:33:01 H=(200.150.196.245) [116.129.250.48]:64996 F= rejected RCPT : "JunkMail rejected - (200.150.196.245) [116.129.250.48]:64996 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/116.129.250.48"116.129.250.481814991Vx  -7) ossec13001i\IExim Auth failed2025-11-17 14:32:56 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:59874: 535 Incorrect authentication data (set_id=contato)201.15.149.2543469034 -bV u R a G gO5T1>U<-_  -O# ossec13001i]Exim Auth failed2025-11-17 14:39:24 dovecot_login authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:52645: 535 Incorrect authentication data (set_id=eliezer)111.70.32.61668284(  e'' ossec9710i]Dovecot Auth failed on disconnected session.Nov 17 14:39:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991  W' ossec9708i]Dovecot Aborted Login with empty userNov 17 14:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -[# ossec13001i]Exim Auth failed2025-11-17 14:38:59 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:60666: 535 Incorrect authentication data (set_id=eliezer)58.8.48.1781605651o  -i) ossec13001i]Exim Auth failed2025-11-17 14:38:42 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:55549: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)178.232.51.1353144096  k' ossec9709i]Multiple Dovecot Aborted Logins with empty userNov 17 14:38:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -G' ossec13001i]kExim Auth failed2025-11-17 14:37:47 dovecot_login authenticator failed for ([121.129.34.91]) [121.129.34.91]:59924: 535 Incorrect authentication data (set_id=isabellylisboa)121.129.34.911835841 W' ossec9708i]]Dovecot Aborted Login with empty userNov 17 14:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -3) ossec13001i][Exim Auth failed2025-11-17 14:37:30 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:56606: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)95.229.202.1973175395\  -C) ossec13001i]'Exim Auth failed2025-11-17 14:36:38 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:60762: 535 Incorrect authentication data (set_id=financeiro)128.185.242.741269750 W' ossec9708i]!Dovecot Aborted Login with empty userNov 17 14:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  -g' ossec13001i]Exim Auth failed2025-11-17 14:36:26 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:49123: 535 Incorrect authentication data (set_id=desenvolvimento2)67.55.189.2116252001  k' ossec9709i\Multiple Dovecot Aborted Logins with empty userNov 17 14:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -E) ossec13001i\Exim Auth failed2025-11-17 14:35:26 dovecot_login authenticator failed for ([219.140.170.34]) [59.173.225.128]:4278: 535 Incorrect authentication data (set_id=atualizacoes)59.173.225.1281814991  -% ossec13001i] Exim Auth failed2025-11-17 14:36:13 dovecot_login authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:56790: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)95.79.57.2212017370  3?# ossec11301i] New FTP connection.Nov 17 14:36:08 hosting pure-ftpd: (?@65.49.1.142) [INFO] New connection from 65.49.1.14265.49.1.1426252001 & ' $ D &%3V,%  W' ossec9708i^kDovecot Aborted Login with empty userNov 17 14:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1npv3c1Dut2xV3kv>177.87.121.473469034h$  -[) ossec13001i^VExim Auth failed2025-11-17 14:41:40 dovecot_login authenticator failed for (ofluminense.static.gvt.net.br) [189.97.236.201]:55648: 535 Incorrect authentication data (set_id=sec.geral)189.97.236.2013469034#  k' ossec9709i^NMultiple Dovecot Aborted Logins with empty userNov 17 14:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343"  e;) ossec9710i^NDovecot Auth failed on disconnected session.Nov 17 14:41:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044&!  e!) ossec9710i^@Dovecot Auth failed on disconnected session.Nov 17 14:41:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841Y  -=) ossec13001i^Exim Auth failed2025-11-17 14:40:20 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:55300: 535 Incorrect authentication data (set_id=eliezer)200.106.49.1493932488n  -g) ossec13001i^3Exim Auth failed2025-11-17 14:41:07 dovecot_login authenticator failed for ([111.23.182.187]) [111.23.182.187]:54000: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)111.23.182.1871814991}  - ' ossec13001i^1Exim Auth failed2025-11-17 14:41:05 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:50040: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)92.62.243.154732800  U+ ossec11001i^Deferred login on the cpanel service[2025-11-17 14:40:23 -0300] info [webmaild] 177.201.202.209 - regiane@singseguros.com.br "GET /cpsess1468261695/webmail/jupiter/?login=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect177.201.202.2093469034\  -C) ossec13001i^/Exim Auth failed2025-11-17 14:41:03 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:33424: 535 Incorrect authentication data (set_id=sec.geral)182.95.222.2021269750e  -[# ossec13001i^Exim Auth failed2025-11-17 14:40:42 dovecot_login authenticator failed for ([101.13.1.75]) [101.13.1.75]:43278: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)101.13.1.751668284 W' ossec9708i^Dovecot Aborted Login with empty userNov 17 14:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -O' ossec13001i]Exim Auth failed2025-11-17 14:40:12 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:50181: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.721819730 W' ossec9708i]Dovecot Aborted Login with empty userNov 17 14:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -9' ossec13001i]Exim Auth failed2025-11-17 14:39:43 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:40720: 535 Incorrect authentication data (set_id=eliezer)121.73.163.612186224 :" <  uRS:4  W' ossec9708i_ Dovecot Aborted Login with empty userNov 17 14:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{3  S[) ossec11000i_Login failed on the cpanel service.[2025-11-17 14:44:34 -0300] info [webmaild] 82.221.113.209 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect82.221.113.20926296912  k' ossec9709i_Multiple Dovecot Aborted Logins with empty userNov 17 14:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%1  e%# ossec9710i^Dovecot Auth failed on disconnected session.Nov 17 14:43:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.5318149910 W' ossec9708i^Dovecot Aborted Login with empty userNov 17 14:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V/  -7) ossec13001i^Exim Auth failed2025-11-17 14:43:16 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:49610: 535 Incorrect authentication data (set_id=info)129.80.228.2316252001. -+ ossec13001i^Exim Auth failed2025-11-17 14:43:17 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:53705: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)223.197.145.1141819730m-  -g) ossec13001i^Exim Auth failed2025-11-17 14:43:04 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:58992: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)62.220.236.203660013*,  e)) ossec9710i^Dovecot Auth failed on disconnected session.Nov 17 14:42:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084+ W' ossec9708i^Dovecot Aborted Login with empty userNov 17 14:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+*  e)+ ossec9710i^{Dovecot Auth failed on disconnected session.Nov 17 14:42:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628222)  e9) ossec9710i^wDovecot Auth failed on disconnected session.Nov 17 14:42:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387b(  -U% ossec13001i^uExim Auth failed2025-11-17 14:42:12 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:45426: 535 Incorrect authentication data (set_id=alex.vendas)2.55.100.104294640u'  -y% ossec13001i^iExim Auth failed2025-11-17 14:42:01 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:38320: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)103.90.27.831643084a&  -M) ossec13001i^>Exim Auth failed2025-11-17 14:41:16 dovecot_login authenticator failed for ([79.135.236.154]) [79.135.236.154]:38798: 535 Incorrect authentication data (set_id=administrativo1)79.135.236.1542017370 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991k 1814991_ 1814991U 1814991R 1814991M 1814991D 1814991= 1814991( 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991G 1814991C 1814991B 1814991& 1814991% 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991v 1814991u 1814991d 1814991` 1814991Y 1814991W 1814991I 1814991B 18149918 1814991- 1814991, 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991w 1814991u 1814991r 1814991n 1814991g 1814991c 1814991` 1814991Q 1814991L 18149914 1814991, 1814991) 1814991# 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991t 1814991p 1814991i 1814991d 1814991[ 1814991U 1814991P 1814991O 1814991H 1814991@ 18149916 18149910 1814991* 1814991# 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991| 1814991m 1814991e 1814991a 1814991N 1814991K 1814991< 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991t 1814991s 1814991_ 1814991Y 1814991X 1814991M 18149914 1814991$ 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991s 1814991r 1814991q 1814991Q 1814991P 1814991L 1814991B 1814991A 1814991? 1814991= 18149910 1814991& 1814991$ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991q 1814991e 1814991_ 1814991] 1814991Y 1814991S 1814991L 1814991J 1814991G 1814991< 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991s 1814991q 1814991Z 1814991W 1814991N 1814991D 1814991@ 18149917 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f 4 * \ R H >   vlbXD:&0N|rh^TJ@6,"FndxZP<2( jV~t`B8.$Lf\zp | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& ic9 ic5 icS icS icE ic[ icW icW icG icA ib ib ib ib ib ib ib ib ib ib ib ib ib ib ib ibI ibu ibG iba ibW ibS ibI ibA ibq ibC ib] ibu ib_ ib9 ib ib  ia ib1 ib/ ib+ ib+ ib ib  ia ia ia ia ia ia ia ia~ ia} ia| ia{ iaz iay iax iaw iav iau iaSt ias ia`r iaZq iaWp iaWo ia<n ia6m ia2l ia&k ia j iai iah iag iaf i`e i`d i`c i`b i`a i`` i`_ i`^ i`] i`\ i`[ i`Z i`nY i`lX i`hW i`V i`xU i`tT i`S i`nR i`^Q i`P i`RO i`0N i`.M i`(L i_K i`J i_I i_H i_G i_F i_E i_D i_C i_xB i_nA i_@ i_? i_> i_z= i_v< i_; i_>: i_29 i_T8 i_F7 i_F6 i_@5 i_ 4 i_3 i_2 i^1 i^0 i^/ i^. i^- i^, i^+ i^{* i^w) i^u( i^k% i^i' i^V$ i^N# i^N" i^@! i^>& i^3 i^1 i^/ i^ i^ i^ i^ i] i] i] i] i] i] i] i] i] i]k i]] i][ i]' i]! id id id id id id id id id id id id ide idQ id; id) id% id id id  id  id  ic ic ic ic ic ic ic ic ic ic ic ic ic ic ic ic ic icy icu icq ico i] i]  i]  i] i] i\ i\ i\ i\ i\ i\ i\ i\ i\ i\{ i\u i\m i\m i\O i\O i\I i\? i\1 i\ i\ i\ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ i[ id i[ i[ i[ i[} i i i i[1 i[% i[ i[ i[ iZ iZ iZ iZ iZ iZ iZ iZ iZ iZ iZ iZ iZ iZ~ iZd iZR iZP iZ: iZ: iZ2 iZ* iZ* iZ( iZ& iZ& iZ iZ iY iY iY 4   ; H .7J\j42C  e=% ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 14:47:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651nB  -g) ossec13001i_xExim Auth failed2025-11-17 14:46:31 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:42100: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)120.157.27.2372077456jA  -a' ossec13001i_nExim Auth failed2025-11-17 14:46:21 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:34430: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)1.244.246.2211835841i@  -c# ossec13001i_Exim Auth failed2025-11-17 14:46:52 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:37956: 535 Incorrect authentication data (set_id=assessoria)189.56.0.193469034c?  -Q) ossec13001i_Exim Auth failed2025-11-17 14:46:53 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:45414: 535 Incorrect authentication data (set_id=contato)197.219.210.861036973W>  -;' ossec13001i_Exim Auth failed2025-11-17 14:46:41 dovecot_login authenticator failed for ([27.214.141.53]) [27.214.141.53]:17820: 535 Incorrect authentication data (set_id=juridico)27.214.141.531814991= W' ossec9708i_zDovecot Aborted Login with empty userNov 17 14:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_<  -G+ ossec13001i_vExim Auth failed2025-11-17 14:46:30 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:43689: 535 Incorrect authentication data (set_id=assessoria)211.247.127.25018358414;  e?' ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 14:47:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822: W' ossec9708i_>Dovecot Aborted Login with empty userNov 17 14:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o9  -i) ossec13001i_2Exim Auth failed2025-11-17 14:45:21 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:40086: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)220.93.167.1441835841S8  -3' ossec13001i_TExim Auth failed2025-11-17 14:45:54 dovecot_login authenticator failed for ([38.226.107.72]) [38.226.107.70]:48629: 535 Incorrect authentication data (set_id=info)38.226.107.7034690347  - + ossec13001i_FExim Auth failed2025-11-17 14:45:40 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:39272: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)203.192.211.1561269750q6  -k+ ossec13001i_FExim Auth failed2025-11-17 14:45:40 dovecot_login authenticator failed for ([220.118.190.204]) [220.118.190.204]:33281: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)220.118.190.2041835841o5  -i) ossec13001i_@Exim Auth failed2025-11-17 14:45:34 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:33870: 535 Incorrect authentication data (set_id=xavier)122.186.202.101269750 ? \ * &? R  3G' ossec11301i`nNew FTP connection.Nov 17 14:50:36 hosting pure-ftpd: (?@154.47.29.228) [INFO] New connection from 154.47.29.228154.47.29.2283202326tQ  -q+ ossec13001i`^Exim Auth failed2025-11-17 14:50:21 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:57008: 535 Incorrect authentication data (set_id=bianca.user.ceo@globalmedica.com.br)128.185.229.1261269750P  W' ossec9708i`Dovecot Aborted Login with empty userNov 17 14:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dO  -Q+ ossec13001i`RExim Auth failed2025-11-17 14:50:09 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:54115: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651UN  -7' ossec13001i`0Exim Auth failed2025-11-17 14:49:35 dovecot_login authenticator failed for ([121.185.89.74]) [121.185.89.74]:52494: 535 Incorrect authentication data (set_id=envios)121.185.89.741835841M W' ossec9708i`.Dovecot Aborted Login with empty userNov 17 14:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5RZC+M1D2oexV3kv>177.87.121.473469034%L  e%# ossec9710i`(Dovecot Auth failed on disconnected session.Nov 17 14:49:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001*K  e/# ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 14:48:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001fJ  -Y' ossec13001i`Exim Auth failed2025-11-17 14:49:16 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:41532: 535 Incorrect authentication data (set_id=envios@comercial.art.br)213.234.8.1142017370I W' ossec9708i_Dovecot Aborted Login with empty userNov 17 14:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.H  e1) ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 14:48:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.19322333871G  e=# ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 14:47:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<6Czw8c1DTLgIjQ01>8.141.13.531814991F  k' ossec9709i_Multiple Dovecot Aborted Logins with empty userNov 17 14:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/E  e1+ ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 14:48:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822D  W' ossec9708i_Dovecot Aborted Login with empty userNov 17 14:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 # ,OE33a  e?% ossec9710i`Dovecot Auth failed on disconnected session.Nov 17 14:51:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382]`  -E) ossec13001i`Exim Auth failed2025-11-17 14:51:39 dovecot_login authenticator failed for ([95.191.196.220]) [95.191.196.220]:36411: 535 Incorrect authentication data (set_id=atendimento)95.191.196.22020173700_  e3+ ossec9710i`Dovecot Auth failed on disconnected session.Nov 17 14:51:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822^ W' ossec9708i`Dovecot Aborted Login with empty userNov 17 14:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]]  -G' ossec13001i`Exim Auth failed2025-11-17 14:51:31 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:58300: 535 Incorrect authentication data (set_id=paulo.user.ceo)147.92.66.1886251999-\  e/) ossec9710i`Dovecot Auth failed on disconnected session.Nov 17 14:51:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750[  -% ossec13001i`Exim Auth failed2025-11-17 14:51:18 dovecot_login authenticator failed for (162.15.48.59.broad.dt.sx.dynamic.163data.com.cn) [59.48.15.162]:34775: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)59.48.15.1621814991YZ  -=) ossec13001i`Exim Auth failed2025-11-17 14:51:27 dovecot_login authenticator failed for ([211.216.58.204]) [211.216.58.204]:47319: 535 Incorrect authentication data (set_id=contato)211.216.58.2041835841Y  3C% ossec11301i`nNew FTP connection.Nov 17 14:50:37 hosting pure-ftpd: (?@194.32.122.5) [INFO] New connection from 194.32.122.5194.32.122.5597427 X  -+ ossec13001i`lExim Auth failed2025-11-17 14:50:35 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:51316: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)177.174.105.1133469034W  k' ossec9709i`hMultiple Dovecot Aborted Logins with empty userNov 17 14:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qV  -q% ossec13001i`Exim Auth failed2025-11-17 14:50:58 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:51931: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)111.70.32.101668284,U  e-) ossec9710i`xDovecot Auth failed on disconnected session.Nov 17 14:50:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044aT  -M) ossec13001i`tExim Auth failed2025-11-17 14:50:44 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:47999: 535 Incorrect authentication data (set_id=bianca.user.ceo)180.137.151.931814991tS  -s) ossec13001i`Exim Auth failed2025-11-17 14:50:59 dovecot_login authenticator failed for ([111.26.101.122]) [111.26.101.122]:36220: 535 Incorrect authentication data (set_id=paulo.user.ceo@louvoreterno.com.br)111.26.101.1221814991 x" ,;ZpWnxq W' ossec9708iaZDovecot Aborted Login with empty userNov 17 14:54:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Xp  -;) ossec13001iaWExim Auth failed2025-11-17 14:54:30 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:55608: 535 Incorrect authentication data (set_id=cpfnc2)103.233.92.1231269750eo -U' ossec13001iaWExim Auth failed2025-11-17 14:54:30 dovecot_plain authenticator failed for ([192.168.1.44]) [186.121.3.202]:54412: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)186.121.3.2023686110n  W' ossec9708ia<Dovecot Aborted Login with empty userNov 17 14:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fm  -Y' ossec13001ia6Exim Auth failed2025-11-17 14:53:57 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:51130: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)182.95.177.781269750]l  -G) ossec13001ia2Exim Auth failed2025-11-17 14:53:53 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:52190: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549mk  -i% ossec13001ia&Exim Auth failed2025-11-17 14:53:42 dovecot_login authenticator failed for ([183.236.13.2]) [183.236.13.2]:54036: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)183.236.13.21814991Vj  -9' ossec13001ia Exim Auth failed2025-11-17 14:53:35 dovecot_login authenticator failed for ([111.26.95.126]) [111.26.95.126]:43446: 535 Incorrect authentication data (set_id=contato)111.26.95.1261814991ei  -W' ossec13001iaExim Auth failed2025-11-17 14:53:33 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:53008: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)27.124.65.1381269750h  k' ossec9709iaMultiple Dovecot Aborted Logins with empty userNov 17 14:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jg  -_) ossec13001iaExim Auth failed2025-11-17 14:53:09 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:57090: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)122.187.220.301269750Yf  -A% ossec13001iaExim Auth failed2025-11-17 14:53:08 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:54438: 535 Incorrect authentication data (set_id=atendimento)211.196.31.21835841xe  -}' ossec13001i`Exim Auth failed2025-11-17 14:52:40 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:56335: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)103.51.26.1981269750d W' ossec9708i`Dovecot Aborted Login with empty userNov 17 14:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+c  e-' ossec9710i`Dovecot Auth failed on disconnected session.Nov 17 14:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084Zb  -?) ossec13001i`Exim Auth failed2025-11-17 14:51:17 dovecot_login authenticator failed for ([201.173.92.100]) [201.173.92.100]:42834: 535 Incorrect authentication data (set_id=eleicoes)201.173.92.1003996063 ( @ P u J P En3z  -% ossec13001iaExim Auth failed2025-11-17 14:56:29 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:42680: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)78.186.54.65298795  W' ossec9708iaDovecot Aborted Login with empty userNov 17 14:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347~  eE' ossec9710iaDovecot Auth failed on disconnected session.Nov 17 14:56:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084S}  -5% ossec13001iaExim Auth failed2025-11-17 14:56:41 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:58326: 535 Incorrect authentication data (set_id=contato)46.8.246.1832017370W|  -=% ossec13001iaExim Auth failed2025-11-17 14:56:00 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:11355: 535 Incorrect authentication data (set_id=jose.almiro)117.135.6.101814991]{  -E) ossec13001iaExim Auth failed2025-11-17 14:55:35 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:34428: 535 Incorrect authentication data (set_id=vendas.luiz)111.26.106.1191814991z W' ossec9708iaDovecot Aborted Login with empty userNov 17 14:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3we5Dc5DYtmxV3kv>177.87.121.4734690341y  e9' ossec9710iaDovecot Auth failed on disconnected session.Nov 17 14:55:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991vx  -u+ ossec13001iaExim Auth failed2025-11-17 14:55:45 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:52763: 535 Incorrect authentication data (set_id=jose.almiro@vidaengenharia.com.br)183.167.193.1271814991'w  e%' ossec9710iaDovecot Auth failed on disconnected session.Nov 17 14:55:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<8V72Dc5DmKMkMrBu>36.50.176.1101562822Wv  -;' ossec13001iaExim Auth failed2025-11-17 14:55:34 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:19535: 535 Incorrect authentication data (set_id=compras)58.49.113.1381814991lu  -g' ossec13001iaExim Auth failed2025-11-17 14:55:19 dovecot_login authenticator failed for ([82.193.122.91]) [82.193.122.91]:59519: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)82.193.122.91690791Xt  -9+ ossec13001iaSExim Auth failed2025-11-17 14:54:26 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:42150: 535 Incorrect authentication data (set_id=contato)128.185.229.1261269750s  -' ossec13001iaExim Auth failed2025-11-17 14:55:14 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:42289: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)177.27.76.2103469034Tr  -9# ossec13001ia`Exim Auth failed2025-11-17 14:54:40 dovecot_login authenticator failed for ([112.94.5.43]) [112.94.5.43]:54374: 535 Incorrect authentication data (set_id=aureovieira)112.94.5.431814991 y vwyz  -}+ ossec13001ib9Exim Auth failed2025-11-17 14:58:15 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:40438: 535 Incorrect authentication data (set_id=administrativo1)122.187.228.2331269750{  -% ossec13001ibExim Auth failed2025-11-17 14:57:50 dovecot_login authenticator failed for (host87-89-16-178.reedlan.com) [178.16.89.87]:58001: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)178.16.89.87690791 W' ossec9708ib Dovecot Aborted Login with empty userNov 17 14:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  -k# ossec13001iaExim Auth failed2025-11-17 14:57:17 dovecot_login authenticator failed for ([194.4.42.33]) [194.4.42.33]:59724: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)194.4.42.333175395*  e'+ ossec9710ib1Dovecot Auth failed on disconnected session.Nov 17 14:58:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822q  -q% ossec13001ib/Exim Auth failed2025-11-17 14:58:06 dovecot_login authenticator failed for (lixadoracuritiba.com.br) [206.82.9.238]:49411: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)206.82.9.2386252001  --) ossec13001ib+Exim Auth failed2025-11-17 14:58:02 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:53852: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)122.187.220.301269750   -%) ossec13001ib+Exim Auth failed2025-11-17 14:58:01 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:59626: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)117.211.77.1841269750r  -o) ossec13001ibExim Auth failed2025-11-17 14:57:47 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:41688: 535 Incorrect authentication data (set_id=comercial.user.ceo@inovasite.com)195.222.57.1903277605Y  -=) ossec13001ib Exim Auth failed2025-11-17 14:57:30 dovecot_login authenticator failed for ([178.177.200.26]) [178.177.200.26]:42990: 535 Incorrect authentication data (set_id=adriana)178.177.200.262017370-  e-+ ossec9710iaDovecot Auth failed on disconnected session.Nov 17 14:57:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841k  U;' ossec11001iaDeferred login on the cpanel service[2025-11-17 14:56:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing187.67.211.473469034n  -k% ossec13001iaExim Auth failed2025-11-17 14:57:09 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:52497: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)58.16.201.521814991*  e)) ossec9710iaDovecot Auth failed on disconnected session.Nov 17 14:57:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841  k' ossec9709iaMultiple Dovecot Aborted Logins with empty userNov 17 14:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6LNEEc5DpomxV3kv>177.87.121.473469034 d |d  k' ossec9709ibMultiple Dovecot Aborted Logins with empty userNov 17 14:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  e!' ossec9710ibDovecot Auth failed on disconnected session.Nov 17 15:00:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<1cz+Hc5DLN8+PIOL>62.60.131.139130758g  -Y) ossec13001ibIExim Auth failed2025-11-17 14:58:31 dovecot_login authenticator failed for ([188.247.63.174]) [188.247.63.174]:33036: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)188.247.63.1742017370^  -G) ossec13001ibuExim Auth failed2025-11-17 14:59:15 dovecot_login authenticator failed for ([197.255.134.56]) [197.255.134.56]:44777: 535 Incorrect authentication data (set_id=atualizacoes)197.255.134.563374766!  e# ossec9710ibGDovecot Auth failed on disconnected session.Nov 17 14:58:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001z  -}+ ossec13001ibaExim Auth failed2025-11-17 14:58:57 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:60491: 535 Incorrect authentication data (set_id=financeiro)212.120.163.1102017370:  eG+ ossec9710ibWDovecot Auth failed on disconnected session.Nov 17 14:58:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001u  -}! ossec13001ibSExim Auth failed2025-11-17 14:58:43 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:34604: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)87.76.5.362017370 W' ossec9708ibIDovecot Aborted Login with empty userNov 17 14:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -K% ossec13001ibAExim Auth failed2025-11-17 14:58:23 dovecot_login authenticator failed for ([111.4.120.19]) [111.4.120.19]:57054: 535 Incorrect authentication data (set_id=comercial.user.ceo)111.4.120.191814991]  -G' ossec13001ibqExim Auth failed2025-11-17 14:59:12 dovecot_login authenticator failed for ([121.73.167.33]) [121.73.167.33]:40032: 535 Incorrect authentication data (set_id=isabellylisboa)121.73.167.332186224$  e## ossec9710ibCDovecot Auth failed on disconnected session.Nov 17 14:58:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<4CnnF85DYJQIjQ01>8.141.13.531814991z  -' ossec13001ib]Exim Auth failed2025-11-17 14:58:51 dovecot_login authenticator failed for 24.115.167.85.res-cmts.mlf.ptd.net [24.115.167.85]:45889: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)24.115.167.856252001) U5' ossec11001ibuDeferred login on the cpanel service[2025-11-17 14:59:15 -0300] info [webmaild] 187.67.211.47 - comercial@huboperacoes.com "GET /cpsess5305070381/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034v  -y' ossec13001ib_Exim Auth failed2025-11-17 14:58:54 dovecot_login authenticator failed for ([111.26.69.160]) [111.26.69.160]:36630: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)111.26.69.1601814991 U  }FEUl-  -c) ossec13001icGExim Auth failed2025-11-17 15:02:45 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:57417: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)103.168.241.321269750},  -) ossec13001icAExim Auth failed2025-11-17 15:02:40 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:34218: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)187.161.136.1839960633+  e;) ossec9710ibDovecot Auth failed on disconnected session.Nov 17 15:01:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084* W' ossec9708ibDovecot Aborted Login with empty userNov 17 15:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.) U?' ossec11001ibDeferred login on the cpanel service[2025-11-17 15:01:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess4680129972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034.(  e/+ ossec9710ibDovecot Auth failed on disconnected session.Nov 17 15:00:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822v'  SS' ossec11000ibLogin failed on the cpanel service.[2025-11-17 15:00:45 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect187.67.211.473469034X&  -;) ossec13001ibExim Auth failed2025-11-17 15:00:34 dovecot_login authenticator failed for ([219.128.55.126]) [219.128.55.126]:36114: 535 Incorrect authentication data (set_id=rafael)219.128.55.1261814991% W' ossec9708ibDovecot Aborted Login with empty userNov 17 15:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.$  e1) ossec9710ibDovecot Auth failed on disconnected session.Nov 17 15:00:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750j#  -a' ossec13001ibExim Auth failed2025-11-17 15:00:57 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:42796: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)103.107.36.1812697508"  E ossec2501ibUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127!  W' ossec9708ibDovecot Aborted Login with empty userNov 17 15:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i  -a% ossec13001ibExim Auth failed2025-11-17 14:59:55 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:41468: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)182.95.54.101269750/  UC' ossec11001ibDeferred login on the cpanel service[2025-11-17 14:59:47 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "GET /cpsess5305070381/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034  (  .< U?' ossec11001icqDeferred login on the cpanel service[2025-11-17 15:03:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess4680129972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034n;  -e+ ossec13001icoExim Auth failed2025-11-17 15:03:27 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:53682: 535 Incorrect authentication data (set_id=formula316)213.238.254.1562661886o:  SE' ossec11000icLogin failed on the cpanel service.[2025-11-17 15:04:11 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect187.67.211.473469034]9 -C) ossec13001icExim Auth failed2025-11-17 15:03:46 dovecot_login authenticator failed for (User) [177.74.174.120]:49165: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)177.74.174.1203469034]8  -E) ossec13001icyExim Auth failed2025-11-17 15:03:36 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:56887: 535 Incorrect authentication data (set_id=venesselume)125.215.199.3718197307  -' ossec13001icExim Auth failed2025-11-17 15:03:53 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:65105: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)77.106.78.2152017370T6  EG ossec2501icUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x3e27d50), "3rdparty/roundcube/skins/elastic/watermark.html", "jupiter") called at cpsrvd.pl line 51275  k' ossec9709ic9Multiple Dovecot Aborted Logins with empty userNov 17 15:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.4 U?' ossec11001ic5Deferred login on the cpanel service[2025-11-17 15:02:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess4680129972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034u3  -y% ossec13001icSExim Auth failed2025-11-17 15:02:58 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:56072: 535 Incorrect authentication data (set_id=atualizacoes)83.221.15.762017370~2  -) ossec13001icSExim Auth failed2025-11-17 15:02:58 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:42296: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)58.182.111.1621880251)1  e%+ ossec9710icEDovecot Auth failed on disconnected session.Nov 17 15:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841j0  -_) ossec13001ic[Exim Auth failed2025-11-17 15:03:07 dovecot_login authenticator failed for ([36.105.166.200]) [36.105.166.200]:49750: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)36.105.166.2001814991M/  -+# ossec13001icWExim Auth failed2025-11-17 15:03:03 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:47782: 535 Incorrect authentication data (set_id=info)113.59.34.51814991.  W' ossec9708icWDovecot Aborted Login with empty userNov 17 15:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   K  k' ossec9709icMultiple Dovecot Aborted Logins with empty userNov 17 15:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_J  -K' ossec13001icExim Auth failed2025-11-17 15:05:26 dovecot_login authenticator failed for ([121.73.163.92]) [121.73.163.92]:39180: 535 Incorrect authentication data (set_id=andre.nascimento)121.73.163.922186224sI  -s' ossec13001idExim Auth failed2025-11-17 15:06:14 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:34120: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)77.206.93.1073017382)H  e+' ossec9710id Dovecot Auth failed on disconnected session.Nov 17 15:06:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<5zY6M85DRpY+PIOL>62.60.131.139130758lG  -a+ ossec13001icExim Auth failed2025-11-17 15:04:26 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:52295: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.19322333875A UM' ossec11001icDeferred login on the cpanel service[2025-11-17 15:05:12 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034o@  SE' ossec11000icLogin failed on the cpanel service.[2025-11-17 15:04:39 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect187.67.211.473469034? W' ossec9708icDovecot Aborted Login with empty userNov 17 15:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T>  EG ossec2501icUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x3e97648), "3rdparty/roundcube/skins/elastic/watermark.html", "jupiter") called at cpsrvd.pl line 5127= W' ossec9708icuDovecot Aborted Login with empty userNov 17 15:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  w k jHlR"tY  -u' ossec13001idExim Auth failed2025-11-17 15:08:46 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:46869: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)39.125.67.1091835841X  k' ossec9709idMultiple Dovecot Aborted Logins with empty userNov 17 15:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#W  e' ossec9710idDovecot Auth failed on disconnected session.Nov 17 15:08:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758,V  e/' ossec9710idDovecot Auth failed on disconnected session.Nov 17 15:08:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991U W' ossec9708ideDovecot Aborted Login with empty userNov 17 15:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034XT  -A# ossec13001idExim Auth failed2025-11-17 15:08:10 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:57725: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.7062519995S UM' ossec11001idQDeferred login on the cpanel service[2025-11-17 15:07:12 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034eR -W% ossec13001id;Exim Auth failed2025-11-17 15:06:50 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.245.7]:32900: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)104.28.245.73469034Q W' ossec9708id)Dovecot Aborted Login with empty userNov 17 15:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034cP  -Q) ossec13001id%Exim Auth failed2025-11-17 15:06:28 dovecot_login authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:45308: 535 Incorrect authentication data (set_id=info)218.26.205.1541814991O  -+ ossec13001id Exim Auth failed2025-11-17 15:06:00 dovecot_login authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:43110: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)180.218.102.22516682845N UM' ossec11001idDeferred login on the cpanel service[2025-11-17 15:06:12 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034M  W' ossec9708id Dovecot Aborted Login with empty userNov 17 15:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7eNDM85DGqCxV3kv>177.87.121.4734690343L  e9+ ossec9710icDovecot Auth failed on disconnected session.Nov 17 15:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 5  / ' 7 Kj= ]h -C) ossec13001ie Exim Auth failed2025-11-17 15:10:16 dovecot_login authenticator failed for (User) [177.74.174.120]:51743: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)177.74.174.1203469034)g  e)' ossec9710ieDovecot Auth failed on disconnected session.Nov 17 15:10:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<4HGWQ85DtNI7GIXF>59.24.133.1971835841"f  e' ossec9710ieDovecot Auth failed on disconnected session.Nov 17 15:10:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991e W' ossec9708ieDovecot Aborted Login with empty userNov 17 15:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d W' ossec9708idDovecot Aborted Login with empty userNov 17 15:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,c  U?% ossec11001ieDeferred login on the cpanel service[2025-11-17 15:10:07 -0300] info [webmaild] 189.40.71.97 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.40.71.973469034)b  e') ossec9710ieDovecot Auth failed on disconnected session.Nov 17 15:10:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387]a -C) ossec13001idExim Auth failed2025-11-17 15:10:00 dovecot_login authenticator failed for (User) [177.74.174.120]:51743: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)177.74.174.1203469034h`  -a# ossec13001idExim Auth failed2025-11-17 15:09:12 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:59198: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)46.8.246.272017370l_  -g% ossec13001idExim Auth failed2025-11-17 15:09:05 dovecot_login authenticator failed for ([36.135.62.79]) [36.135.62.79]:58180: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)36.135.62.791814991^  -' ossec13001idExim Auth failed2025-11-17 15:08:43 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:64983: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)184.57.39.1706252001i]  -a' ossec13001idExim Auth failed2025-11-17 15:09:05 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:56142: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795\  W' ossec9708idDovecot Aborted Login with empty userNov 17 15:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<56kCPs5DEpCxV3kv>177.87.121.473469034Y[  -?' ossec13001idExim Auth failed2025-11-17 15:08:57 dovecot_login authenticator failed for ([27.24.141.119]) [27.24.141.119]:33314: 535 Incorrect authentication data (set_id=financeiro)27.24.141.1191814991jZ  -a' ossec13001idExim Auth failed2025-11-17 15:08:58 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:59466: 535 Incorrect authentication data (set_id=administrativo1)93.241.232.142921044 {  {)w  e-# ossec9710ieDovecot Auth failed on disconnected session.Nov 17 15:14:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001v W' ossec9708ieDovecot Aborted Login with empty userNov 17 15:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Yu  -=) ossec13001ieExim Auth failed2025-11-17 15:13:13 dovecot_login authenticator failed for ([113.160.209.29]) [113.160.209.29]:45542: 535 Incorrect authentication data (set_id=contato)113.160.209.291562822ht  -_% ossec13001ieExim Auth failed2025-11-17 15:12:54 dovecot_login authenticator failed for ([183.6.115.88]) [183.6.115.88]:56026: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)183.6.115.881814991s W' ossec9708ieDovecot Aborted Login with empty userNov 17 15:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ar  -K+ ossec13001ieExim Auth failed2025-11-17 15:12:27 dovecot_login authenticator failed for ([120.157.143.104]) [120.157.143.104]:60480: 535 Incorrect authentication data (set_id=vendas.pedro)120.157.143.1042077456'q  e!+ ossec9710ieeDovecot Auth failed on disconnected session.Nov 17 15:11:48 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=190.181.100.133, lip=200.150.196.245, TLS, session=<25/QRs5DtLG+tWSF>190.181.100.1333865483-p U?% ossec11001ieUDeferred login on the cpanel service[2025-11-17 15:11:33 -0300] info [webmaild] 189.40.71.97 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.40.71.973469034o  k' ossec9709ieUMultiple Dovecot Aborted Logins with empty userNov 17 15:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3nHsRs5D9uOxV3kv>177.87.121.473469034vn  -w) ossec13001ieQExim Auth failed2025-11-17 15:11:29 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:36960: 535 Incorrect authentication data (set_id=andre.nascimento.ceo)186.235.248.733469034qm  -q% ossec13001ieOExim Auth failed2025-11-17 15:11:27 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:49376: 535 Incorrect authentication data (set_id=info.user.ceo@lixadoracuritiba.com.br)84.54.115.461512440l  --' ossec13001ieFExim Auth failed2025-11-17 15:11:16 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:57248: 535 Incorrect authentication data (set_id=andre.nascimento.ceo@calcautomacao.com.br)125.20.251.661269750qk  -m) ossec13001ie|Exim Auth failed2025-11-17 15:12:11 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:50799: 535 Incorrect authentication data (set_id=vendas.pedro@maringasoldas.com.br)193.169.28.2442017370j  W' ossec9708iesDovecot Aborted Login with empty userNov 17 15:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bi  -M+ ossec13001ieaExim Auth failed2025-11-17 15:11:45 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:33371: 535 Incorrect authentication data (set_id=info.user.ceo)122.225.203.1061814991 U   8=2P"CMUt -q) ossec13001ifExim Auth failed2025-11-17 15:17:07 dovecot_plain authenticator failed for ([107.172.135.11]) [107.172.135.11]:52577: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)107.172.135.116252001r  -o) ossec13001ifExim Auth failed2025-11-17 15:16:36 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:49754: 535 Incorrect authentication data (set_id=fabio.vendas)172.248.47.1146252001[  -?+ ossec13001ifExim Auth failed2025-11-17 15:16:35 dovecot_login authenticator failed for ([220.119.153.105]) [220.119.153.105]:50720: 535 Incorrect authentication data (set_id=cpfnc2)220.119.153.1051835841*  e'+ ossec9710ifZDovecot Auth failed on disconnected session.Nov 17 15:15:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991^  -I' ossec13001ifRExim Auth failed2025-11-17 15:15:45 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:47481: 535 Incorrect authentication data (set_id=contato)84.213.189.273144096  -' ossec13001ifLExim Auth failed2025-11-17 15:15:40 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:59362: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)213.124.221.22750405w  -y) ossec13001iflExim Auth failed2025-11-17 15:16:11 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:41719: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)109.207.33.2486290252\  -A+ ossec13001if`Exim Auth failed2025-11-17 15:15:59 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:44437: 535 Incorrect authentication data (set_id=contato)177.236.145.1883996063d  -W% ossec13001ifXExim Auth failed2025-11-17 15:15:52 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:3729: 535 Incorrect authentication data (set_id=gerson.comercial)144.64.65.302264397z~  -' ossec13001ifPExim Auth failed2025-11-17 15:15:42 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:54466: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)51.68.226.1713017382} W' ossec9708ifFDovecot Aborted Login with empty userNov 17 15:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g|  -[' ossec13001if>Exim Auth failed2025-11-17 15:15:25 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:48798: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)88.84.205.1042017370P{  -3% ossec13001ifExim Auth failed2025-11-17 15:14:53 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:40500: 535 Incorrect authentication data (set_id=envios)65.20.170.5999237z  k' ossec9709if Multiple Dovecot Aborted Logins with empty userNov 17 15:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iy  -]) ossec13001ifExim Auth failed2025-11-17 15:14:25 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:59974: 535 Incorrect authentication data (set_id=envios@comercial.art.br)125.20.228.1461269750x  W' ossec9708if(Dovecot Aborted Login with empty userNov 17 15:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 Y ksZvUpY0  e3+ ossec9710ifDovecot Auth failed on disconnected session.Nov 17 15:18:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001 W' ossec9708ifDovecot Aborted Login with empty userNov 17 15:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<82v2X85DyIqxV3kv>177.87.121.473469034\  -E' ossec13001ifExim Auth failed2025-11-17 15:18:10 dovecot_login authenticator failed for ([59.46.193.187]) [59.46.193.187]:49165: 535 Incorrect authentication data (set_id=ferramentaria)59.46.193.1871814991e  -S+ ossec13001ifExim Auth failed2025-11-17 15:17:54 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50074: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651a  -M) ossec13001ifExim Auth failed2025-11-17 15:17:39 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:39936: 535 Incorrect authentication data (set_id=paulinho.vendas)192.34.128.2026252001  e% ossec9710ifDovecot Auth failed on disconnected session.Nov 17 15:17:34 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=71.41.202.12, lip=200.150.196.245, TLS, session=<18pmW85DOqNHKcoM>71.41.202.126252001`  -M' ossec13001ifExim Auth failed2025-11-17 15:17:30 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:54041: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730  W' ossec9708ifDovecot Aborted Login with empty userNov 17 15:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t  -s) ossec13001ifExim Auth failed2025-11-17 15:17:58 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:38775: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)83.239.171.2262017370  k' ossec9709ifMultiple Dovecot Aborted Logins with empty userNov 17 15:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e)+ ossec9710ifDovecot Auth failed on disconnected session.Nov 17 15:17:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001r  -q' ossec13001ifExim Auth failed2025-11-17 15:17:21 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:58793: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)70.174.168.9962520015  e?) ossec9710ifDovecot Auth failed on disconnected session.Nov 17 15:17:14 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=117.217.120.52, lip=200.150.196.245, TLS, session=117.217.120.521269750 W' ossec9708ifDovecot Aborted Login with empty userNov 17 15:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  -y' ossec13001ifvExim Auth failed2025-11-17 15:16:21 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:14294: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)200.5.113.1333865483 W#1  -3upW%  W' ossec9708igDovecot Aborted Login with empty userNov 17 15:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  - + ossec13001igExim Auth failed2025-11-17 15:21:03 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:40925: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)151.237.115.208732800.#  e3' ossec9710igDovecot Auth failed on disconnected session.Nov 17 15:20:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.11015628225"  e=+ ossec9710ig|Dovecot Auth failed on disconnected session.Nov 17 15:20:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001!  k' ossec9709igpMultiple Dovecot Aborted Logins with empty userNov 17 15:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  e-) ossec9710igDovecot Auth failed on disconnected session.Nov 17 15:21:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084v  -u+ ossec13001igExim Auth failed2025-11-17 15:21:05 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:57882: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)197.219.228.2421036973Y  -=) ossec13001igExim Auth failed2025-11-17 15:20:53 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:56506: 535 Incorrect authentication data (set_id=adriana)111.93.177.2281269750p  -o% ossec13001ignExim Auth failed2025-11-17 15:20:30 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:37747: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)61.72.58.2421835841b  -W! ossec13001igPExim Auth failed2025-11-17 15:19:59 dovecot_login authenticator failed for ([84.54.3.39]) [84.54.3.39]:33816: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)84.54.3.391819730q  -u# ossec13001igHExim Auth failed2025-11-17 15:19:51 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:43500: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)89.67.38.27798544:  eI) ossec9710ig6Dovecot Auth failed on disconnected session.Nov 17 15:19:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750 W' ossec9708ig4Dovecot Aborted Login with empty userNov 17 15:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n  -i' ossec13001ig^Exim Auth failed2025-11-17 15:20:14 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:2114: 535 Incorrect authentication data (set_id=contato)187.218.57.503996063Y  -;+ ossec13001igZExim Auth failed2025-11-17 15:20:09 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:41742: 535 Incorrect authentication data (set_id=info)194.179.135.1742661886 L    %)EqF,L\5  -C) ossec13001igExim Auth failed2025-11-17 15:21:35 dovecot_login authenticator failed for ([222.122.103.21]) [222.122.103.21]:33460: 535 Incorrect authentication data (set_id=assessoria)222.122.103.2118358414 W' ossec9708igDovecot Aborted Login with empty userNov 17 15:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'3  e%' ossec9710igDovecot Auth failed on disconnected session.Nov 17 15:22:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991P2  -3! ossec13001igExim Auth failed2025-11-17 15:21:58 dovecot_login authenticator failed for ([78.36.7.89]) [78.36.7.89]:36102: 535 Incorrect authentication data (set_id=financeiro)78.36.7.892017370V1  -9' ossec13001igExim Auth failed2025-11-17 15:21:52 dovecot_login authenticator failed for ([182.66.81.153]) [27.123.112.90]:45174: 535 Incorrect authentication data (set_id=contato)27.123.112.901269750R0  -7! ossec13001igExim Auth failed2025-11-17 15:21:43 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:46312: 535 Incorrect authentication data (set_id=atualizacoes)14.33.96.31835841y/  -}) ossec13001igExim Auth failed2025-11-17 15:22:00 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:60405: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)201.160.64.11839960633.  e;) ossec9710igDovecot Auth failed on disconnected session.Nov 17 15:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044x-  -% ossec13001igExim Auth failed2025-11-17 15:21:43 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:58662: 535 Incorrect authentication data (set_id=financeiro)146.4.81.2062658434l,  -c) ossec13001igExim Auth failed2025-11-17 15:21:29 dovecot_login authenticator failed for ([188.247.63.174]) [188.247.63.174]:56396: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)188.247.63.1742017370j+  -g% ossec13001igExim Auth failed2025-11-17 15:21:45 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:50675: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)65.20.170.5999237~*  -) ossec13001igExim Auth failed2025-11-17 15:21:26 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:59958: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)116.48.149.1231819730g)  -_# ossec13001igExim Auth failed2025-11-17 15:21:24 dovecot_login authenticator failed for ([101.13.1.58]) [101.13.1.58]:60914: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)101.13.1.581668284(  -) ossec13001igExim Auth failed2025-11-17 15:22:15 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:54236: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)178.140.212.922017370&'  e!) ossec9710igDovecot Auth failed on disconnected session.Nov 17 15:21:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841\&  -E' ossec13001igExim Auth failed2025-11-17 15:21:31 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:35672: 535 Incorrect authentication data (set_id=administrativo1)111.93.80.1581269750   9# 7*D  e+' ossec9710ihDovecot Auth failed on disconnected session.Nov 17 15:25:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084C W' ossec9708ihDovecot Aborted Login with empty userNov 17 15:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^B  -G) ossec13001ihExim Auth failed2025-11-17 15:25:20 dovecot_login authenticator failed for ([199.193.97.116]) [199.193.97.116]:48193: 535 Incorrect authentication data (set_id=atualizacoes)199.193.97.1166252001lA  -c) ossec13001ihrExim Auth failed2025-11-17 15:24:50 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:51810: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)152.52.199.1261269750@ W' ossec9708ih`Dovecot Aborted Login with empty userNov 17 15:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4Q1ndc5D+OmxV3kv>177.87.121.473469034V?  -9' ossec13001ihNExim Auth failed2025-11-17 15:24:14 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:39644: 535 Incorrect authentication data (set_id=contato)106.0.165.2191605651>  W' ossec9708ihBDovecot Aborted Login with empty userNov 17 15:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034=  k' ossec9709ih&Multiple Dovecot Aborted Logins with empty userNov 17 15:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<85Hacc5DJsSxV3kv>177.87.121.473469034S<  -5% ossec13001ih Exim Auth failed2025-11-17 15:23:28 dovecot_login authenticator failed for ([36.135.62.79]) [36.135.62.79]:33368: 535 Incorrect authentication data (set_id=rodrigo)36.135.62.791814991c;  -Y# ossec13001ihExim Auth failed2025-11-17 15:23:17 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:59437: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)5.30.196.79290557m:  -i% ossec13001igExim Auth failed2025-11-17 15:22:31 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:47068: 535 Incorrect authentication data (set_id=isabellylisboa)139.60.85.946252001c9  -O+ ossec13001igExim Auth failed2025-11-17 15:22:26 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:35577: 535 Incorrect authentication data (set_id=rafael)178.232.116.1653144096c8  -U% ossec13001ihExim Auth failed2025-11-17 15:22:58 dovecot_login authenticator failed for ([39.164.91.67]) [39.164.91.67]:50468: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)39.164.91.671814991,7  e++ ossec9710igDovecot Auth failed on disconnected session.Nov 17 15:22:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628226 W' ossec9708igDovecot Aborted Login with empty userNov 17 15:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 | q ;G^WuR[W`|`S  -K) ossec13001ihExim Auth failed2025-11-17 15:26:49 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:39970: 535 Incorrect authentication data (set_id=isabellylisboa)128.185.218.181269750sR  -u% ossec13001ihExim Auth failed2025-11-17 15:26:33 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:45876: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)59.27.93.1381835841Q  - ) ossec13001ihExim Auth failed2025-11-17 15:26:53 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:48990: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)14.194.128.1581269750sP  -u' ossec13001ihExim Auth failed2025-11-17 15:26:42 dovecot_login authenticator failed for 188-197-29-85.dyn.estpak.ee [85.29.197.188]:45702: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)85.29.197.188453733O  k' ossec9709ihMultiple Dovecot Aborted Logins with empty userNov 17 15:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^N  -G) ossec13001ihExim Auth failed2025-11-17 15:26:25 dovecot_login authenticator failed for ([111.206.233.34]) [221.218.37.145]:39943: 535 Incorrect authentication data (set_id=junior.gomes)221.218.37.1451814991M  -) ossec13001ihExim Auth failed2025-11-17 15:26:21 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:39026: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)122.187.234.541269750eL  -W' ossec13001ihExim Auth failed2025-11-17 15:26:55 dovecot_login authenticator failed for 111-70-23-238.emome-ip.hinet.net [111.70.23.238]:44345: 535 Incorrect authentication data (set_id=leandro)111.70.23.2381668284pK  -m' ossec13001ihExim Auth failed2025-11-17 15:26:05 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:38568: 535 Incorrect authentication data (set_id=financeiro)202.53.94.24212697502J  e9) ossec9710ihDovecot Auth failed on disconnected session.Nov 17 15:25:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.20222333870I  e5) ossec9710ihDovecot Auth failed on disconnected session.Nov 17 15:25:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841*H  e)) ossec9710ihDovecot Auth failed on disconnected session.Nov 17 15:25:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841G  -' ossec13001ihExim Auth failed2025-11-17 15:25:33 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:47074: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)182.66.218.261269750(F  e+# ossec9710ihDovecot Auth failed on disconnected session.Nov 17 15:25:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991tE  -q+ ossec13001ihExim Auth failed2025-11-17 15:26:02 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:55304: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)190.238.101.2093932488  6eb  -U+ ossec13001ii]Exim Auth failed2025-11-17 15:28:43 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:58242: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795a W' ossec9708iiQDovecot Aborted Login with empty userNov 17 15:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h`  -Y+ ossec13001iiKExim Auth failed2025-11-17 15:28:26 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:12591: 535 Incorrect authentication data (set_id=eliezer)121.202.215.2051819730w_  -w+ ossec13001iiIExim Auth failed2025-11-17 15:28:24 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:36729: 535 Incorrect authentication data (set_id=andre.nascimento)166.201.209.15262520017^  eE' ossec9710iiwDovecot Auth failed on disconnected session.Nov 17 15:29:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=41.139.37.218, lip=200.150.196.245, TLS, session=41.139.37.21823006606]  eE% ossec9710iiDovecot Auth failed on disconnected session.Nov 17 15:27:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651\ W' ossec9708iiDovecot Aborted Login with empty userNov 17 15:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z[  -?) ossec13001iiExim Auth failed2025-11-17 15:27:25 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:33315: 535 Incorrect authentication data (set_id=salamuni)103.248.30.2051269750YZ  -=) ossec13001ii Exim Auth failed2025-11-17 15:27:24 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:41746: 535 Incorrect authentication data (set_id=eduardo)218.156.93.2021835841Y  -' ossec13001ii:Exim Auth failed2025-11-17 15:28:10 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:59194: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)182.95.57.1581269750aX  -Q% ossec13001ii6Exim Auth failed2025-11-17 15:28:05 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:58478: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)84.54.115.461512440$W  e## ossec9710ii&Dovecot Auth failed on disconnected session.Nov 17 15:27:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001aV  -S# ossec13001ii Exim Auth failed2025-11-17 15:27:43 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:53080: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)182.95.47.21269750tU  -s) ossec13001iiExim Auth failed2025-11-17 15:27:12 dovecot_login authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:43441: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)109.202.61.1552017370T  W' ossec9708ihDovecot Aborted Login with empty userNov 17 15:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0bJVfs5Dtt6xV3kv>177.87.121.473469034 vdI</"~qdWJ=0#  i \ O B 5 (     r e X K > 1 $  { n a T Gy : -   l_RE8+uh[NA4' w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^Q ~D7*tgZM@3& qd}pcVzm`SF9, vWJ=0 3469034S 3469034O 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034z 3469034s 3469034q 3469034n 3469034h 3469034d 34690344 3469034U 3469034R 3469034Q 3469034H 3469034B 3469034< 3469034; 34690346 34690343 3469034. 3469034* 3469034) 3469034( 3469034" 3469034! 3469034 3469034 3469034} 3469034x 3469034w 3469034p 3469034o 3469034m 3469034k 3469034e 3469034] 3469034X 3469034M 3469034L 3469034G 3469034@ 3469034? 3469034: 34690347 34690345 3469034, 3469034$ 3469034# 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034N 3469034 3469034 3469034 3469034 3469034 3469034 3469034~ 3469034{ 3469034y 3469034s 3469034n 3469034m 3469034h 3469034a 3469034\ 3469034T 3469034O 3469034C 3469034@ 3469034> 3469034= 34690346 34690344 3469034% 3469034! 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034^ 3469034X 3469034W 3469034P 3469034M 3469034I 3469034F 3469034D 3469034@ 3469034= 3469034: 34690348 34690342 34690340 3469034+ 3469034% 3469034$ 3469034# 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 34690344 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034{ 3469034y 3469034m 3469034k 3469034i 3469034e 3469034d 3469034b 3469034\ 3469034W 3469034 3469034 p*> 2 (   ~tj`VLB8.$f\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f R H > 4 \ *   lv:bXN0&D|rh^"TJ@6,xndZP<2F (B8j`V~tL.$fzp>\RH | r h ^ T J @ 6 , "    x n d Z P F <zp4*  vlbXND:0& im in in in im im im im im im im im imz im imN imj imX imV imN im0 im0 im im il il il il il il il il il il il ilm il il{ il] il[ il! ilK ilK ilA il? il- ik ik ik il  il ik ik ik ik ik ik ik ika ik ik ikm ikO ik1 ik/ ik' ikA ik3 ik1 ik+ ik ik ik  ik ij ij ik ik ij ij ij ij ij ij ij ij ij ij ij} ijo ijm ij ij ijk ij_ ij[ ijW ijO ijA ijk ij ij ij~ ii} ij#| ij{ ijz iiy iix iiw iiv iiu iit iis iir iiq iip iio iin iim iil iik iij iii iih ii}g iiUf ii}e iiud iiec ii]b iiQa iiw^ iiK` iiI_ ii:Y ii6X ii&W ii V ii] ii\ ii[ ii Z iiU ihT ihL ihQ ihS ihP ihR ihO ihN ihM ihK ihE ihJ ihI ihH ihD ihG ihC ihF ihB ihrA ih`@ ihN? ihB> ih&= ih < ih; ih8 ig7 ig6 ig: ie ie ie ie  ie ie io io io io io io iov ioh ioh ioZ ioR ioJ ioH ioF io@ io. io. io in in in in in in in in in in in in in in~ in| inz inx inr inl in> in$ in ig9 ig3 ig( ig/ ig2 ig1 ig+ ig0 ig- ig5 ig4 ig' ig& ig, ig. ig* ig) ig ig ig% ig$ ig ig# ig|" igp! ign ig^ igZ igP igH ig6 ig4 if if if if if if if if if if io if if if if if if if ifv ifl if` ifZ ifX ifR ifP ifL ifF if> if( if if  if ie ie ie ie ie ie ie| ies iee iea ieU ieU ieQ ieO ieF 7 7#r  3K) ossec11301iiNew FTP connection.Nov 17 15:30:21 hosting pure-ftpd: (?@195.184.76.102) [INFO] New connection from 195.184.76.102195.184.76.1026252001mq  -g) ossec13001iiExim Auth failed2025-11-17 15:31:07 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:58288: 535 Incorrect authentication data (set_id=contato)149.210.41.172390903xp  -{) ossec13001iiExim Auth failed2025-11-17 15:30:58 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:41001: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)158.181.132.861527747,o  e-) ossec9710iiDovecot Auth failed on disconnected session.Nov 17 15:30:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044jn  ;U% ossec13008iiMail Recipient rejected2025-11-17 15:30:35 H=(195.3.134.135) [179.0.178.53]:60466 F= rejected RCPT : Nenhuma pessoa no endereço.179.0.178.533469034m  W' ossec9708iiDovecot Aborted Login with empty userNov 17 15:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2tYSic5DKNCxV3kv>177.87.121.473469034nl  -i' ossec13001iiExim Auth failed2025-11-17 15:29:52 dovecot_login authenticator failed for ([212.3.154.183]) [212.3.154.183]:51956: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)212.3.154.1832017370Yk  -?' ossec13001iiExim Auth failed2025-11-17 15:29:35 dovecot_login authenticator failed for ([79.135.236.42]) [79.135.236.42]:54000: 535 Incorrect authentication data (set_id=financeiro)79.135.236.422017370Wj  -=% ossec13001iiExim Auth failed2025-11-17 15:30:05 dovecot_login authenticator failed for ([221.2.153.49]) [221.2.153.49]:53419: 535 Incorrect authentication data (set_id=alex.vendas)221.2.153.491814991ki  -_+ ossec13001iiExim Auth failed2025-11-17 15:29:40 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59228: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651h  k' ossec9709iiMultiple Dovecot Aborted Logins with empty userNov 17 15:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lg  -g% ossec13001ii}Exim Auth failed2025-11-17 15:29:15 dovecot_login authenticator failed for ([59.10.56.129]) [59.10.56.129]:36923: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)59.10.56.12918358410f  e3+ ossec9710iiUDovecot Auth failed on disconnected session.Nov 17 15:28:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<+53dg85DVodns7yS>103.179.188.1461562822de  -Q+ ossec13001ii}Exim Auth failed2025-11-17 15:29:16 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:49464: 535 Incorrect authentication data (set_id=administrativo1)211.198.128.12418358414d  eC# ossec9710iiuDovecot Auth failed on disconnected session.Nov 17 15:29:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991zc  -}+ ossec13001iieExim Auth failed2025-11-17 15:28:52 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:52496: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)196.216.220.2102403846  8 m  S=+ ossec11000ijkLogin failed on the cpanel service.[2025-11-17 15:33:15 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect124.198.131.1076252001|  -+ ossec13001ijExim Auth failed2025-11-17 15:31:32 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.123]:55560: 535 Incorrect authentication data (set_id=andressa.financeiro)116.193.128.1231269750Y  -=) ossec13001ijExim Auth failed2025-11-17 15:31:32 dovecot_login authenticator failed for ([222.175.187.214]) [218.59.235.170]:53058: 535 Incorrect authentication data (set_id=cpfnc2)218.59.235.1701814991~ W' ossec9708ijDovecot Aborted Login with empty userNov 17 15:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}  -=% ossec13001iiExim Auth failed2025-11-17 15:31:16 dovecot_login authenticator failed for node-9w6.pool-125-25.dynamic.nt-isp.net ([183.89.250.247]) [125.25.50.22]:51083: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)125.25.50.2216056511|  e5+ ossec9710ij#Dovecot Auth failed on disconnected session.Nov 17 15:32:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822`{  -I+ ossec13001ijExim Auth failed2025-11-17 15:31:29 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:35551: 535 Incorrect authentication data (set_id=fabio.vendas)186.238.247.23834690345z  eA' ossec9710ijDovecot Auth failed on disconnected session.Nov 17 15:31:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822(y U3' ossec11001iiDeferred login on the cpanel service[2025-11-17 15:31:24 -0300] info [webmaild] 189.63.42.143 - diretoria@eaglebpo.com.br "GET /cpsess6120534665/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.63.42.1433469034 x  3G' ossec11301iiNew FTP connection.Nov 17 15:30:22 hosting pure-ftpd: (?@195.184.76.96) [INFO] New connection from 195.184.76.96195.184.76.966252001gw  -[' ossec13001iiExim Auth failed2025-11-17 15:31:12 dovecot_login authenticator failed for 110-25-109-53.adsl.fetnet.net [110.25.109.53]:51151: 535 Incorrect authentication data (set_id=fabio.vendas)110.25.109.531668284sv  -u% ossec13001iiExim Auth failed2025-11-17 15:30:58 dovecot_login authenticator failed for ([14.40.114.86]) [14.40.114.86]:38818: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)14.40.114.861835841, method=PLAIN, rip=103.18.166.131, lip=200.150.196.245, TLS, session=<3q3uis5DF7lnEqaD>103.18.166.1311269750dt  -U' ossec13001iiExim Auth failed2025-11-17 15:30:37 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:38558: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)182.95.57.1581269750s W' ossec9708iiDovecot Aborted Login with empty userNov 17 15:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 U yb1<"?1UX  -?% ossec13001ijExim Auth failed2025-11-17 15:34:22 dovecot_login authenticator failed for ([182.78.107.6]) [182.78.107.6]:46220: 535 Incorrect authentication data (set_id=fabio.vendas)182.78.107.61269750[  -C' ossec13001ijExim Auth failed2025-11-17 15:34:08 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:60880: 535 Incorrect authentication data (set_id=fabio.vendas)125.20.224.101269750+  e-' ossec9710ijDovecot Auth failed on disconnected session.Nov 17 15:33:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084_  -G+ ossec13001ijExim Auth failed2025-11-17 15:33:46 dovecot_login authenticator failed for ([211.104.166.110]) [211.104.166.110]:35375: 535 Incorrect authentication data (set_id=escritura1)211.104.166.1101835841 W' ossec9708ij}Dovecot Aborted Login with empty userNov 17 15:33:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  -q% ossec13001ijoExim Auth failed2025-11-17 15:33:17 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:37446: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)38.226.118.03469034-  e/) ossec9710ijmDovecot Auth failed on disconnected session.Nov 17 15:33:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750  -1) ossec13001ijExim Auth failed2025-11-17 15:33:51 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:44168: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)182.70.122.2451269750  Ss) ossec11000ijLogin failed on the cpanel service.[2025-11-17 15:33:36 -0300] info [cpaneld] 152.42.163.119 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password152.42.163.1191880251-  e/) ossec9710ijkDovecot Auth failed on disconnected session.Nov 17 15:33:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387  W' ossec9708ij_Dovecot Aborted Login with empty userNov 17 15:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034R  -3% ossec13001ij[Exim Auth failed2025-11-17 15:32:59 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:38984: 535 Incorrect authentication data (set_id=xavier)41.231.85.7524644613  e?% ossec9710ijWDovecot Auth failed on disconnected session.Nov 17 15:32:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382~  - % ossec13001ijOExim Auth failed2025-11-17 15:32:46 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:44260: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)34.146.248.71861060  k' ossec9709ijAMultiple Dovecot Aborted Logins with empty userNov 17 15:32:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 ~     'Jm]~[  -G% ossec13001ik1Exim Auth failed2025-11-17 15:36:33 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:48790: 535 Incorrect authentication data (set_id=envios)77.85.43.156732800   e# ossec9710ik+Dovecot Auth failed on disconnected session.Nov 17 15:36:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001h  -]' ossec13001ikExim Auth failed2025-11-17 15:36:06 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:57077: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)15.218.135.586252001Y  -=) ossec13001ikExim Auth failed2025-11-17 15:36:05 dovecot_login authenticator failed for ([39.152.138.178]) [39.152.138.178]:41268: 535 Incorrect authentication data (set_id=eduardo)39.152.138.1781814991Y  -C' ossec13001ik Exim Auth failed2025-11-17 15:35:54 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:43027: 535 Incorrect authentication data (set_id=fabio.vendas)65.20.251.17099237\  -E' ossec13001ikExim Auth failed2025-11-17 15:35:49 dovecot_login authenticator failed for (ADMIN) [187.45.103.11]:57418: 535 Incorrect authentication data (set_id=comercial@inovasite.com)187.45.103.113469034  - ' ossec13001ijExim Auth failed2025-11-17 15:35:29 dovecot_login authenticator failed for (223-25-94-211.myrepublic.com.sg) [223.25.94.211]:63942: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)223.25.94.2111880251 -% ossec13001ijExim Auth failed2025-11-17 15:35:23 dovecot_login authenticator failed for host86-128-93-57.range86-128.btcentralplus.com [86.128.93.57]:39574: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)86.128.93.572635167k  -a+ ossec13001ikExim Auth failed2025-11-17 15:36:14 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:47282: 535 Incorrect authentication data (set_id=envios@comercial.art.br)178.250.191.189458258  W' ossec9708ikDovecot Aborted Login with empty userNov 17 15:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1g6Jns5DBOuxV3kv>177.87.121.473469034y  -}) ossec13001ijExim Auth failed2025-11-17 15:35:37 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:58704: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)121.202.198.981819730[  -?+ ossec13001ijExim Auth failed2025-11-17 15:35:34 dovecot_login authenticator failed for ([221.231.107.174]) [221.231.107.174]:4516: 535 Incorrect authentication data (set_id=contato)221.231.107.1741814991  k' ossec9709ijMultiple Dovecot Aborted Logins with empty userNov 17 15:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+nDFnM5D3NqxV3kv>177.87.121.473469034U  -7' ossec13001ijExim Auth failed2025-11-17 15:34:55 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:35952: 535 Incorrect authentication data (set_id=xavier)182.95.115.381269750n  -g) ossec13001ijExim Auth failed2025-11-17 15:34:32 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:55512: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)103.251.31.1661269750 W' ossec9708ijDovecot Aborted Login with empty userNov 17 15:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 '2 U o U u [jt~J7/  eE' ossec9710ikDovecot Auth failed on disconnected session.Nov 17 15:39:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084(.  e'' ossec9710ikDovecot Auth failed on disconnected session.Nov 17 15:38:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<1D61qM5DDK0kMrBu>36.50.176.11015628220-  e7' ossec9710ikDovecot Auth failed on disconnected session.Nov 17 15:38:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991,  k' ossec9709ikMultiple Dovecot Aborted Logins with empty userNov 17 15:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l+  -e) ossec13001ikExim Auth failed2025-11-17 15:37:50 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:46419: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)109.100.41.198798549_*  -K' ossec13001ikaExim Auth failed2025-11-17 15:37:20 dovecot_login authenticator failed for ([182.76.86.130]) [182.76.86.130]:57318: 535 Incorrect authentication data (set_id=andre.nascimento)182.76.86.1301269750r)  -q' ossec13001ikExim Auth failed2025-11-17 15:38:09 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:48100: 535 Incorrect authentication data (set_id=ieqcampocomprido)49.249.76.2211269750m(  -e+ ossec13001ikExim Auth failed2025-11-17 15:38:13 dovecot_login authenticator failed for (ADMIN) [217.199.146.204]:56350: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)217.199.146.204192950' W' ossec9708ikmDovecot Aborted Login with empty userNov 17 15:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\&  -A+ ossec13001ikOExim Auth failed2025-11-17 15:37:03 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:50683: 535 Incorrect authentication data (set_id=contato)121.142.146.1671835841% W' ossec9708ik1Dovecot Aborted Login with empty userNov 17 15:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0apZoM5DqpqxV3kv>177.87.121.473469034b$  -O) ossec13001ik/Exim Auth failed2025-11-17 15:36:31 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:47130: 535 Incorrect authentication data (set_id=andre.nascimento)111.26.106.1191814991Y#  -=) ossec13001ik'Exim Auth failed2025-11-17 15:36:22 dovecot_login authenticator failed for ([120.157.237.93]) [120.157.237.93]:35684: 535 Incorrect authentication data (set_id=eduardo)120.157.237.932077456q"  -k+ ossec13001ikAExim Auth failed2025-11-17 15:36:48 dovecot_login authenticator failed for ([110.185.173.167]) [110.185.173.167]:36284: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)110.185.173.1671814991U!  -7' ossec13001ik3Exim Auth failed2025-11-17 15:36:34 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:52986: 535 Incorrect authentication data (set_id=cpanel)121.73.162.152186224  UqRu6.=  e1) ossec9710il[Dovecot Auth failed on disconnected session.Nov 17 15:41:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841< W' ossec9708il!Dovecot Aborted Login with empty userNov 17 15:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-;  e5# ossec9710ilKDovecot Auth failed on disconnected session.Nov 17 15:41:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001;:  eI+ ossec9710ilKDovecot Auth failed on disconnected session.Nov 17 15:41:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001Y9  -=) ossec13001ilAExim Auth failed2025-11-17 15:41:04 dovecot_login authenticator failed for ([111.26.106.117]) [111.26.106.117]:37718: 535 Incorrect authentication data (set_id=contato)111.26.106.1171814991,8  e++ ossec9710il?Dovecot Auth failed on disconnected session.Nov 17 15:41:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841k7  -c' ossec13001il-Exim Auth failed2025-11-17 15:40:44 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:56595: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)124.228.32.341814991`6  -Q# ossec13001ikExim Auth failed2025-11-17 15:39:52 dovecot_login authenticator failed for ([58.17.128.7]) [58.17.128.7]:35120: 535 Incorrect authentication data (set_id=envios@comercial.art.br)58.17.128.71814991*5  e'+ ossec9710ikDovecot Auth failed on disconnected session.Nov 17 15:39:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.11915628224 W' ossec9708ikDovecot Aborted Login with empty userNov 17 15:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903453  e?) ossec9710il Dovecot Auth failed on disconnected session.Nov 17 15:40:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084b2  -O) ossec13001ilExim Auth failed2025-11-17 15:40:05 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:47236: 535 Incorrect authentication data (set_id=envios)197.219.210.861036973'1  e)# ossec9710ikDovecot Auth failed on disconnected session.Nov 17 15:39:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.5318149910  W' ossec9708ikDovecot Aborted Login with empty userNov 17 15:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 v jPvVL  -9' ossec13001ilExim Auth failed2025-11-17 15:43:40 dovecot_login authenticator failed for ([121.137.93.14]) [121.137.93.14]:34625: 535 Incorrect authentication data (set_id=contato)121.137.93.141835841K W' ossec9708ilDovecot Aborted Login with empty userNov 17 15:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.J  e/+ ossec9710ilDovecot Auth failed on disconnected session.Nov 17 15:42:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822 I  -+ ossec13001ilExim Auth failed2025-11-17 15:42:27 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:55010: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)182.239.109.2081819730rH  -o) ossec13001ilExim Auth failed2025-11-17 15:43:15 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:52991: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)109.207.33.2486290252*G  e+' ossec9710ilDovecot Auth failed on disconnected session.Nov 17 15:42:42 hosting dovecot: pop3-login: Disconnected: Inactivity (user disabled): user=, method=PLAIN, rip=14.103.168.32, lip=200.150.196.245, session=14.103.168.321814991YF  -=) ossec13001ilExim Auth failed2025-11-17 15:42:41 dovecot_login authenticator failed for ([83.220.255.230]) [83.220.255.230]:37775: 535 Incorrect authentication data (set_id=contato)83.220.255.2302017370E W' ossec9708ilDovecot Aborted Login with empty userNov 17 15:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034D  -) ossec13001ilExim Auth failed2025-11-17 15:42:57 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:38930: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)175.180.129.871668284.C  e1) ossec9710ilDovecot Auth failed on disconnected session.Nov 17 15:42:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750[B  -?+ ossec13001ilExim Auth failed2025-11-17 15:43:10 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:53595: 535 Incorrect authentication data (set_id=bianca)103.194.243.1871269750pA  -o' ossec13001ilmExim Auth failed2025-11-17 15:41:48 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:51346: 535 Incorrect authentication data (set_id=vendas.dilson@maringasoldas.com.br)45.82.110.150660013o@  -k' ossec13001ilExim Auth failed2025-11-17 15:42:13 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:32984: 535 Incorrect authentication data (set_id=vendas.dilson)123.194.136.31668284?  W' ossec9708il{Dovecot Aborted Login with empty userNov 17 15:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+zkGtM5DGOSxV3kv>177.87.121.473469034>  k' ossec9709il]Multiple Dovecot Aborted Logins with empty userNov 17 15:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 5 {O5[ W' ossec9708imDovecot Aborted Login with empty userNov 17 15:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(Z  e#+ ossec9710imDovecot Auth failed on disconnected session.Nov 17 15:46:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.20418358414Y  e;+ ossec9710imDovecot Auth failed on disconnected session.Nov 17 15:46:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822gX  -Y) ossec13001imExim Auth failed2025-11-17 15:46:25 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:38304: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)128.185.253.981269750{W  -' ossec13001imzExim Auth failed2025-11-17 15:46:16 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:42884: 535 Incorrect authentication data (set_id=paulo.user.finance)189.56.202.863469034zV  -) ossec13001imExim Auth failed2025-11-17 15:47:11 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:35544: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)88.248.250.143298795U W' ossec9708imNDovecot Aborted Login with empty userNov 17 15:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -' ossec13001imjExim Auth failed2025-11-17 15:46:01 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:48530: 535 Incorrect authentication data (set_id=paulo.user.finance@louvoreterno.com.br)177.207.248.53469034dS  -Q+ ossec13001imXExim Auth failed2025-11-17 15:45:43 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:60226: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651sR  -s' ossec13001imVExim Auth failed2025-11-17 15:45:40 dovecot_login authenticator failed for (182.239.78.55.hk.chinamobile.com) [182.239.78.55]:44932: 535 Incorrect authentication data (set_id=bianca.user.finance)182.239.78.551819730Q Su' ossec11000imNLogin failed on the cpanel service.[2025-11-17 15:45:33 -0300] info [cpaneld] 103.55.146.14 - bonfitne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bonfitne (has_cpuser_file failed)103.55.146.141210997 P  -!) ossec13001im0Exim Auth failed2025-11-17 15:45:03 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:42569: 535 Incorrect authentication data (set_id=bianca.user.finance@globalmedica.com.br)187.40.215.1623469034O  W' ossec9708im0Dovecot Aborted Login with empty userNov 17 15:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 N  S% ossec11000imLogin failed on the cpanel service.[2025-11-17 15:44:44 -0300] info [cpaneld] 157.66.54.66 - adportobelo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adportobelo (has_cpuser_file failed)157.66.54.661643084M  k' ossec9709imMultiple Dovecot Aborted Logins with empty userNov 17 15:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  3 ij  -_' ossec13001in~Exim Auth failed2025-11-17 15:50:37 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:41206: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)182.78.111.341269750oi  -i) ossec13001inExim Auth failed2025-11-17 15:51:01 dovecot_login authenticator failed for ([121.73.162.213]) [121.73.162.213]:54714: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)121.73.162.2132186224sh  -o+ ossec13001in|Exim Auth failed2025-11-17 15:50:36 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:49303: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)207.200.180.1746252001jg  -c% ossec13001inrExim Auth failed2025-11-17 15:50:25 dovecot_login authenticator failed for ([162.243.8.74]) [162.243.8.74]:54254: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)162.243.8.746252001f W' ossec9708in>Dovecot Aborted Login with empty userNov 17 15:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ne  -g) ossec13001inExim Auth failed2025-11-17 15:48:36 dovecot_login authenticator failed for ([222.175.187.214]) [218.59.235.170]:36874: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)218.59.235.1701814991d W' ossec9708inDovecot Aborted Login with empty userNov 17 15:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,c  e/' ossec9710imDovecot Auth failed on disconnected session.Nov 17 15:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991#b  e) ossec9710in$Dovecot Auth failed on disconnected session.Nov 17 15:49:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387Ta  -7% ossec13001inExim Auth failed2025-11-17 15:49:00 dovecot_login authenticator failed for ([14.55.31.157]) [14.55.31.157]:59014: 535 Incorrect authentication data (set_id=juridico)14.55.31.1571835841]`  -G) ossec13001inExim Auth failed2025-11-17 15:48:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:57684: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549n_  -i' ossec13001imExim Auth failed2025-11-17 15:47:27 dovecot_login authenticator failed for broadband-188-32-79-237.ip.moscow.rt.ru [188.32.79.237]:36454: 535 Incorrect authentication data (set_id=novamanha)188.32.79.2372017370^  W' ossec9708imDovecot Aborted Login with empty userNov 17 15:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  k' ossec9709imMultiple Dovecot Aborted Logins with empty userNov 17 15:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<63ysx85DBLmxV3kv>177.87.121.473469034b\  -O) ossec13001imExim Auth failed2025-11-17 15:46:49 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:51164: 535 Incorrect authentication data (set_id=eliezer)188.81.132.1142264397  $ 2 X 0  y  - ) ossec13001inExim Auth failed2025-11-17 15:52:20 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:35826: 535 Incorrect authentication data (set_id=comercial.user.finance@inovasite.com)179.185.29.2333469034gx  -]' ossec13001ioExim Auth failed2025-11-17 15:52:56 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:52014: 535 Incorrect authentication data (set_id=adriana)78.188.102.28298795ew  -W' ossec13001inExim Auth failed2025-11-17 15:52:35 dovecot_login authenticator failed for ([172.81.45.147]) [172.81.45.147]:47725: 535 Incorrect authentication data (set_id=comercial.user.finance)172.81.45.1476252001v  - + ossec13001inExim Auth failed2025-11-17 15:52:35 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54497: 535 Incorrect authentication data (set_id=alex.vendas)122.166.253.2261269750u W' ossec9708inDovecot Aborted Login with empty userNov 17 15:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034rt  -s' ossec13001inExim Auth failed2025-11-17 15:52:28 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:58564: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)91.239.23.149458258s W' ossec9708inDovecot Aborted Login with empty userNov 17 15:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Sr  -5% ossec13001inExim Auth failed2025-11-17 15:51:30 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:34793: 535 Incorrect authentication data (set_id=eliezer)187.12.48.703469034q  k' ossec9709inzMultiple Dovecot Aborted Logins with empty userNov 17 15:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034"p  e' ossec9710inxDovecot Auth failed on disconnected session.Nov 17 15:50:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991$o  e!' ossec9710inlDovecot Auth failed on disconnected session.Nov 17 15:50:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758Vn  -9' ossec13001inExim Auth failed2025-11-17 15:51:13 dovecot_login authenticator failed for ([95.220.33.115]) [95.220.33.115]:56384: 535 Incorrect authentication data (set_id=contato)95.220.33.1152017370Um  -7' ossec13001inExim Auth failed2025-11-17 15:51:11 dovecot_login authenticator failed for ([111.57.17.171]) [111.57.17.171]:42214: 535 Incorrect authentication data (set_id=rafael)111.57.17.1711814991l  W' ossec9708inDovecot Aborted Login with empty userNov 17 15:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+Uw01M5DHr2xV3kv>177.87.121.473469034Xk  -?% ossec13001inExim Auth failed2025-11-17 15:50:39 dovecot_login authenticator failed for ([218.13.47.83]) [218.13.47.83]:58396: 535 Incorrect authentication data (set_id=misterthomas)218.13.47.831814991    -) ossec13001ioZExim Auth failed2025-11-17 15:54:17 dovecot_login authenticator failed for (209.66.120.237.IDIA-404706-ZYO.zip.zayo.com) [209.66.120.237]:40611: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)209.66.120.2376252001*  e+' ossec9710ioDovecot Auth failed on disconnected session.Nov 17 15:55:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841S  -5% ossec13001ioExim Auth failed2025-11-17 15:55:01 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:49754: 535 Incorrect authentication data (set_id=contato)59.27.93.1381835841(  e#+ ossec9710ioDovecot Auth failed on disconnected session.Nov 17 15:55:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001y  -}) ossec13001ioExim Auth failed2025-11-17 15:55:08 dovecot_login authenticator failed for ([191.59.155.179]) [191.59.155.179]:56668: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)191.59.155.1793469034a  -O' ossec13001ioExim Auth failed2025-11-17 15:55:06 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62692: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730S  -7# ossec13001ioExim Auth failed2025-11-17 15:54:59 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:52888: 535 Incorrect authentication data (set_id=financeiro)1.180.62.411814991  W' ossec9708ioJDovecot Aborted Login with empty userNov 17 15:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -I' ossec13001ioHExim Auth failed2025-11-17 15:54:00 dovecot_login authenticator failed for ([112.6.127.244]) [112.6.127.244]:50987: 535 Incorrect authentication data (set_id=administrativo1)112.6.127.2441814991u  -w' ossec13001ioFExim Auth failed2025-11-17 15:53:57 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:46120: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)46.212.39.2013144096)~  e') ossec9710io@Dovecot Auth failed on disconnected session.Nov 17 15:53:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387w}  -y) ossec13001io.Exim Auth failed2025-11-17 15:53:34 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:46490: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)83.239.171.2262017370|  k' ossec9709io.Multiple Dovecot Aborted Logins with empty userNov 17 15:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+vki3c5DRKOxV3kv>177.87.121.473469034e{  U/' ossec11001ioRDeferred login on the cpanel service[2025-11-17 15:54:08 -0300] info [webmaild] 200.66.118.88 - vendas@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing200.66.118.883469034z  - ) ossec13001inExim Auth failed2025-11-17 15:52:22 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:35714: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)118.103.253.481820814 =  , -%=d  -U' ossec13001ip7Exim Auth failed2025-11-17 15:57:57 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:42961: 535 Incorrect authentication data (set_id=fabio.vendas)177.19.165.903469034k  -_+ ossec13001ip/Exim Auth failed2025-11-17 15:57:49 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50291: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651  W' ossec9708ioDovecot Aborted Login with empty userNov 17 15:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001ioExim Auth failed2025-11-17 15:56:38 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:46626: 535 Incorrect authentication data (set_id=rafael)195.222.57.1903277605  k' ossec9709ioMultiple Dovecot Aborted Logins with empty userNov 17 15:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i  -_' ossec13001ioExim Auth failed2025-11-17 15:56:23 dovecot_login authenticator failed for ([14.212.198.51]) [14.212.198.51]:51146: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)14.212.198.511814991Z  -C% ossec13001ioExim Auth failed2025-11-17 15:55:33 dovecot_login authenticator failed for ([183.6.115.88]) [183.6.115.88]:36229: 535 Incorrect authentication data (set_id=isabellylisboa)183.6.115.881814991 W' ossec9708ioDovecot Aborted Login with empty userNov 17 15:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7vRM5M5DvNixV3kv>177.87.121.473469034g  -]% ossec13001ioExim Auth failed2025-11-17 15:55:25 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:42938: 535 Incorrect authentication data (set_id=ferramentaria)5.128.123.342017370l  -c) ossec13001ioExim Auth failed2025-11-17 15:55:22 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:33846: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)103.140.18.1861269750w  -w+ ossec13001ioExim Auth failed2025-11-17 15:55:18 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:37218: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)218.149.235.15218358411  e;' ossec9710ioDovecot Auth failed on disconnected session.Nov 17 15:55:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758^  -G) ossec13001ioExim Auth failed2025-11-17 15:55:39 dovecot_login authenticator failed for ([202.108.14.226]) [202.108.14.225]:56068: 535 Incorrect authentication data (set_id=atualizacoes)202.108.14.2251814991  -+ ossec13001iovExim Auth failed2025-11-17 15:54:45 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:60480: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)166.130.176.1366252001Y  -?' ossec13001iohExim Auth failed2025-11-17 15:54:32 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:35834: 535 Incorrect authentication data (set_id=financeiro)121.73.162.152186224 W' ossec9708iohDovecot Aborted Login with empty userNov 17 15:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 M  ayAMp'  -m' ossec13001ipExim Auth failed2025-11-17 15:59:41 dovecot_login authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:49168: 535 Incorrect authentication data (set_id=presidencia)85.30.248.21320173704&  e=) ossec9710ipDovecot Auth failed on disconnected session.Nov 17 15:59:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044d%  -S) ossec13001ipExim Auth failed2025-11-17 15:59:45 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:39764: 535 Incorrect authentication data (set_id=contato)200.46.214.1103703430$  k' ossec9709ipMultiple Dovecot Aborted Logins with empty userNov 17 15:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#  W' ossec9708ipDovecot Aborted Login with empty userNov 17 16:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034" W' ossec9708ipYDovecot Aborted Login with empty userNov 17 15:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<38EA785D5saxV3kv>177.87.121.4734690342!  e7+ ossec9710ipWDovecot Auth failed on disconnected session.Nov 17 15:58:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001V  -9' ossec13001ipSExim Auth failed2025-11-17 15:58:26 dovecot_login authenticator failed for ([113.201.2.253]) [113.201.2.253]:31958: 535 Incorrect authentication data (set_id=contato)113.201.2.2531814991r  -o) ossec13001ip-Exim Auth failed2025-11-17 15:57:47 dovecot_login authenticator failed for ([188.247.59.158]) [188.247.59.158]:58864: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)188.247.59.1582017370/  e3) ossec9710ipDovecot Auth failed on disconnected session.Nov 17 15:57:33 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=190.223.53.234, lip=200.150.196.245, TLS, session=190.223.53.2343932488v  -w) ossec13001ip!Exim Auth failed2025-11-17 15:57:35 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:52276: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)116.98.104.1381562822 W' ossec9708ipDovecot Aborted Login with empty userNov 17 15:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g  -]% ossec13001ipGExim Auth failed2025-11-17 15:58:14 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:44974: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)60.166.8.1741814991f  -Y' ossec13001ipGExim Auth failed2025-11-17 15:58:13 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:55290: 535 Incorrect authentication data (set_id=contato)188.122.151.62661886#  e+ ossec9710ip9Dovecot Auth failed on disconnected session.Nov 17 15:58:00 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=180.222.166.212, lip=200.150.196.245, TLS, session=180.222.166.2122077456  a\k8Vun6  -e+ ossec13001iqExim Auth failed2025-11-17 16:01:37 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:37887: 535 Incorrect authentication data (set_id=contato)103.203.210.11912697505 W' ossec9708iq Dovecot Aborted Login with empty userNov 17 16:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y4  -C% ossec13001iqExim Auth failed2025-11-17 16:01:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56064: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758o3  -g+ ossec13001ipExim Auth failed2025-11-17 16:01:18 dovecot_login authenticator failed for ([123.235.187.158]) [123.235.187.158]:36452: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)123.235.187.1581814991]2  -E) ossec13001iq3Exim Auth failed2025-11-17 16:02:09 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:46234: 535 Incorrect authentication data (set_id=aureovieira)103.144.37.1021269750^1  -G) ossec13001iq%Exim Auth failed2025-11-17 16:01:55 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:62851: 535 Incorrect authentication data (set_id=atualizacoes)50.247.189.1896252001/0  e5' ossec9710iq+Dovecot Auth failed on disconnected session.Nov 17 16:02:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822m/  -k% ossec13001iqExim Auth failed2025-11-17 16:01:51 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:60065: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)89.67.37.219798544.  -' ossec13001iqExim Auth failed2025-11-17 16:01:24 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:46235: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)42.200.70.13418197309-  eG) ossec9710ipDovecot Auth failed on disconnected session.Nov 17 16:01:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<4dZh+M5DSoxA44h6>64.227.136.1221269750, W' ossec9708ipDovecot Aborted Login with empty userNov 17 16:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0c4n9s5DwqyxV3kv>177.87.121.473469034*+  e'+ ossec9710ipDovecot Auth failed on disconnected session.Nov 17 16:00:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991{*  -% ossec13001ipExim Auth failed2025-11-17 15:59:33 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:63056: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)92.189.80.732510769j)  -c% ossec13001ipExim Auth failed2025-11-17 15:59:19 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:60606: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)217.33.89.472635167)(  e') ossec9710ipDovecot Auth failed on disconnected session.Nov 17 15:59:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084   +.F  e/+ ossec9710iqDovecot Auth failed on disconnected session.Nov 17 16:03:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<31K0AM9DnONns7yS>103.179.188.1461562822ZE  -?) ossec13001iqExim Auth failed2025-11-17 16:03:28 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:54364: 535 Incorrect authentication data (set_id=eleicoes)192.34.128.2026252001VD  -;% ossec13001iqExim Auth failed2025-11-17 16:03:26 dovecot_login authenticator failed for ([151.2.166.30]) [151.2.166.30]:46726: 535 Incorrect authentication data (set_id=financeiro)151.2.166.302635167YC  -A' ossec13001iqyExim Auth failed2025-11-17 16:03:19 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:46238: 535 Incorrect authentication data (set_id=aureovieira)45.82.110.150660013 B  3G' ossec11301iqNew FTP connection.Nov 17 16:04:05 hosting pure-ftpd: (?@91.196.152.11) [INFO] New connection from 91.196.152.1191.196.152.113017382 A  3G' ossec11301iqNew FTP connection.Nov 17 16:04:04 hosting pure-ftpd: (?@91.196.152.15) [INFO] New connection from 91.196.152.1591.196.152.153017382@  k' ossec9709iqIMultiple Dovecot Aborted Logins with empty userNov 17 16:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g?  -_# ossec13001iq;Exim Auth failed2025-11-17 16:02:18 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:49123: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)187.8.64.943469034#>  e) ossec9710iq;Dovecot Auth failed on disconnected session.Nov 17 16:02:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841o=  -i) ossec13001iqqExim Auth failed2025-11-17 16:03:12 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:47104: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)152.52.236.1581269750h<  -[) ossec13001iqqExim Auth failed2025-11-17 16:03:12 dovecot_login authenticator failed for ([220.179.87.203]) [220.179.87.203]:55172: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)220.179.87.2031814991{;  -+ ossec13001iq[Exim Auth failed2025-11-17 16:02:50 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:33154: 535 Incorrect authentication data (set_id=ieqcampocomprido)122.187.227.1641269750):  U7' ossec11001iq[Deferred login on the cpanel service[2025-11-17 16:02:49 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034h9  -[) ossec13001iq[Exim Auth failed2025-11-17 16:02:50 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:45793: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)201.160.64.1183996063h8  -[) ossec13001iqQExim Auth failed2025-11-17 16:02:40 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:48458: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)172.191.74.15162520017  W' ossec9708iqgDovecot Aborted Login with empty userNov 17 16:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Ggg/85DnoexV3kv>177.87.121.473469034  upEOtU  -u' ossec13001iqExim Auth failed2025-11-17 16:05:29 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:31062: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)111.61.176.581814991yT  -}) ossec13001iqExim Auth failed2025-11-17 16:05:27 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:51421: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)210.219.232.341835841YS  -=) ossec13001irExim Auth failed2025-11-17 16:06:03 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:34311: 535 Incorrect authentication data (set_id=adriana)189.44.133.2383469034KR  -+ ossec13001irExim Auth failed2025-11-17 16:05:57 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:45503: 535 Incorrect authentication data211.198.128.1241835841rQ  -y! ossec13001irExim Auth failed2025-11-17 16:05:51 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:50678: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)89.67.37.2798544'P  e)# ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:05:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001O  k' ossec9709iqMultiple Dovecot Aborted Logins with empty userNov 17 16:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nN  -i' ossec13001iqExim Auth failed2025-11-17 16:05:30 dovecot_login authenticator failed for (186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:35190: 535 Incorrect authentication data (set_id=bruno)189.56.202.863469034lM  -c) ossec13001iqExim Auth failed2025-11-17 16:05:27 dovecot_login authenticator failed for ([186.235.248.73]) [186.235.248.73]:57714: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)186.235.248.733469034L W' ossec9708iqDovecot Aborted Login with empty userNov 17 16:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%K  e%# ossec9710iqDovecot Auth failed on disconnected session.Nov 17 16:04:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991J  -' ossec13001iqExim Auth failed2025-11-17 16:05:14 dovecot_login authenticator failed for host.46-183-135-88.broadband.redcom.ru [46.183.135.88]:44399: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)46.183.135.882017370+I  e-' ossec9710iqDovecot Auth failed on disconnected session.Nov 17 16:05:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<5JBZBs9D/J1SnOdL>82.156.231.751814991rH  -q' ossec13001iqExim Auth failed2025-11-17 16:05:01 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:43976: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)182.95.52.1221269750G W' ossec9708iqDovecot Aborted Login with empty userNov 17 16:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  &C  ! (  ld  -c) ossec13001ir)Exim Auth failed2025-11-17 16:06:17 dovecot_login authenticator failed for ([124.197.22.130]) [124.197.22.130]:45050: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)124.197.22.1301562822]c  -E) ossec13001ir[Exim Auth failed2025-11-17 16:07:06 dovecot_login authenticator failed for ([210.245.33.154]) [210.245.33.154]:57378: 535 Incorrect authentication data (set_id=aureovieira)210.245.33.1541562822hb  -[) ossec13001irKExim Auth failed2025-11-17 16:06:50 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:46906: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)221.224.133.981814991]a  -I% ossec13001ir=Exim Auth failed2025-11-17 16:06:37 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:47303: 535 Incorrect authentication data (set_id=info.user.finance)58.16.201.521814991`  -7) ossec13001ir;Exim Auth failed2025-11-17 16:06:35 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:36862: 535 Incorrect authentication data (set_id=andre.nascimento.finance@calcautomacao.com.br)203.174.182.382077456-_  e/) ossec9710ir9Dovecot Auth failed on disconnected session.Nov 17 16:06:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841r^  -u# ossec13001ir!Exim Auth failed2025-11-17 16:06:08 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:59308: 535 Incorrect authentication data (set_id=info.user.finance@lixadoracuritiba.com.br)39.74.74.441814991]  W' ossec9708irDovecot Aborted Login with empty userNov 17 16:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s\  -q) ossec13001iqExim Auth failed2025-11-17 16:05:34 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:60056: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)125.19.160.2061269750,[  e3# ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:05:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<+QAnCc9D2oAXXz9j>23.95.63.996252001uZ  -w) ossec13001irExim Auth failed2025-11-17 16:05:53 dovecot_login authenticator failed for ([196.219.93.108]) [196.219.93.108]:42602: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)196.219.93.108357994pY  -o% ossec13001irExim Auth failed2025-11-17 16:06:02 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:45983: 535 Incorrect authentication data (set_id=andre.nascimento)71.41.202.126252001*X U7' ossec11001ir Deferred login on the cpanel service[2025-11-17 16:05:49 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034_W  -I) ossec13001irExim Auth failed2025-11-17 16:05:42 dovecot_login authenticator failed for ([182.79.31.107]) [152.52.199.126]:50672: 535 Incorrect authentication data (set_id=isabellylisboa)152.52.199.1261269750VV  -9' ossec13001irExim Auth failed2025-11-17 16:05:40 dovecot_login authenticator failed for ([119.206.62.88]) [119.206.62.88]:33586: 535 Incorrect authentication data (set_id=compras)119.206.62.881835841  3 i8qr  -q% ossec13001isExim Auth failed2025-11-17 16:10:11 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:43756: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)78.81.209.7620173703q  e;) ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:09:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387p W' ossec9708irDovecot Aborted Login with empty userNov 17 16:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+5ZcFs9DFuyxV3kv>177.87.121.473469034o  k' ossec9709irMultiple Dovecot Aborted Logins with empty userNov 17 16:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4vHDEs9DJMqxV3kv>177.87.121.473469034-n  e/) ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:08:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044m  W' ossec9708irDovecot Aborted Login with empty userNov 17 16:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(l  e'' ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:08:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084k W' ossec9708iruDovecot Aborted Login with empty userNov 17 16:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342j  e=% ossec9710irmDovecot Auth failed on disconnected session.Nov 17 16:07:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.24316056511i  e=# ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:08:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991Sh  -5% ossec13001ir=Exim Auth failed2025-11-17 16:06:36 dovecot_login authenticator failed for ([88.86.221.69]) [88.86.221.69]:59108: 535 Incorrect authentication data (set_id=compras)88.86.221.692017370pg  -m' ossec13001ir+Exim Auth failed2025-11-17 16:06:18 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:60334: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)218.78.112.811814991df  -W% ossec13001irMExim Auth failed2025-11-17 16:06:53 dovecot_login authenticator failed for ([192.72.6.162]) [192.72.6.162]:48003: 535 Incorrect authentication data (set_id=andre.nascimento.finance)192.72.6.1621668284e W' ossec9708ir9Dovecot Aborted Login with empty userNov 17 16:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 h~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 ~ 3469034 | 3469034 t 3469034 q 3469034 l 3469034 h 3469034 d 3469034 c 3469034 Y 3469034 U 3469034 N 3469034 M 3469034 L 3469034 J 3469034 9 3469034 6 3469034 4 3469034 / 3469034 ) 3469034 3469034  3469034  3469034  3469034 3469034  3469034  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 ~ 3469034 { 3469034 w 3469034 v 3469034 u 3469034 t 3469034 r 3469034 o 3469034 j 3469034 h 3469034 d 3469034 b 3469034 [ 3469034 X 3469034 V 3469034 I 3469034 B 3469034 < 3469034 4 3469034 + 3469034 $ 3469034  3469034  3469034  3469034  3469034 3469034 3469034  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 { 3469034 u 3469034 o 3469034 h 3469034 ` 3469034 _ 3469034 ^ 3469034 [ 3469034 Y 3469034 O 3469034 M 3469034 K 3469034 @ 3469034 = 3469034 8 3469034 1 3469034 . 3469034 + 3469034 & 3469034 % 3469034  3469034  3469034  3469034  3469034  3469034  3469034  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034| 3469034v 3469034u 3469034s 3469034r 3469034j 3469034i 3469034g 3469034c 3469034] 3469034W 3469034Q 3469034M 3469034H 3469034F 3469034@ 34690349 34690343 34690342 34690340 3469034, 3469034# 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 g g W' ossec9708isDovecot Aborted Login with empty userNov 17 16:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<88WuJM9DlpCxV3kv>177.87.121.473469034  k' ossec9709isfMultiple Dovecot Aborted Logins with empty userNov 17 16:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034- U?% ossec11001is`Deferred login on the cpanel service[2025-11-17 16:11:26 -0300] info [webmaild] 189.40.71.27 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.40.71.273469034p~  -k) ossec13001isExim Auth failed2025-11-17 16:12:15 dovecot_login authenticator failed for ([47.98.191.121]) [115.197.198.89]:50668: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)115.197.198.891814991}  W' ossec9708isDovecot Aborted Login with empty userNov 17 16:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d|  -U' ossec13001is|Exim Auth failed2025-11-17 16:11:54 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:50542: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)222.104.76.941835841{{  -) ossec13001is)Exim Auth failed2025-11-17 16:10:33 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:49775: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)124.170.26.1692077456[z  -E% ossec13001is#Exim Auth failed2025-11-17 16:10:26 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:40122: 535 Incorrect authentication data (set_id=administrativo1)111.26.67.361814991vy  -w) ossec13001isAExim Auth failed2025-11-17 16:10:56 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:58782: 535 Incorrect authentication data (set_id=junior.gomes)37.235.140.1632017370,x  U?% ossec11001is-Deferred login on the cpanel service[2025-11-17 16:10:36 -0300] info [webmaild] 189.40.71.27 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.40.71.273469034w W' ossec9708is)Dovecot Aborted Login with empty userNov 17 16:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vv  -;% ossec13001isHExim Auth failed2025-11-17 16:11:03 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:36068: 535 Incorrect authentication data (set_id=financeiro)36.50.167.811269750qu  -m) ossec13001is3Exim Auth failed2025-11-17 16:10:42 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:42378: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)122.184.124.461269750 t  -+ ossec13001is/Exim Auth failed2025-11-17 16:10:39 dovecot_login authenticator failed for (nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:55166: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)122.187.230.11612697502s  e7+ ossec9710irDovecot Auth failed on disconnected session.Nov 17 16:09:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 k'4 zk5  eA' ossec9710it^Dovecot Auth failed on disconnected session.Nov 17 16:15:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822R  -3% ossec13001itZExim Auth failed2025-11-17 16:15:36 dovecot_login authenticator failed for ([111.26.63.84]) [111.26.63.85]:47712: 535 Incorrect authentication data (set_id=igreja)111.26.63.851814991 W' ossec9708itVDovecot Aborted Login with empty userNov 17 16:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708it8Dovecot Aborted Login with empty userNov 17 16:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#  e!# ossec9710itDovecot Auth failed on disconnected session.Nov 17 16:14:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001o  -i) ossec13001itExim Auth failed2025-11-17 16:14:25 dovecot_login authenticator failed for ([188.247.59.158]) [188.247.59.158]:40120: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)188.247.59.1582017370,  e-) ossec9710it(Dovecot Auth failed on disconnected session.Nov 17 16:14:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750U  -7' ossec13001it&Exim Auth failed2025-11-17 16:14:45 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:56080: 535 Incorrect authentication data (set_id=xavier)61.133.10.2041814991e  -S+ ossec13001it$Exim Auth failed2025-11-17 16:14:42 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56436: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651\  -E' ossec13001itExim Auth failed2025-11-17 16:14:36 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:53070: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001  k' ossec9709itMultiple Dovecot Aborted Logins with empty userNov 17 16:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034;  eM) ossec9710itDovecot Auth failed on disconnected session.Nov 17 16:14:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=37.221.142.123, lip=200.150.196.245, TLS, session=37.221.142.1236907915  eC% ossec9710itDovecot Auth failed on disconnected session.Nov 17 16:14:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382o  -m% ossec13001isExim Auth failed2025-11-17 16:13:10 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:53540: 535 Incorrect authentication data (set_id=vendas@arkson.com.br)111.70.3.1221668284U  -7' ossec13001isExim Auth failed2025-11-17 16:13:52 dovecot_login authenticator failed for ([178.206.226.8]) [178.206.226.8]:54734: 535 Incorrect authentication data (set_id=vendas)178.206.226.82017370 z*4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    R z p f \ H  > 4 *  lbv&XND:0|rh^TJ"@6,x2(nZPFd< j~`tV.$LB8zp4f\RH> | r h ^ T J @ 6 , "    x n d Z Pz*  vlbXND:0& ixs ix ix ix ix} ixy ix[ ixU ixS ixQ ixA ixo ixk ixe ix_ ixA ix ix ix ix ix  iw iw iw iw iw iw iw iw iw iw iw iw iw iw iw iw iw iw{ iwQ iwn iwk iwa iw] iwU iwM iwI iw{ iw$ iw iw iw iw= iw5 iw3 iw1 iw9 iw$ iv iv iw iw iw iv iv iv iv ivb iv\ ivp ivp ivR iv4 iv( iv$ iv ivT ivL iv@ iv iu iu iu iu iu iu iu iu iu iu iu iu iu0 iu, iu, iuD iu: iu iu  iu it it iu& iu iu  iu it it it it it it it it it it it it it it it it it~ itD itt itp itn it^ itZ itV it8 it it( it& it$ it it it it it is is is is~ is} is|| isf is` isHv isAy is3u is/t is-x is){ is)w is#z isr irq irp irs irm iro irn iri irl iruk irmj ir[c irMf irKb ir=h ir=a ir;` ir9e io io io io io io io io iy? iy0 iy/ iy3 iy5 iy. iy2 iy1 iy4 iy) iy- iy}, iy{+ iym* iy[( iyK' iyI& iyI$ iyA# iy;% iy7" iy-! iy% iy# iy! iy! iy iy  iy ix ix ix ix ix ix ix ix ix ix ir9_ ir+g ir)d ir!^ ir] irY irS irR ir[ irZ irQ ir X irW irV irP iq\ iqO iqN iqU iqT iqM iqJ iqI iqH iqL iqK iqB iqA iqG iqF iqE iqD iqyC iqq= iqq< iqg7 iq[; iq[: iq[9 iqQ8 iqI@ iq;?( iy: iq;> iq32 iq+0 iq%1 iq/ iq6 iq 5 iq. iq4 ip3 ip- ip, ip+ ip# ip( ip% ip' ip& ip* ip$ ip) ipY" ipW! ipS ipG ipG ip9 ip7 ip/ ip- ip! ip ip io M  ; ; K1IU2LXi4Mc  -U' ossec13001itExim Auth failed2025-11-17 16:18:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:55415: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.42987951  e7) ossec9710itDovecot Auth failed on disconnected session.Nov 17 16:17:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387k  -a) ossec13001itExim Auth failed2025-11-17 16:17:21 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:64600: 535 Incorrect authentication data (set_id=adriana)116.48.150.1151819730p  -o% ossec13001itExim Auth failed2025-11-17 16:17:09 dovecot_login authenticator failed for ([95.79.108.51]) [95.79.108.51]:46065: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)95.79.108.512017370b  -S% ossec13001itExim Auth failed2025-11-17 16:17:51 dovecot_login authenticator failed for (170-83-41-60.swtelecom.com.br) [170.83.41.60]:42835: 535 Incorrect authentication data (set_id=contato)170.83.41.603469034  k' ossec9709itMultiple Dovecot Aborted Logins with empty userNov 17 16:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p  -k) ossec13001itExim Auth failed2025-11-17 16:16:54 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:58754: 535 Incorrect authentication data (set_id=junior.gomes)179.125.169.773469034d  -Y# ossec13001itExim Auth failed2025-11-17 16:16:36 dovecot_login authenticator failed for 81.5.83.207.dhcp.mipt-telecom.ru [81.5.83.207]:52605: 535 Incorrect authentication data (set_id=marialuiza)81.5.83.2072017370 W' ossec9708itDovecot Aborted Login with empty userNov 17 16:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0mtiL89DJIKxV3kv>177.87.121.473469034l  -e' ossec13001itExim Auth failed2025-11-17 16:16:29 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:33228: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)182.95.49.1861269750|  -' ossec13001itExim Auth failed2025-11-17 16:16:23 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:51241: 535 Incorrect authentication data (set_id=marialuiza)201.61.40.1173469034O  -+' ossec13001it~Exim Auth failed2025-11-17 16:16:13 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:53038: 535 Incorrect authentication data152.231.25.643686110g  -]' ossec13001itDExim Auth failed2025-11-17 16:15:16 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:39412: 535 Incorrect authentication data (set_id=igreja@pibtrindade.com.br)31.135.26.217798544a  -Q% ossec13001ittExim Auth failed2025-11-17 16:16:03 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:39072: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)60.172.1.2101814991q  -m) ossec13001itpExim Auth failed2025-11-17 16:15:58 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:49222: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)46.229.128.2512017370)  e)' ossec9710itnDovecot Auth failed on disconnected session.Nov 17 16:15:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 (  )  .&S('/  e%' ossec9710iu:Dovecot Auth failed on disconnected session.Nov 17 16:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822O.  -/# ossec13001iuExim Auth failed2025-11-17 16:18:45 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:41552: 535 Incorrect authentication data (set_id=gerson)46.8.246.272017370j-  -a' ossec13001iu Exim Auth failed2025-11-17 16:18:33 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:59290: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)95.220.47.2422017370, W' ossec9708iuDovecot Aborted Login with empty userNov 17 16:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f+  -Y' ossec13001itExim Auth failed2025-11-17 16:18:22 dovecot_login authenticator failed for ([120.224.15.67]) [120.224.15.67]:15306: 535 Incorrect authentication data (set_id=envios@comercial.art.br)120.224.15.671814991e*  -W' ossec13001itExim Auth failed2025-11-17 16:18:11 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:50950: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)182.95.59.1541269750)  e # ossec9710iu&Dovecot Auth failed on disconnected session.Nov 17 16:19:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=31.222.12.8, lip=200.150.196.245, TLS, session=31.222.12.8798544V(  -9' ossec13001iuExim Auth failed2025-11-17 16:18:39 dovecot_login authenticator failed for ([183.220.65.21]) [183.220.65.21]:51070: 535 Incorrect authentication data (set_id=contato)183.220.65.211814991X'  -;) ossec13001iu Exim Auth failed2025-11-17 16:18:35 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:59555: 535 Incorrect authentication data (set_id=envios)189.44.133.2383469034*&  e-% ossec9710iuDovecot Auth failed on disconnected session.Nov 17 16:18:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=41.76.80.113, lip=200.150.196.245, TLS, session=<+6ZqNc9D1pIpTFBx>41.76.80.1132328926$%  e## ossec9710itDovecot Auth failed on disconnected session.Nov 17 16:18:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991o$  -g+ ossec13001itExim Auth failed2025-11-17 16:17:40 dovecot_login authenticator failed for ([114.216.225.109]) [114.216.225.109]:2530: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)114.216.225.1091814991U#  -7' ossec13001itExim Auth failed2025-11-17 16:17:21 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:37740: 535 Incorrect authentication data (set_id=xavier)183.171.53.821733045n"  -g) ossec13001itExim Auth failed2025-11-17 16:18:06 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:49732: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)103.168.241.321269750!  W' ossec9708itDovecot Aborted Login with empty userNov 17 16:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  V z W : s=  -s' ossec13001iuExim Auth failed2025-11-17 16:21:47 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:37447: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)42.200.70.1341819730$<  e!' ossec9710iuDovecot Auth failed on disconnected session.Nov 17 16:21:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.1391307584;  e?' ossec9710iuDovecot Auth failed on disconnected session.Nov 17 16:21:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991: W' ossec9708iuDovecot Aborted Login with empty userNov 17 16:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*9  e'+ ossec9710iuDovecot Auth failed on disconnected session.Nov 17 16:21:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822Z8  -A' ossec13001iuExim Auth failed2025-11-17 16:22:04 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.97.146]:51858: 535 Incorrect authentication data (set_id=aureovieira)115.77.97.1461562822i7  -]) ossec13001iuExim Auth failed2025-11-17 16:21:51 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:40488: 535 Incorrect authentication data (set_id=envios@comercial.art.br)210.219.232.3418358416  W' ossec9708iuDovecot Aborted Login with empty userNov 17 16:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903455  eA' ossec9710iuDovecot Auth failed on disconnected session.Nov 17 16:20:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9baTPs9DWr1n9M4G>103.244.206.616430844  k' ossec9709iuMultiple Dovecot Aborted Logins with empty userNov 17 16:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6DG3Pc9DRqexV3kv>177.87.121.473469034X3  -=' ossec13001iu0Exim Auth failed2025-11-17 16:19:12 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:62112: 535 Incorrect authentication data (set_id=novamanha)209.16.71.2546252001V2  ;-% ossec13008iu,Mail Recipient rejected2025-11-17 16:19:06 H=(195.3.134.135) [179.0.178.53]:51472 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:51472 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.53346903421  e9) ossec9710iu,Dovecot Auth failed on disconnected session.Nov 17 16:19:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.10816430840 W' ossec9708iuDDovecot Aborted Login with empty userNov 17 16:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<87oXOs9DWumxV3kv>177.87.121.473469034 M d~M-L  e/) ossec9710ivbDovecot Auth failed on disconnected session.Nov 17 16:24:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750bK  -Q) ossec13001iv\Exim Auth failed2025-11-17 16:24:11 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:16442: 535 Incorrect authentication data (set_id=contato)178.150.135.19690791,J  e++ ossec9710ivpDovecot Auth failed on disconnected session.Nov 17 16:24:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841I W' ossec9708ivpDovecot Aborted Login with empty userNov 17 16:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 H  -) ossec13001ivRExim Auth failed2025-11-17 16:24:01 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:59358: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)90.160.139.1632510769G  k' ossec9709iv4Multiple Dovecot Aborted Logins with empty userNov 17 16:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034WF  -9) ossec13001iv(Exim Auth failed2025-11-17 16:23:20 dovecot_login authenticator failed for (pc169.zz.ha.cn) [61.168.104.169]:35276: 535 Incorrect authentication data (set_id=contato)61.168.104.1691814991YE  -=) ossec13001iv$Exim Auth failed2025-11-17 16:23:15 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:36870: 535 Incorrect authentication data (set_id=loopert)14.139.107.1461269750jD  -c% ossec13001ivExim Auth failed2025-11-17 16:23:05 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:59375: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)61.72.59.1061835841C  W' ossec9708ivTDovecot Aborted Login with empty userNov 17 16:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.B  e/+ ossec9710ivLDovecot Auth failed on disconnected session.Nov 17 16:23:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.11915628228A  eC+ ossec9710iv@Dovecot Auth failed on disconnected session.Nov 17 16:23:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<76TzSM9DELOGx8nN>134.199.201.2056252001k@  -c' ossec13001ivExim Auth failed2025-11-17 16:23:05 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:34146: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)217.24.185.982017370? W' ossec9708iuDovecot Aborted Login with empty userNov 17 16:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8/vXRM9DMOyxV3kv>177.87.121.473469034g>  -Y) ossec13001iuExim Auth failed2025-11-17 16:22:10 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:37953: 535 Incorrect authentication data (set_id=envios)110.175.41.2172077456 3"  ! - ##)3r[  -q) ossec13001iw=Exim Auth failed2025-11-17 16:27:55 dovecot_login authenticator failed for ([78.101.217.177]) [78.101.217.177]:51490: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)78.101.217.177289688vZ  -w) ossec13001iw5Exim Auth failed2025-11-17 16:27:48 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:48586: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)116.98.104.1381562822OY  -/# ossec13001iw3Exim Auth failed2025-11-17 16:27:45 dovecot_login authenticator failed for ([14.48.112.8]) [14.48.112.8]:1248: 535 Incorrect authentication data (set_id=eduardo)14.48.112.81835841)X  e+' ossec9710iw1Dovecot Auth failed on disconnected session.Nov 17 16:27:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758rW  -q' ossec13001iw9Exim Auth failed2025-11-17 16:27:51 dovecot_login authenticator failed for ([27.40.100.188]) [27.40.100.188]:38698: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)27.40.100.1881814991mV  -e) ossec13001iw$Exim Auth failed2025-11-17 16:27:32 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:36573: 535 Incorrect authentication data (set_id=doninha)172.248.47.1146252001U  k' ossec9709ivMultiple Dovecot Aborted Logins with empty userNov 17 16:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034WT  -=% ossec13001ivExim Auth failed2025-11-17 16:26:24 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:47614: 535 Incorrect authentication data (set_id=aureovieira)183.99.89.741835841S  W' ossec9708iwDovecot Aborted Login with empty userNov 17 16:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lR  -a+ ossec13001iwExim Auth failed2025-11-17 16:26:59 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55721: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.2311605651dQ  -Y# ossec13001iwExim Auth failed2025-11-17 16:27:00 dovecot_login authenticator failed for ([77.35.96.85]) [77.35.96.85]:32822: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)77.35.96.852017370\P  -K! ossec13001ivExim Auth failed2025-11-17 16:25:56 dovecot_login authenticator failed for ([61.59.6.81]) [61.59.6.81]:54851: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)61.59.6.811668284O W' ossec9708ivDovecot Aborted Login with empty userNov 17 16:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+N  e+) ossec9710ivDovecot Auth failed on disconnected session.Nov 17 16:25:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<+oFhTs9DREuvfiX3>175.126.37.2471835841ZM  -A' ossec13001ivExim Auth failed2025-11-17 16:25:11 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:62550: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001 B  BXj  -=' ossec13001iwExim Auth failed2025-11-17 16:29:42 dovecot_login authenticator failed for (adlondrina.com.br) [112.122.54.54]:35868: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991Zi  -?) ossec13001iw{Exim Auth failed2025-11-17 16:28:58 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:51290: 535 Incorrect authentication data (set_id=unijovem)103.251.143.141269750Yh  -=) ossec13001iwQExim Auth failed2025-11-17 16:28:15 dovecot_login authenticator failed for ([45.136.194.120]) [45.136.194.120]:39448: 535 Incorrect authentication data (set_id=compras)45.136.194.1202510769pg  -i+ ossec13001iwnExim Auth failed2025-11-17 16:28:45 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:53370: 535 Incorrect authentication data (set_id=unijovem@pibtrindade.com.br)121.178.185.1411835841hf  -_' ossec13001iwkExim Auth failed2025-11-17 16:28:41 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:33202: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)87.200.171.25290557e W' ossec9708iwaDovecot Aborted Login with empty userNov 17 16:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<59pKWs9D+NmxV3kv>177.87.121.473469034d  - + ossec13001iw]Exim Auth failed2025-11-17 16:28:27 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:34532: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)103.203.210.1191269750,c  e/' ossec9710iwUDovecot Auth failed on disconnected session.Nov 17 16:28:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991 b  -!+ ossec13001iwMExim Auth failed2025-11-17 16:28:12 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:39282: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)122.184.127.1501269750[a  -E% ossec13001iwIExim Auth failed2025-11-17 16:28:08 dovecot_login authenticator failed for ([89.105.153.3]) [89.105.153.3]:49729: 535 Incorrect authentication data (set_id=paulinho.vendas)89.105.153.32017370V`  -9' ossec13001iw{Exim Auth failed2025-11-17 16:28:57 dovecot_login authenticator failed for ([122.201.27.64]) [122.201.27.64]:41644: 535 Incorrect authentication data (set_id=compras)122.201.27.642029969_ W' ossec9708iw$Dovecot Aborted Login with empty userNov 17 16:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V^  -9' ossec13001iwExim Auth failed2025-11-17 16:27:16 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:34115: 535 Incorrect authentication data (set_id=eduardo)175.115.29.391835841}]  -) ossec13001iwExim Auth failed2025-11-17 16:27:14 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:54340: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)178.140.212.9220173706\  e?+ ossec9710iwDovecot Auth failed on disconnected session.Nov 17 16:27:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 2 ]CP#3VX2"y  e' ossec9710iwDovecot Auth failed on disconnected session.Nov 17 16:30:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991zx  -) ossec13001iwExim Auth failed2025-11-17 16:30:23 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:33297: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)110.25.112.1511668284Yw  -=) ossec13001iwExim Auth failed2025-11-17 16:30:20 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:33514: 535 Incorrect authentication data (set_id=eduardo)50.247.189.1896252001lv  -e' ossec13001iwExim Auth failed2025-11-17 16:30:07 dovecot_login authenticator failed for (adlondrina.com.br) [112.122.54.54]:1961: 535 Incorrect authentication data (set_id=postmaster@adlondrina.com.br)112.122.54.541814991)u  e-# ossec9710iwDovecot Auth failed on disconnected session.Nov 17 16:30:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001ot  -g+ ossec13001iwExim Auth failed2025-11-17 16:30:45 dovecot_login authenticator failed for ([180.218.110.248]) [180.218.110.248]:51150: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)180.218.110.2481668284s W' ossec9708iwDovecot Aborted Login with empty userNov 17 16:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#r  e' ossec9710iwDovecot Auth failed on disconnected session.Nov 17 16:30:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758q  W' ossec9708iwDovecot Aborted Login with empty userNov 17 16:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p  W+ ossec9708iwDovecot Aborted Login with empty userNov 17 16:29:29 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.242, lip=200.150.207.122, TLS, session=185.247.137.2422635167o  -++ ossec13001iwExim Auth failed2025-11-17 16:30:04 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:40556: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)122.170.111.1401269750]n  -E) ossec13001iwExim Auth failed2025-11-17 16:29:39 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:57746: 535 Incorrect authentication data (set_id=aureovieira)196.28.226.1241036973m  k' ossec9709iwMultiple Dovecot Aborted Logins with empty userNov 17 16:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034xl  -% ossec13001iwExim Auth failed2025-11-17 16:29:18 dovecot_login authenticator failed for broadband-37-110-40-20.ip.moscow.rt.ru [37.110.40.20]:57624: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)37.110.40.202017370(k  e#+ ossec9710iwDovecot Auth failed on disconnected session.Nov 17 16:29:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841 `   JXT;W4ES`o  -i) ossec13001ix[Exim Auth failed2025-11-17 16:32:43 dovecot_login authenticator failed for mail.dichieweb.com [123.110.53.177]:45344: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)123.110.53.1771668284n  -k% ossec13001ixUExim Auth failed2025-11-17 16:32:37 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:49189: 535 Incorrect authentication data (set_id=atendimento@interlubfiltros.com.br)124.74.9.1901814991k  -a) ossec13001ixSExim Auth failed2025-11-17 16:32:33 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:60876: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)125.20.228.1461269750  k' ossec9709ixQMultiple Dovecot Aborted Logins with empty userNov 17 16:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`  -M' ossec13001ixAExim Auth failed2025-11-17 16:32:15 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:50761: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730  W' ossec9708ixoDovecot Aborted Login with empty userNov 17 16:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e#+ ossec9710ixkDovecot Auth failed on disconnected session.Nov 17 16:32:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001T  -9# ossec13001ixeExim Auth failed2025-11-17 16:32:52 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:40468: 535 Incorrect authentication data (set_id=atendimento)180.71.9.311835841n  -i' ossec13001ix_Exim Auth failed2025-11-17 16:32:45 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:35350: 535 Incorrect authentication data (set_id=rafael)108.30.14.2216252001  3G' ossec11301ixANew FTP connection.Nov 17 16:32:15 hosting pure-ftpd: (?@50.116.26.161) [INFO] New connection from 50.116.26.16150.116.26.1616252001k  -c) ossec13001ixExim Auth failed2025-11-17 16:31:16 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:43666: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)196.188.187.21337996;~  S[) ossec11000ixLogin failed on the cpanel service.[2025-11-17 16:31:13 -0300] info [webmaild] 154.213.164.69 - andre.nascimento@calcautomacao.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)154.213.164.692921044d}  -S) ossec13001ixExim Auth failed2025-11-17 16:31:36 dovecot_login authenticator failed for (pool-109-191-146-98.is74.ru) [109.191.146.98]:49828: 535 Incorrect authentication data (set_id=compras)109.191.146.982017370| W' ossec9708ixDovecot Aborted Login with empty userNov 17 16:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]{ -C) ossec13001ix Exim Auth failed2025-11-17 16:31:20 dovecot_login authenticator failed for (User) [177.74.174.120]:54058: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)177.74.174.1203469034}z  -+ ossec13001iwExim Auth failed2025-11-17 16:30:44 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:58480: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)177.135.223.1233469034   oj  -c% ossec13001ixExim Auth failed2025-11-17 16:35:17 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:57804: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)87.31.17.1313175395w  -y) ossec13001ixExim Auth failed2025-11-17 16:35:11 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:46452: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)178.178.222.562017370 W' ossec9708ixDovecot Aborted Login with empty userNov 17 16:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -A' ossec13001ixExim Auth failed2025-11-17 16:34:15 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:59704: 535 Incorrect authentication data (set_id=alex.vendas)111.26.61.2441814991~  -) ossec13001ixExim Auth failed2025-11-17 16:34:13 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:35272: 535 Incorrect authentication data (set_id=junior.gomes)50.188.204.2136252001k  -a) ossec13001ixExim Auth failed2025-11-17 16:34:08 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:62114: 535 Incorrect authentication data (set_id=adriana)220.246.42.2121819730}  - % ossec13001ixExim Auth failed2025-11-17 16:34:02 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:34406: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)71.62.34.2166252001q  -m) ossec13001ixExim Auth failed2025-11-17 16:33:24 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:62747: 535 Incorrect authentication data (set_id=ferramentaria)220.246.43.1721819730S  -5% ossec13001ix}Exim Auth failed2025-11-17 16:33:16 dovecot_login authenticator failed for ([36.135.62.84]) [36.135.62.85]:54160: 535 Incorrect authentication data (set_id=contato)36.135.62.851814991   -#) ossec13001ixsExim Auth failed2025-11-17 16:33:06 dovecot_login authenticator failed for 104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:33429: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)104.203.37.2256252001'  e#) ossec9710ixDovecot Auth failed on disconnected session.Nov 17 16:33:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<4Ww8bc9D5OGl0iHB>165.210.33.1932233387v  -w) ossec13001ixExim Auth failed2025-11-17 16:33:50 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:41523: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)190.114.243.873625428  -) ossec13001ixExim Auth failed2025-11-17 16:33:49 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:41576: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)24.233.210.1886252001 W' ossec9708ixDovecot Aborted Login with empty userNov 17 16:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345  e?) ossec9710ixyDovecot Auth failed on disconnected session.Nov 17 16:33:11 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.61.177.187, lip=200.150.196.245, TLS, session=111.61.177.1871814991   , M 4<b'  -W# ossec13001iyKExim Auth failed2025-11-17 16:36:42 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:52106: 535 Incorrect authentication data (set_id=faturamento)31.41.84.60798544t&  -q+ ossec13001iyIExim Auth failed2025-11-17 16:36:40 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:38802: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)104.236.145.12862520014%  e=) ossec9710iy;Dovecot Auth failed on disconnected session.Nov 17 16:36:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044^$  -G) ossec13001iyIExim Auth failed2025-11-17 16:36:40 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:42950: 535 Incorrect authentication data (set_id=atualizacoes)220.180.204.321814991# W' ossec9708iyADovecot Aborted Login with empty userNov 17 16:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034"  -% ossec13001iy7Exim Auth failed2025-11-17 16:36:22 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:54518: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)77.53.110.1126618862!  e7+ ossec9710iy-Dovecot Auth failed on disconnected session.Nov 17 16:36:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001t  -q+ ossec13001iy%Exim Auth failed2025-11-17 16:36:04 dovecot_login authenticator failed for ([200.149.213.242]) [200.149.213.242]:39867: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)200.149.213.2423469034  W' ossec9708iy#Dovecot Aborted Login with empty userNov 17 16:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[  -E% ossec13001iy!Exim Auth failed2025-11-17 16:36:01 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:52165: 535 Incorrect authentication data (set_id=contato)210.1.66.1541694008l  -c) ossec13001iy!Exim Auth failed2025-11-17 16:36:01 dovecot_login authenticator failed for ([111.26.106.117]) [111.26.106.117]:53712: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)111.26.106.1171814991l  -c) ossec13001iyExim Auth failed2025-11-17 16:35:47 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:47486: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)27.212.198.2261814991k  -c' ossec13001iy Exim Auth failed2025-11-17 16:35:38 dovecot_login authenticator failed for (ool-4b639492.static.optonline.net) [75.99.148.146]:45327: 535 Incorrect authentication data (set_id=financeiro)75.99.148.1466252001  k' ossec9709iyMultiple Dovecot Aborted Logins with empty userNov 17 16:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -K% ossec13001ixExim Auth failed2025-11-17 16:35:21 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:56968: 535 Incorrect authentication data (set_id=administrativo1)187.9.247.583469034 7 3  !Y6GxX7  -;) ossec13001iyExim Auth failed2025-11-17 16:39:42 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:57528: 535 Incorrect authentication data (set_id=contato)122.184.120.981269750`6  -O' ossec13001iyExim Auth failed2025-11-17 16:39:39 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:54920: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795*5  e)) ossec9710iyDovecot Auth failed on disconnected session.Nov 17 16:38:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.10816430844  3C% ossec11301iyNew FTP connection.Nov 17 16:38:15 hosting pure-ftpd: (?@87.121.84.35) [INFO] New connection from 87.121.84.3587.121.84.352750405k3  -c' ossec13001iyExim Auth failed2025-11-17 16:38:57 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:42388: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)187.6.121.24634690342  k' ossec9709iyMultiple Dovecot Aborted Logins with empty userNov 17 16:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+1  AQ% ossec11302iyFTP Authentication failed.Nov 17 16:38:21 hosting pure-ftpd: (?@87.121.84.35) [WARNING] Authentication failed for user [PLC]87.121.84.3527504050  W' ossec9708iyDovecot Aborted Login with empty userNov 17 16:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i/  -_' ossec13001iyExim Auth failed2025-11-17 16:38:59 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:34902: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)193.46.192.202510769n.  -g) ossec13001iyExim Auth failed2025-11-17 16:38:45 dovecot_login authenticator failed for ([219.139.39.106]) [219.139.39.106]:33284: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)219.139.39.1061814991g-  -[' ossec13001iyExim Auth failed2025-11-17 16:37:39 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:35608: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)111.93.80.1581269750, W' ossec9708iy}Dovecot Aborted Login with empty userNov 17 16:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*+  e)) ossec9710iy{Dovecot Auth failed on disconnected session.Nov 17 16:37:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387*  - + ossec13001iymExim Auth failed2025-11-17 16:37:16 dovecot_login authenticator failed for (121.156.170.222.broad.sh.hl.dynamic.163data.com.cn) [222.170.156.121]:51396: 535 Incorrect authentication data (set_id=financeiro)222.170.156.1211814991d)  -S) ossec13001iyExim Auth failed2025-11-17 16:38:04 dovecot_login authenticator failed for 110-25-112-143.adsl.fetnet.net [110.25.112.143]:36875: 535 Incorrect authentication data (set_id=rafael)110.25.112.1431668284](  -G' ossec13001iy[Exim Auth failed2025-11-17 16:36:58 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:33302: 535 Incorrect authentication data (set_id=isabellylisboa)74.208.177.566252001  %EfzaG  -Q% ossec13001iz/Exim Auth failed2025-11-17 16:40:31 dovecot_login authenticator failed for (82-156-58-61.tinp.net.tw) [61.58.156.82]:53089: 535 Incorrect authentication data (set_id=novalondria)61.58.156.821668284YF ;-) ossec13008iz!Mail Recipient rejected2025-11-17 16:40:16 H=(localhost) [168.232.81.177]:27111 F= rejected RCPT : Sender verify failed168.232.81.1773469034hE  -[) ossec13001izExim Auth failed2025-11-17 16:40:08 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:42942: 535 Incorrect authentication data (set_id=contato)94.255.208.1692661886[D  -A) ossec13001izLExim Auth failed2025-11-17 16:40:59 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:35118: 535 Incorrect authentication data (set_id=comercial)182.95.223.1141269750\C  -E' ossec13001izPExim Auth failed2025-11-17 16:41:03 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:44214: 535 Incorrect authentication data (set_id=paulo.user.hr)193.46.192.202510769oB  -g+ ossec13001iz?Exim Auth failed2025-11-17 16:40:46 dovecot_login authenticator failed for ([178.178.194.134]) [178.178.194.134]:58360: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)178.178.194.1342017370zA  -' ossec13001iz5Exim Auth failed2025-11-17 16:40:37 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:36881: 535 Incorrect authentication data (set_id=paulo.user.hr@louvoreterno.com.br)152.231.25.643686110f@  -Y' ossec13001izExim Auth failed2025-11-17 16:40:07 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:38446: 535 Incorrect authentication data (set_id=novalondria@cieadep.com)187.6.121.2463469034Y?  -=) ossec13001iyExim Auth failed2025-11-17 16:39:14 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:53730: 535 Incorrect authentication data (set_id=contato)125.19.248.1701269750o>  -i) ossec13001iz Exim Auth failed2025-11-17 16:39:54 dovecot_login authenticator failed for ([95.189.109.187]) [95.189.109.187]:40748: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)95.189.109.1872017370e=  -U) ossec13001iyExim Auth failed2025-11-17 16:39:36 dovecot_login authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:38670: 535 Incorrect authentication data (set_id=brizola)110.25.103.2001668284'<  e%' ossec9710iyDovecot Auth failed on disconnected session.Nov 17 16:39:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<7I9ogc9D7s47GIXF>59.24.133.1971835841w;  -{' ossec13001iyExim Auth failed2025-11-17 16:39:28 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:32797: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)68.193.149.886252001z:  -' ossec13001iyExim Auth failed2025-11-17 16:39:22 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:50359: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)111.70.23.24116682849 W' ossec9708iyDovecot Aborted Login with empty userNov 17 16:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690348  -+ ossec13001iz Exim Auth failed2025-11-17 16:39:52 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:54954: 535 Incorrect authentication data (set_id=bianca.user.hr@globalmedica.com.br)188.234.212.1012017370   = T 1 '7M47?R$V  e) ossec9710izDovecot Auth failed on disconnected session.Nov 17 16:43:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.10818358419U  eG) ossec9710izDovecot Auth failed on disconnected session.Nov 17 16:42:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750iT  -a% ossec13001izExim Auth failed2025-11-17 16:42:40 dovecot_login authenticator failed for (ws6-94.maryno.net) [188.244.6.94]:55084: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)188.244.6.942017370tS  -u' ossec13001izExim Auth failed2025-11-17 16:42:41 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:41688: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)125.23.140.541269750yR  -% ossec13001izExim Auth failed2025-11-17 16:42:08 dovecot_login authenticator failed for host86-128-93-57.range86-128.btcentralplus.com [86.128.93.57]:45682: 535 Incorrect authentication data (set_id=flavio.oliveira)86.128.93.572635167Q  W' ossec9708izDovecot Aborted Login with empty userNov 17 16:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fP  -[% ossec13001izExim Auth failed2025-11-17 16:41:59 dovecot_login authenticator failed for ([125.90.72.14]) [125.90.72.14]:41798: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)125.90.72.141814991lO  -c) ossec13001izyExim Auth failed2025-11-17 16:41:45 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:35708: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)210.219.232.341835841N Ss% ossec11000izmLogin failed on the cpanel service.[2025-11-17 16:41:32 -0300] info [cpaneld] 103.82.65.48 - sindeesf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sindeesf (has_cpuser_file failed)103.82.65.482077456M  k' ossec9709izmMultiple Dovecot Aborted Logins with empty userNov 17 16:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034eL  -U+ ossec13001izkExim Auth failed2025-11-17 16:41:30 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:62028: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795NK  -1# ossec13001iz[Exim Auth failed2025-11-17 16:41:14 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:56469: 535 Incorrect authentication data (set_id=contato)65.20.202.499237oJ  -i) ossec13001iz=Exim Auth failed2025-11-17 16:40:45 dovecot_login authenticator failed for ([182.135.63.175]) [182.135.63.175]:51794: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)182.135.63.1751814991`I  -K) ossec13001iz7Exim Auth failed2025-11-17 16:40:39 dovecot_login authenticator failed for ([194.230.82.157]) [194.230.82.157]:46326: 535 Incorrect authentication data (set_id=bianca.user.hr)194.230.82.1572658434H W' ossec9708iz1Dovecot Aborted Login with empty userNov 17 16:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  V]d  -G) ossec13001i{$Exim Auth failed2025-11-17 16:44:34 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:34882: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549c  k' ossec9709i{"Multiple Dovecot Aborted Logins with empty userNov 17 16:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(b  e+# ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:44:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991+a  e)+ ossec9710i{<Dovecot Auth failed on disconnected session.Nov 17 16:44:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991{`  -) ossec13001i{8Exim Auth failed2025-11-17 16:44:55 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:58591: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)71.208.122.18562520019_  eK' ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:44:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=178.216.25.24, lip=200.150.196.245, TLS, session=<41aRkM9DjJOy2BkY>178.216.25.24798544%^  e%# ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:43:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001] W' ossec9708izDovecot Aborted Login with empty userNov 17 16:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2af3j89D0JKxV3kv>177.87.121.473469034/\  e1+ ossec9710izDovecot Auth failed on disconnected session.Nov 17 16:43:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<5tFpj89Drq2Gx8nN>134.199.201.2056252001+[  e)+ ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:44:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822SZ  -5% ossec13001izExim Auth failed2025-11-17 16:43:00 dovecot_login authenticator failed for ([31.173.0.140]) [31.173.0.140]:44976: 535 Incorrect authentication data (set_id=contato)31.173.0.1402017370^Y  -G) ossec13001izExim Auth failed2025-11-17 16:42:53 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:49268: 535 Incorrect authentication data (set_id=atualizacoes)152.52.244.2021269750.X  e3' ossec9710izDovecot Auth failed on disconnected session.Nov 17 16:42:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822W W' ossec9708izDovecot Aborted Login with empty userNov 17 16:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7DBhjM9D7OGxV3kv>177.87.121.473469034  8   ' s  k' ossec9709i{Multiple Dovecot Aborted Logins with empty userNov 17 16:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r W' ossec9708i{Dovecot Aborted Login with empty userNov 17 16:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034rq  -q' ossec13001i{Exim Auth failed2025-11-17 16:46:18 dovecot_plain authenticator failed for (xuof7t6ywo1p3gtl4lk07egwrobke) [43.135.46.226]:37074: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)43.135.46.2261819730ep  -W' ossec13001i{Exim Auth failed2025-11-17 16:46:16 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:33314: 535 Incorrect authentication data (set_id=isabellylisboa)57.129.90.2152921044o  - ) ossec13001i{Exim Auth failed2025-11-17 16:47:01 dovecot_login authenticator failed for (pool-109-191-146-98.is74.ru) [109.191.146.98]:58060: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)109.191.146.982017370in  -e% ossec13001i{Exim Auth failed2025-11-17 16:46:42 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:37148: 535 Incorrect authentication data (set_id=comercial.user.hr@inovasite.com)65.20.250.6399237pm  -q# ossec13001i{~Exim Auth failed2025-11-17 16:46:04 dovecot_login authenticator failed for ([46.44.0.185]) [46.44.0.185]:55678: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)46.44.0.1852017370el  -Y% ossec13001i{lExim Auth failed2025-11-17 16:45:47 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:59176: 535 Incorrect authentication data (set_id=gerson)139.60.85.946252001k  -+ ossec13001i{`Exim Auth failed2025-11-17 16:45:34 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:43057: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)201.234.106.2153865483j W' ossec9708i{^Dovecot Aborted Login with empty userNov 17 16:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ti  -u' ossec13001i{FExim Auth failed2025-11-17 16:45:09 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:40096: 535 Incorrect authentication data (set_id=financeiro)186.201.54.903469034-h  e/) ossec9710i{DDovecot Auth failed on disconnected session.Nov 17 16:45:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<8FiClc9DnsCd5hjP>157.230.24.2072921044g  W' ossec9708i{@Dovecot Aborted Login with empty userNov 17 16:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034df  -W% ossec13001i{Exim Auth failed2025-11-17 16:44:26 dovecot_login authenticator failed for ([111.26.67.36]) [111.26.67.36]:47786: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)111.26.67.361814991\e  -C) ossec13001i{&Exim Auth failed2025-11-17 16:44:37 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:43628: 535 Incorrect authentication data (set_id=formula316)50.187.155.1306252001 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0  3469034B 3469034< 34690347 34690343 3469034, 3469034+ 3469034* 3469034) 3469034& 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034y 3469034v 3469034l 3469034k 3469034d 3469034_ 3469034[ 3469034Y 3469034U 3469034N 3469034H 3469034F 3469034C 3469034B 3469034@ 3469034; 34690349 34690344 3469034. 3469034( 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034q 3469034o 3469034n 3469034k 3469034h 3469034f 3469034d 3469034c 3469034R 3469034P 3469034J 3469034G 3469034C 3469034> 3469034< 34690348 3469034. 3469034, 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 | 3469034 { 3469034 z 3469034 x 3469034 t 3469034 n 3469034 i 3469034 g 3469034 ` 3469034 ] 3469034 R 3469034 L 3469034 I 3469034 G 3469034 F 3469034 = 3469034 8 3469034 7 3469034 3 3469034 , 3469034 + 3469034 & 3469034 3469034  3469034  3469034  3469034 3469034  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 | 3469034 u 3469034 o 3469034 l 3469034 k 3469034 i 3469034 c 3469034 [ 3469034 W 3469034 U 3469034 H 3469034 F 3469034 C 3469034 A 3469034 @ 3469034 8 3469034 3 3469034 1 3469034 0 3469034 , 3469034 ) 3469034 # 3469034 ! 3469034 3469034  3469034  3469034 3469034  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034  x@r  -o) ossec13001i|rExim Auth failed2025-11-17 16:50:10 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:52584: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)49.206.201.2531269750  W' ossec9708i|Dovecot Aborted Login with empty userNov 17 16:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708i|NDovecot Aborted Login with empty userNov 17 16:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/~  e1+ ossec9710i|hDovecot Auth failed on disconnected session.Nov 17 16:49:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822d}  -Q+ ossec13001i|Exim Auth failed2025-11-17 16:48:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:52624: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651| W' ossec9708i|Dovecot Aborted Login with empty userNov 17 16:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'{  e%' ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:48:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149914z  eC# ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:48:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991.y  e1) ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:47:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.10818358415x  eC% ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:47:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651\w  -A+ ossec13001i{Exim Auth failed2025-11-17 16:47:18 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:49076: 535 Incorrect authentication data (set_id=adriana)128.185.227.1421269750uv  -u) ossec13001i{Exim Auth failed2025-11-17 16:47:12 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:33097: 535 Incorrect authentication data (set_id=comercial.user.hr)200.141.211.583469034u  W' ossec9708i{Dovecot Aborted Login with empty userNov 17 16:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034't  e%' ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 16:47:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 r"  9 = + 0,;`jrt  -s) ossec13001i}Exim Auth failed2025-11-17 16:52:32 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:56958: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)179.185.29.2333469034r  -m+ ossec13001i|Exim Auth failed2025-11-17 16:52:10 dovecot_login authenticator failed for (calcautomacao.com.br) [111.122.211.212]:19866: 535 Incorrect authentication data (set_id=admin@calcautomacao.com.br)111.122.211.2121814991W  -=% ossec13001i}Exim Auth failed2025-11-17 16:53:02 dovecot_login authenticator failed for ([95.53.245.92]) [95.53.245.92]:42951: 535 Incorrect authentication data (set_id=alex.vendas)95.53.245.922017370S  -5% ossec13001i}Exim Auth failed2025-11-17 16:52:49 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:56398: 535 Incorrect authentication data (set_id=contato)203.82.40.341694008q  -m) ossec13001i}Exim Auth failed2025-11-17 16:52:45 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:34690: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)218.22.237.1081814991!  e# ossec9710i} Dovecot Auth failed on disconnected session.Nov 17 16:52:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001  - ' ossec13001i|Exim Auth failed2025-11-17 16:51:44 dovecot_login authenticator failed for 24.115.167.85.res-cmts.mlf.ptd.net [24.115.167.85]:47895: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)24.115.167.856252001f  -Y' ossec13001i|Exim Auth failed2025-11-17 16:51:44 dovecot_login authenticator failed for 176-170-1-244.abo.bbox.fr [176.170.1.244]:33263: 535 Incorrect authentication data (set_id=paulinho.vendas)176.170.1.2443017382s  -q) ossec13001i|Exim Auth failed2025-11-17 16:51:41 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:63473: 535 Incorrect authentication data (set_id=administrativo1)116.48.151.1361819730 W' ossec9708i|Dovecot Aborted Login with empty userNov 17 16:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -)' ossec13001i|Exim Auth failed2025-11-17 16:51:29 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:59408: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)58.169.37.1632077456x  -y+ ossec13001i|Exim Auth failed2025-11-17 16:51:26 dovecot_login authenticator failed for ([122.175.189.100]) [122.175.189.100]:48455: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)122.175.189.1001269750_  -G+ ossec13001i|Exim Auth failed2025-11-17 16:51:59 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:60160: 535 Incorrect authentication data (set_id=financeiro)218.149.235.1521835841_  -G+ ossec13001i|Exim Auth failed2025-11-17 16:51:46 dovecot_login authenticator failed for (calcautomacao.com.br) [111.122.211.212]:14872: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991  k' ossec9709i|Multiple Dovecot Aborted Logins with empty userNov 17 16:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -A' ossec13001i|Exim Auth failed2025-11-17 16:50:29 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:57510: 535 Incorrect authentication data (set_id=vendas.luiz)188.72.74.1302017370  b.  - ) ossec13001i}Exim Auth failed2025-11-17 16:55:50 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:55192: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)213.33.204.1302017370 W' ossec9708i}zDovecot Aborted Login with empty userNov 17 16:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001i}Exim Auth failed2025-11-17 16:55:00 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:49958: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)125.20.251.661269750(  e+# ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 16:54:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001p  -k) ossec13001i}Exim Auth failed2025-11-17 16:54:43 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:33866: 535 Incorrect authentication data (set_id=rebecakessler@prafebrum.com.br)220.67.122.2301835841l  -i# ossec13001i}Exim Auth failed2025-11-17 16:54:41 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:52726: 535 Incorrect authentication data (set_id=contato)96.1.40.1516251999'  e#) ossec9710i}:Dovecot Auth failed on disconnected session.Nov 17 16:53:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358410  e3+ ossec9710i}8Dovecot Auth failed on disconnected session.Nov 17 16:53:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628225  e?) ossec9710i}6Dovecot Auth failed on disconnected session.Nov 17 16:53:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387# U)' ossec11001i}$Deferred login on the cpanel service[2025-11-17 16:53:08 -0300] info [webmaild] 177.16.29.122 - palozi@arkson.com.br "GET /cpsess6933818839/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect177.16.29.1223469034  W' ossec9708i}ZDovecot Aborted Login with empty userNov 17 16:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5dB5tc9DArexV3kv>177.87.121.473469034d  -U' ossec13001i}FExim Auth failed2025-11-17 16:53:42 dovecot_login authenticator failed for ([60.12.106.119]) [60.12.106.119]:34514: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)60.12.106.1191814991  k' ossec9709i}>Multiple Dovecot Aborted Logins with empty userNov 17 16:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708i}Dovecot Aborted Login with empty userNov 17 16:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 (M  v<.  -) ossec13001i~Exim Auth failed2025-11-17 16:57:10 dovecot_login authenticator failed for (User) [177.74.174.120]:55934: 535 Incorrect authentication data177.74.174.1203469034-  W' ossec9708i~Dovecot Aborted Login with empty userNov 17 16:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d,  -U' ossec13001i}Exim Auth failed2025-11-17 16:56:42 dovecot_login authenticator failed for ([125.23.235.41]) [182.95.49.186]:60072: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)182.95.49.1861269750]+ -C) ossec13001i}Exim Auth failed2025-11-17 16:56:37 dovecot_login authenticator failed for (User) [177.74.174.120]:55934: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)177.74.174.1203469034,*  e-) ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 16:56:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750)  k' ossec9709i}Multiple Dovecot Aborted Logins with empty userNov 17 16:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5O1tvs9DuJWxV3kv>177.87.121.473469034U(  -;# ossec13001i}Exim Auth failed2025-11-17 16:56:05 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:17066: 535 Incorrect authentication data (set_id=vanessalima)61.37.150.61835841' W' ossec9708i}Dovecot Aborted Login with empty userNov 17 16:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o&  -i) ossec13001i}Exim Auth failed2025-11-17 16:55:25 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:35510: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)178.176.229.362017370^%  -G) ossec13001i}Exim Auth failed2025-11-17 16:55:08 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:35290: 535 Incorrect authentication data (set_id=rebecakessler)125.19.194.1661269750($  e'' ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 16:55:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084R#  ;%% ossec13008i}Mail Recipient rejected2025-11-17 16:55:45 H=(195.3.134.135) [179.0.178.53]:64425 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:64425 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.5334690346"  eE% ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 16:55:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<+Un2us9DXs0zTY0d>51.77.141.293017382W!  -=% ossec13001i}Exim Auth failed2025-11-17 16:55:20 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:53722: 535 Incorrect authentication data (set_id=vendas.luiz)77.41.156.642017370T  -5' ossec13001i}Exim Auth failed2025-11-17 16:56:03 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:48322: 535 Incorrect authentication data (set_id=xavier)182.95.60.1461269750 )J 0 > _ lbl1Z#k=  -a) ossec13001i~Exim Auth failed2025-11-17 16:59:38 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:40274: 535 Incorrect authentication data (set_id=envios)123.193.152.641668284<  k' ossec9709i~Multiple Dovecot Aborted Logins with empty userNov 17 16:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034';  e)# ossec9710i~_Dovecot Auth failed on disconnected session.Nov 17 16:58:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.5318149913:  e;) ossec9710i~UDovecot Auth failed on disconnected session.Nov 17 16:58:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084S9  ;%' ossec13008i~QMail Recipient rejected2025-11-17 16:58:07 H=(localhost) [168.197.87.49]:44210 F= rejected RCPT : Sender verify failed168.197.87.49346903478  eE' ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 16:58:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822r7  -m+ ossec13001i~zExim Auth failed2025-11-17 16:58:50 dovecot_login authenticator failed for (nsg-corporate-150.219.186.122.airtel.in) [122.186.219.150]:43340: 535 Incorrect authentication data (set_id=contato)122.186.219.15012697506  -' ossec13001i~mExim Auth failed2025-11-17 16:58:35 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52084: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)70.91.135.18162520015 W' ossec9708i~iDovecot Aborted Login with empty userNov 17 16:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U4  -7' ossec13001i~AExim Auth failed2025-11-17 16:57:51 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:49956: 535 Incorrect authentication data (set_id=xavier)102.22.27.1462300660[3  ;5' ossec13008i~?Mail Recipient rejected2025-11-17 16:57:50 H=(localhost) [168.197.87.49]:44210 F= rejected RCPT : Sender verify failed168.197.87.493469034n2  -m# ossec13001i~3Exim Auth failed2025-11-17 16:57:38 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4857: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)144.64.64.822643971 W' ossec9708i~-Dovecot Aborted Login with empty userNov 17 16:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[0 ;3' ossec13008i~"Mail Recipient rejected2025-11-17 16:57:22 H=(localhost) [45.169.206.79]:43632 F= rejected RCPT : Sender verify failed45.169.206.793469034S/  -5% ossec13001i~Exim Auth failed2025-11-17 16:57:13 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:46884: 535 Incorrect authentication data (set_id=doninha)38.226.118.03469034 ** Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p > 4 * f \ R H   vlbXD:0N&rh|^T@6,J"xndF<2ZP( tj`VL~B8.$*z>p4f\RH | r h ^ T J @ 6 , "    x n d  vlbXND:0& i ; i 7 i 9 i 8 i = i 5 i < i 4 i 3 i 2 i 1 i 0 i / i . i - i , i + i * i ) i ( i ' i & i % i $ i # i " i ! i i  i|  if  id  iV  iR  i  iH  iF  i:  i6  i,  i*  i  i  i  i  i  i i i i i i  i  i  i  i  i  i  i  i{ iu ie iK i? i# iS iG i; i9 iU iU i  i i i i i i i i i i i i= i1 iI i+ i i i  i i i i i i i i i i i i i ie ia iY iw i5 i i i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~ i~_ i~U i~Q i~ i~z i~m i~i i~A i~? i~3 i~- i~" i~ i~ i~ i} i} i} i} i} i} i} i} i} i} i} i} i} i} i} i} i} i} i}z i}Z i}F i}> i}: i}8 i}6 i}$ i} i} i} i}  i} i} iz!F izE iz@ iz > iz 8 iy7 iy6 iy= iy9 iy< ib [ i` _ iZ ^ iV ] iT b iF a iF ` i W i Z i Y i V i X i R i U i Q i P i O i N i T i S i I i M i H i L i K i G i F i E i D iz J it C in B ib A iV @ iP ? i, > i : i 6 i| i| i| i| i| i| i| i| i| i| i| i| i|r i|h~ i|N i|} i|| i{{ i{z i{u i{t i{s i{y i{x i{w i{v i{o i{n i{r i{q i{p i{~m i{ll i{`k i{^j i{Fi i{Dh i{@g i{<a i{8` i{&e i{$d2 if \ i{"c i{f i{b i{[ i{_ i{^ iz] iz\ izV izZ izY izX izU izT izS izW izR izQ izP izyO izmN izmM izkL iz[K izPC izLD iz?B iz=J iz7I iz5A iz1H iz/G ^ ) #   ,=#8Ny^*L  e+' ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 17:00:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822K  -+ ossec13001i~Exim Auth failed2025-11-17 17:00:20 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:45186: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)203.198.173.1451819730bJ  -Q' ossec13001i~Exim Auth failed2025-11-17 17:00:09 dovecot_login authenticator failed for ([118.60.136.49]) [183.107.0.216]:58462: 535 Incorrect authentication data (set_id=andre.nascimento.hr)183.107.0.2161835841QI  -1% ossec13001i~Exim Auth failed2025-11-17 17:00:40 dovecot_login authenticator failed for ([39.82.19.35]) [39.91.92.251]:45880: 535 Incorrect authentication data (set_id=wesley)39.91.92.2511814991fH  -Y' ossec13001i~Exim Auth failed2025-11-17 17:00:47 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:47180: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)120.157.17.962077456gG  -Y) ossec13001i~Exim Auth failed2025-11-17 17:00:35 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.186.93]:50435: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)113.160.186.931562822F W' ossec9708i~Dovecot Aborted Login with empty userNov 17 17:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kE  -_+ ossec13001i~Exim Auth failed2025-11-17 17:00:25 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:36700: 535 Incorrect authentication data (set_id=contato)128.106.196.1501880251QD  -5% ossec13001i~Exim Auth failed2025-11-17 17:00:49 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:43932: 535 Incorrect authentication data (set_id=rodrigo)65.20.149.2699237C  W' ossec9708i~Dovecot Aborted Login with empty userNov 17 17:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034B  -) ossec13001i~Exim Auth failed2025-11-17 16:59:49 dovecot_login authenticator failed for (143.130.138.78.in-addr.arpa) [78.138.130.143]:58774: 535 Incorrect authentication data (set_id=andre.nascimento.hr@calcautomacao.com.br)78.138.130.1432017370A  - + ossec13001i~Exim Auth failed2025-11-17 16:59:38 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59107: 535 Incorrect authentication data (set_id=info.user.hr@lixadoracuritiba.com.br)207.200.180.1746252001n@  -g) ossec13001i~Exim Auth failed2025-11-17 16:59:20 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:60085: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)222.101.241.441835841f?  -Y' ossec13001i~Exim Auth failed2025-11-17 16:59:14 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:39150: 535 Incorrect authentication data (set_id=envios@comercial.art.br)1.244.246.2211835841w>  -y) ossec13001i~Exim Auth failed2025-11-17 16:59:52 dovecot_login authenticator failed for pool-108-51-205-170.washdc.fios.verizon.net [108.51.205.170]:59152: 535 Incorrect authentication data (set_id=info.user.hr)108.51.205.1706252001  zIeZ  -]% ossec13001iExim Auth failed2025-11-17 17:03:54 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:36473: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)65.20.211.9699237XY  -;) ossec13001iExim Auth failed2025-11-17 17:03:53 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:39212: 535 Incorrect authentication data (set_id=envios)46.229.128.2512017370X  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:03:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.179.189.189, lip=200.150.196.245, TLS, session=45.179.189.1893469034kW  -_+ ossec13001iExim Auth failed2025-11-17 17:03:36 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56185: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651V W' ossec9708iDovecot Aborted Login with empty userNov 17 17:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340U  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:03:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149911T  e7) ossec9710ieDovecot Auth failed on disconnected session.Nov 17 17:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387-S  e-+ ossec9710iaDovecot Auth failed on disconnected session.Nov 17 17:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822R  k' ossec9709iYMultiple Dovecot Aborted Logins with empty userNov 17 17:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Q  W' ossec9708iwDovecot Aborted Login with empty userNov 17 17:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034P  W' ossec9708i5Dovecot Aborted Login with empty userNov 17 17:01:56 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.4, lip=186.233.225.118, TLS, session=194.164.107.46252001O W' ossec9708iDovecot Aborted Login with empty userNov 17 17:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5GVW0M9DQsWxV3kv>177.87.121.473469034VN  -9' ossec13001iExim Auth failed2025-11-17 17:01:05 dovecot_login authenticator failed for ([222.85.202.86]) [59.51.142.242]:46827: 535 Incorrect authentication data (set_id=rodrigo)59.51.142.24218149914M  e?' ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 17:00:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<6+DnzM9DOtVn9M4G>103.244.206.61643084  & < " G-h  e/) ossec9710i=Dovecot Auth failed on disconnected session.Nov 17 17:06:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750:g  eG+ ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 17:06:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001f W' ossec9708iIDovecot Aborted Login with empty userNov 17 17:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  W' ossec9708i+Dovecot Aborted Login with empty userNov 17 17:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kd  -_+ ossec13001iExim Auth failed2025-11-17 17:05:49 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:58240: 535 Incorrect authentication data (set_id=contato)187.103.196.1243469034vc  -w) ossec13001iExim Auth failed2025-11-17 17:05:39 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:41723: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)196.28.226.1241036973b  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 17 17:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341a  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:05:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822%`  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:04:33 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.163.198.144, lip=200.150.196.245, TLS, session=45.163.198.1443469034_ W' ossec9708iDovecot Aborted Login with empty userNov 17 17:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f^  -W) ossec13001iExim Auth failed2025-11-17 17:04:29 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:53119: 535 Incorrect authentication data (set_id=contato)187.126.105.423469034n]  -g) ossec13001iExim Auth failed2025-11-17 17:04:12 dovecot_login authenticator failed for ([222.122.103.21]) [222.122.103.21]:34215: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)222.122.103.211835841_\  -K' ossec13001iExim Auth failed2025-11-17 17:04:10 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:39276: 535 Incorrect authentication data (set_id=ieqcampocomprido)101.168.17.202077456[  -# ossec13001iExim Auth failed2025-11-17 17:03:16 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35428: 535 Incorrect authentication data (set_id=envios@comercial.art.br)70.89.116.56252001  b ? ]v  -E) ossec13001iUExim Auth failed2025-11-17 17:11:00 dovecot_login authenticator failed for ([208.69.161.214]) [208.69.161.214]:50195: 535 Incorrect authentication data (set_id=aureovieira)208.69.161.2146252001u  e% ossec9710iUDovecot Auth failed on disconnected session.Nov 17 17:10:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=61.73.190.98, lip=200.150.196.245, TLS, session=61.73.190.981835841_t  -K' ossec13001i Exim Auth failed2025-11-17 17:09:44 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:33212: 535 Incorrect authentication data (set_id=desenvolvimento2)193.46.192.202510769$s  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:09:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758r W' ossec9708iDovecot Aborted Login with empty userNov 17 17:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`q  -M' ossec13001iExim Auth failed2025-11-17 17:09:22 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:59116: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.721819730+p  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:09:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841zo  -% ossec13001iExim Auth failed2025-11-17 17:09:15 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:39788: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)77.53.110.112661886/n  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:08:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<7Zv16c9DvJ0naoFh>39.106.129.971814991m  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340l  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:08:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841k  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343j  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:07:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<8ELK5c9DKoFns7yS>103.179.188.1461562822i W' ossec9708iDovecot Aborted Login with empty userNov 17 17:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 0qdWuh[N { n a T G : -   w j ] P C08}pcVI</"3& ZM tg v i \ O B 5 (   J= *  r e X KD7 > 1 $^Q  k x ? 2 %  |obUH;.!~yl_RE  6 )  F9,  zm`S  s f Y L' A4+@~qdWJ=0# 1814991 1814991 1814991 1814991 1814991 1814991 1814991!\ 1814991!V 1814991!F+ 1814991a 1814991G 1814991? 1814991) 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991!g 1814991!` 1814991 1814991@ 1814991 1814991!} 1814991!| 1814991!x 1814991!j 1814991!h 1814991$ 1814991! 1814991 1814991 1814991 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991F 1814991@ 1814991> 1814991; 1814991: 18149918 18149914 18149913 18149912 1814991* 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991 1814991 1814991j 1814991S 1814991P 1814991 1814991 18149910 1814991& 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991g 18149912 1814991. 1814991$ 1814991 1814991 1814991 1814991 1814991 1814991  1814991!6 1814991!. 1814991! 1814991! 1814991! 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991  1814991 } 1814991 v 1814991 p 1814991 n 1814991 i 1814991 c 1814991 b 1814991 N 1814991  1814991  1814991  1814991#E 1814991# 1814991# 1814991# 1814991# 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991"p 1814991"n 1814991"k 1814991"N 1814991" 1814991" 1814991" 1814991! 1814991 1814991 1814991d 1814991\ 1814991C 1814991B 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991h 1814991g 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991} 1814991x 1814991l 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991} 1814991y 1814991m 1814991f 1814991] 1814991R 1814991E 1814991A 1814991 1814991! 1814991! 1814991! 1814991"K 1814991"F 1814991"B 1814991": 1814991"9 1814991"5 1814991"* 1814991"( 1814991"' 1814991"% 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991# 1814991#) 1814991#? 1814991#; 1814991#H M /  'MV  -9' ossec13001iExim Auth failed2025-11-17 17:12:21 dovecot_login authenticator failed for ([188.247.43.42]) [188.247.43.42]:54660: 535 Incorrect authentication data (set_id=rodrigo)188.247.43.422017370S  -5' ossec13001iExim Auth failed2025-11-17 17:12:10 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3680: 535 Incorrect authentication data (set_id=bqtz)213.55.85.202337996. AW% ossec11302iFTP Authentication failed.Nov 17 17:12:37 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]188.44.20.25718075 W' ossec9708iDovecot Aborted Login with empty userNov 17 17:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -C% ossec13001iExim Auth failed2025-11-17 17:11:54 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:42006: 535 Incorrect authentication data (set_id=bqtz@iemif.com)60.172.1.2101814991X  -A# ossec13001i{Exim Auth failed2025-11-17 17:11:39 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:62914: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999  k' ossec9709iuMultiple Dovecot Aborted Logins with empty userNov 17 17:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+~  e)+ ossec9710ieDovecot Auth failed on disconnected session.Nov 17 17:11:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001%}  e!' ossec9710iKDovecot Auth failed on disconnected session.Nov 17 17:10:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991g|  -Y) ossec13001i?Exim Auth failed2025-11-17 17:10:39 dovecot_login authenticator failed for ([111.26.101.122]) [111.26.101.122]:59856: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)111.26.101.1221814991({  e)% ossec9710i#Dovecot Auth failed on disconnected session.Nov 17 17:10:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=93.91.153.26, lip=200.150.196.245, TLS, session=93.91.153.263077311Xz  -;) ossec13001iSExim Auth failed2025-11-17 17:10:58 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:45260: 535 Incorrect authentication data (set_id=brizola)125.19.194.1661269750ky  -c' ossec13001iGExim Auth failed2025-11-17 17:10:46 dovecot_login authenticator failed for ([222.71.159.58]) [222.68.153.96]:39345: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)222.68.153.961814991hx  -[) ossec13001i;Exim Auth failed2025-11-17 17:10:34 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:33182: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)129.80.228.2316252001w W' ossec9708i9Dovecot Aborted Login with empty userNov 17 17:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 _  ] jZ  ;+) ossec13008i:Mail Recipient rejected2025-11-17 17:14:49 H=([103.75.191.183]) [103.75.191.183]:57112 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : "JunkMail rejected - ([103.75.191.183]) [103.75.191.183]:57112 is in an RBL: Listed by XBL, see https://check.spamhaus.org/query/ip/103.75.191.183"103.75.191.1831733045   -%' ossec13001i6Exim Auth failed2025-11-17 17:14:45 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:59068: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)50.187.152.6162520015  e=+ ossec9710i,Dovecot Auth failed on disconnected session.Nov 17 17:14:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001  k' ossec9709i*Multiple Dovecot Aborted Logins with empty userNov 17 17:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o  -g+ ossec13001iExim Auth failed2025-11-17 17:14:11 dovecot_login authenticator failed for ([218.157.129.153]) [218.157.129.153]:34039: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)218.157.129.15318358410  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:13:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044 W' ossec9708iDovecot Aborted Login with empty userNov 17 17:13:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<03pD+89DmuGxV3kv>177.87.121.4734690341  IW% ossec11331i Stealth FTP brute force attackNov 17 17:13:16 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]188.44.20.25718075 3C% ossec11301iNew FTP connection.Nov 17 17:13:12 hosting pure-ftpd: (?@188.44.20.25) [INFO] New connection from 188.44.20.25188.44.20.257180756  gC% ossec11307iMultiple connection attempts from same sourceNov 17 17:13:07 hosting pure-ftpd: (?@188.44.20.25) [INFO] New connection from 188.44.20.25188.44.20.25718075. AW% ossec11302iFTP Authentication failed.Nov 17 17:13:07 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]188.44.20.25718075,  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:13:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841q  -s% ossec13001iExim Auth failed2025-11-17 17:12:08 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:50872: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)37.157.98.80453733  S% ossec211321iPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 188.44.20.25188.44.20.25718075R  W% ossec11321iActive Response. FTP brute force attack (Port 21 is protected)Nov 17 17:13:01 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]188.44.20.25718075 3C% ossec11301iNew FTP connection.Nov 17 17:12:31 hosting pure-ftpd: (?@188.44.20.25) [INFO] New connection from 188.44.20.25188.44.20.25718075 ( " E 9 Y ?JRX~& W' ossec9708iDovecot Aborted Login with empty userNov 17 17:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v%  -w) ossec13001iExim Auth failed2025-11-17 17:16:10 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:34908: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)189.109.154.543469034g$  -Y+ ossec13001iExim Auth failed2025-11-17 17:16:54 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:44187: 535 Incorrect authentication data (set_id=andressa.financeiro)102.215.188.195192950`#  -K) ossec13001iExim Auth failed2025-11-17 17:16:51 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:36050: 535 Incorrect authentication data (set_id=isabellylisboa)221.10.226.1961814991n"  -g) ossec13001iExim Auth failed2025-11-17 17:16:46 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:49298: 535 Incorrect authentication data (set_id=faturamento)94.124.225.1592017370V!  -9' ossec13001iExim Auth failed2025-11-17 17:16:44 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:38843: 535 Incorrect authentication data (set_id=adriana)5.142.196.1852017370v  -y' ossec13001iExim Auth failed2025-11-17 17:16:36 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:46632: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)45.194.26.1491168579t  -q+ ossec13001iExim Auth failed2025-11-17 17:16:21 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:40280: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)176.119.132.2302510769q  -m) ossec13001i|Exim Auth failed2025-11-17 17:15:54 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:35334: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)152.52.246.1781269750 W' ossec9708ifDovecot Aborted Login with empty userNov 17 17:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -C) ossec13001idExim Auth failed2025-11-17 17:15:31 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:38300: 535 Incorrect authentication data (set_id=assessoria)186.97.203.1653686110  -#! ossec13001iVExim Auth failed2025-11-17 17:15:17 dovecot_login authenticator failed for (6.40.48.59.broad.cz.sx.dynamic.163data.com.cn) [59.48.40.6]:47434: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)59.48.40.61814991Y  -=) ossec13001iRExim Auth failed2025-11-17 17:15:13 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:40893: 535 Incorrect authentication data (set_id=contato)50.247.189.1896252001i  -a% ossec13001iExim Auth failed2025-11-17 17:16:04 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:57448: 535 Incorrect authentication data (set_id=alex.vendas)179.42.49.343469034  W' ossec9708iHDovecot Aborted Login with empty userNov 17 17:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -7' ossec13001iFExim Auth failed2025-11-17 17:15:01 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:40706: 535 Incorrect authentication data (set_id=rafael)196.0.107.158226074  7 < 7 R b?;[BL%'5  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:18:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387r4  -o) ossec13001i Exim Auth failed2025-11-17 17:18:19 dovecot_login authenticator failed for ([201.173.216.68]) [201.173.216.68]:42547: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)201.173.216.683996063-3  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:18:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084r2  -u# ossec13001iExim Auth failed2025-11-17 17:18:06 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:57258: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)58.27.253.611685791  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\0  -G% ossec13001iExim Auth failed2025-11-17 17:17:57 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:56120: 535 Incorrect authentication data (set_id=contato)116.94.0.1591861060/  - ) ossec13001iExim Auth failed2025-11-17 17:17:43 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:45558: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)24.233.210.1886252001.  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l-  -c) ossec13001iExim Auth failed2025-11-17 17:18:03 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:57594: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)223.166.87.1451814991a,  -M) ossec13001iExim Auth failed2025-11-17 17:17:59 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:40060: 535 Incorrect authentication data (set_id=administrativo1)61.150.123.1061814991+  -# ossec13001iExim Auth failed2025-11-17 17:17:53 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:39780: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)187.93.2.863469034w*  -y) ossec13001iExim Auth failed2025-11-17 17:17:13 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:47668: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)46.229.128.2512017370\)  -C) ossec13001iExim Auth failed2025-11-17 17:16:59 dovecot_login authenticator failed for ([122.184.89.169]) [125.23.203.114]:60226: 535 Incorrect authentication data (set_id=marialuiza)125.23.203.1141269750^(  -M# ossec13001iExim Auth failed2025-11-17 17:16:46 dovecot_login authenticator failed for ([118.39.27.8]) [118.39.27.8]:34516: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)118.39.27.81835841'  -) ossec13001iExim Auth failed2025-11-17 17:16:35 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:53514: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)116.98.104.1381562822 k  $ '<EkVE  -7) ossec13001iExim Auth failed2025-11-17 17:20:20 dovecot_login authenticator failed for ([136.53.199.160]) [136.53.199.160]:56390: 535 Incorrect authentication data (set_id=edna)136.53.199.1606252001sD  -q+ ossec13001iExim Auth failed2025-11-17 17:20:15 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:37760: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)196.190.220.168337996gC  -[' ossec13001itExim Auth failed2025-11-17 17:20:03 dovecot_login authenticator failed for (95-165-81-180.dynamic.spd-mgts.ru) [95.165.81.180]:55566: 535 Incorrect authentication data (set_id=rafael)95.165.81.1802017370VB  -;% ossec13001inExim Auth failed2025-11-17 17:19:58 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:57673: 535 Incorrect authentication data (set_id=marialuiza)221.145.5.141835841vA  -w) ossec13001ibExim Auth failed2025-11-17 17:19:45 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:51555: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)151.192.57.1181880251@ W' ossec9708iVDovecot Aborted Login with empty userNov 17 17:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034?  - + ossec13001iPExim Auth failed2025-11-17 17:19:26 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:60098: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)166.201.209.1526252001l>  -c) ossec13001i,Exim Auth failed2025-11-17 17:18:50 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:57087: 535 Incorrect authentication data (set_id=isabellylisboa)110.25.112.1451668284= W' ossec9708iDovecot Aborted Login with empty userNov 17 17:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s<  -u% ossec13001iExim Auth failed2025-11-17 17:18:26 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:37084: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)46.8.246.1832017370\;  -C) ossec13001iExim Auth failed2025-11-17 17:18:09 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:34113: 535 Incorrect authentication data (set_id=financeiro)103.142.184.551210997[:  -C' ossec13001iExim Auth failed2025-11-17 17:18:36 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:35457: 535 Incorrect authentication data (set_id=fabio.vendas)37.79.255.1042017370\9  -C) ossec13001i Exim Auth failed2025-11-17 17:18:18 dovecot_login authenticator failed for ([87.229.254.207]) [87.229.254.207]:49076: 535 Incorrect authentication data (set_id=financeiro)87.229.254.2072017370*8 U7' ossec11001iDeferred login on the cpanel service[2025-11-17 17:18:34 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.28346903417  e;' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 17:18:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758_6  -G+ ossec13001iExim Auth failed2025-11-17 17:18:36 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:43400: 535 Incorrect authentication data (set_id=atualizacoes)128.185.254.1621269750 0   $0pT  -i+ ossec13001iExim Auth failed2025-11-17 17:21:24 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:40986: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)123.209.106.1902077456rS  -m+ ossec13001iExim Auth failed2025-11-17 17:21:07 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42110: 535 Incorrect authentication data (set_id=contato)122.187.229.2471269750ZR  -A' ossec13001iExim Auth failed2025-11-17 17:21:55 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:29260: 535 Incorrect authentication data (set_id=venesselume)118.188.18.251814991mQ  -i' ossec13001iExim Auth failed2025-11-17 17:21:44 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:49199: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)46.30.161.197690791\P  -A+ ossec13001iExim Auth failed2025-11-17 17:21:37 dovecot_login authenticator failed for ([211.116.107.220]) [211.116.107.220]:39418: 535 Incorrect authentication data (set_id=contato)211.116.107.2201835841O W' ossec9708iDovecot Aborted Login with empty userNov 17 17:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`N  -I+ ossec13001iExim Auth failed2025-11-17 17:21:26 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:52421: 535 Incorrect authentication data (set_id=presidencia)211.169.212.2061835841M  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wL  -{' ossec13001iExim Auth failed2025-11-17 17:20:45 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:51276: 535 Incorrect authentication data (set_id=vanessalima)50.212.27.1506252001K  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0R9GFNBDIIOxV3kv>177.87.121.473469034J  -% ossec13001izExim Auth failed2025-11-17 17:20:09 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:55780: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)82.19.12.1032635167xI  -% ossec13001iExim Auth failed2025-11-17 17:21:03 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:57895: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)5.128.123.342017370eH  -Y% ossec13001iExim Auth failed2025-11-17 17:20:52 dovecot_login authenticator failed for ([183.6.102.11]) [183.6.102.11]:3938: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)183.6.102.111814991)G  e-# ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:20:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<4CIYFNBDoIEXXz9j>23.95.63.996252001dF  -Y# ossec13001iExim Auth failed2025-11-17 17:20:29 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:62046: 535 Incorrect authentication data (set_id=vanessalima)113.28.86.11819730   x[c  -?+ ossec13001ilExim Auth failed2025-11-17 17:24:12 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:46854: 535 Incorrect authentication data (set_id=cpfnc2)121.142.146.1671835841nb  -k% ossec13001iTExim Auth failed2025-11-17 17:23:48 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:23040: 535 Incorrect authentication data (set_id=tiago.diadio@vidaengenharia.com.br)211.93.6.2301814991na  -k% ossec13001iFExim Auth failed2025-11-17 17:23:34 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:59635: 535 Incorrect authentication data (set_id=tiago.diadio@vidaengenharia.com.br)60.174.39.821814991`  k' ossec9709iFMultiple Dovecot Aborted Logins with empty userNov 17 17:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -) ossec13001i`Exim Auth failed2025-11-17 17:24:00 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:43360: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)200.141.211.583469034X^  ;-) ossec13008iZMail Recipient rejected2025-11-17 17:23:53 H=(localhost) [179.42.148.135]:21166 F= rejected RCPT : Sender verify failed179.42.148.1353469034Z]  -I! ossec13001iVExim Auth failed2025-11-17 17:23:50 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:57443: 535 Incorrect authentication data (set_id=michael@deproi.com.br)5.32.99.14290557i\  -]) ossec13001ifExim Auth failed2025-11-17 17:24:06 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:53747: 535 Incorrect authentication data (set_id=tiago.diadio)196.47.172.2532287781[  W' ossec9708ibDovecot Aborted Login with empty userNov 17 17:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)Z  e') ossec9710i Dovecot Auth failed on disconnected session.Nov 17 17:22:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044Y W' ossec9708i Dovecot Aborted Login with empty userNov 17 17:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'X  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:22:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001SW  -5% ossec13001iExim Auth failed2025-11-17 17:22:52 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:36306: 535 Incorrect authentication data (set_id=contato)87.31.17.1313175395rV  -m+ ossec13001i Exim Auth failed2025-11-17 17:22:33 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:51868: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)103.146.233.2001269750,U  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:21:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387  zdeqnr  -e+ ossec13001iExim Auth failed2025-11-17 17:24:39 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:36190: 535 Incorrect authentication data (set_id=atualizacoes)165.220.169.1132635167pq  -i+ ossec13001iExim Auth failed2025-11-17 17:24:37 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:32926: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)125.139.124.1201835841'p  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:24:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<+VmtItBDCtfSchJs>210.114.18.1081835841Po  ;) ossec13008ijMail Recipient rejected2025-11-17 17:24:10 H=(localhost) [179.42.148.135]:21166 F= rejected RCPT : Sender verify failed179.42.148.1353469034n  -3% ossec13001iExim Auth failed2025-11-17 17:24:57 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:58803: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)80.14.56.1163017382%m  e%# ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<6ba/ItBDQLkIjQ01>8.141.13.531814991_l  -I) ossec13001iExim Auth failed2025-11-17 17:24:35 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:35071: 535 Incorrect authentication data (set_id=ferramentaria)218.156.93.2021835841k  -) ossec13001ivExim Auth failed2025-11-17 17:24:22 dovecot_login authenticator failed for c80-216-181-233.bredband.tele2.se [80.216.181.233]:41680: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)80.216.181.23326618861j  e9' ossec9710ihDovecot Auth failed on disconnected session.Nov 17 17:24:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<4xDkINBDasUkMrBu>36.50.176.1101562822ii  -[+ ossec13001iExim Auth failed2025-11-17 17:24:40 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:42516: 535 Incorrect authentication data (set_id=michael)165.220.130.1602510769h W' ossec9708iDovecot Aborted Login with empty userNov 17 17:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'g  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:24:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841if  -a% ossec13001iExim Auth failed2025-11-17 17:24:53 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:55232: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)183.99.89.741835841.e  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822id  -_' ossec13001irExim Auth failed2025-11-17 17:24:17 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:42718: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)65.191.211.336252001 &] C m 3 K Ukyh\  -A+ ossec13001iExim Auth failed2025-11-17 17:26:22 dovecot_login authenticator failed for (static.vnpt.vn) [113.183.191.127]:54026: 535 Incorrect authentication data (set_id=financeiro)113.183.191.1271562822e  -[# ossec13001iExim Auth failed2025-11-17 17:26:12 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:58048: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)46.8.246.272017370m  -i% ossec13001iExim Auth failed2025-11-17 17:26:09 dovecot_login authenticator failed for ([121.18.49.14]) [121.18.49.14]:27828: 535 Incorrect authentication data (set_id=cpfnc8@cartoriopinheirinho.com.br)121.18.49.141814991Y  -=) ossec13001iExim Auth failed2025-11-17 17:25:13 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:54318: 535 Incorrect authentication data (set_id=juliana)50.217.255.1716252001d~  -Q+ ossec13001iExim Auth failed2025-11-17 17:25:10 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51265: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651/}  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:25:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001Z|  -=+ ossec13001iExim Auth failed2025-11-17 17:25:50 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:52160: 535 Incorrect authentication data (set_id=paulo)154.144.255.2102542007n{  -e+ ossec13001iExim Auth failed2025-11-17 17:25:29 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:48425: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)181.233.140.2503469034fz  -[% ossec13001iExim Auth failed2025-11-17 17:25:27 dovecot_login authenticator failed for (ftth-139-60-85-21.hamiltoncom.net) [139.60.85.21]:33094: 535 Incorrect authentication data (set_id=contato)139.60.85.216252001ry  -m+ ossec13001iExim Auth failed2025-11-17 17:25:25 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:45744: 535 Incorrect authentication data (set_id=leandro)122.187.228.2311269750dx  -U' ossec13001iExim Auth failed2025-11-17 17:25:12 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:37494: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)222.120.176.618358416w  eA) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:25:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750Rv  -5% ossec13001iExim Auth failed2025-11-17 17:25:40 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:19994: 535 Incorrect authentication data (set_id=juliana)41.220.3.101226074u W' ossec9708iDovecot Aborted Login with empty userNov 17 17:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Et  -' ossec13001iExim Auth failed2025-11-17 17:24:53 dovecot_login authenticator failed for ([78.81.213.111]) [78.81.213.111]:36787: 535 Incorrect authentication data78.81.213.1112017370Vs  -9' ossec13001iExim Auth failed2025-11-17 17:24:52 dovecot_login authenticator failed for ([79.135.236.42]) [79.135.236.42]:60966: 535 Incorrect authentication data (set_id=eduardo)79.135.236.422017370 A ( 5 d a >PmvW]V  -9' ossec13001iZExim Auth failed2025-11-17 17:28:10 dovecot_login authenticator failed for ([111.26.61.243]) [111.26.61.244]:54064: 535 Incorrect authentication data (set_id=compras)111.26.61.2441814991v  -y' ossec13001iBExim Auth failed2025-11-17 17:27:46 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:60476: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)182.95.52.19412697503  e?% ossec9710i@Dovecot Auth failed on disconnected session.Nov 17 17:27:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<6CrLLdBDyMvSATzz>210.1.60.2431605651 W' ossec9708i4Dovecot Aborted Login with empty userNov 17 17:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`  -K) ossec13001iPExim Auth failed2025-11-17 17:28:00 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:41534: 535 Incorrect authentication data (set_id=isabellylisboa)220.72.159.2301835841f  -]# ossec13001iJExim Auth failed2025-11-17 17:27:54 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:51974: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)61.12.86.901269750s  -u% ossec13001iHExim Auth failed2025-11-17 17:27:52 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:53259: 535 Incorrect authentication data (set_id=laudicea.aquino@vidaengenharia.com.br)61.72.59.1061835841_  -G+ ossec13001iExim Auth failed2025-11-17 17:26:38 dovecot_login authenticator failed for ([222.170.255.146]) [222.170.255.146]:41370: 535 Incorrect authentication data (set_id=financeiro)222.170.255.1461814991j  -c% ossec13001iExim Auth failed2025-11-17 17:26:37 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:33684: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)61.73.190.981835841  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  - ' ossec13001iExim Auth failed2025-11-17 17:26:29 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:53988: 535 Incorrect authentication data (set_id=cpfnc8@cartoriopinheirinho.com.br)24.119.144.866252001M  -+# ossec13001iExim Auth failed2025-11-17 17:26:26 dovecot_login authenticator failed for ([110.16.40.3]) [110.16.40.3]:52158: 535 Incorrect authentication data (set_id=info)110.16.40.31814991o  -i) ossec13001iExim Auth failed2025-11-17 17:26:07 dovecot_login authenticator failed for ([182.79.31.107]) [152.52.199.126]:58776: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)152.52.199.1261269750  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001iExim Auth failed2025-11-17 17:26:48 dovecot_login authenticator failed for ([92.124.148.205]) [92.124.148.205]:55050: 535 Incorrect authentication data (set_id=cpfnc8)92.124.148.2052017370_  -I) ossec13001iExim Auth failed2025-11-17 17:26:46 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:38384: 535 Incorrect authentication data (set_id=memaagostinho)192.34.128.2026252001 G UEY6Gk  -a) ossec13001iExim Auth failed2025-11-17 17:29:35 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:33410: 535 Incorrect authentication data (set_id=edineia@letracaixa.art.br)111.61.176.2451814991  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3Wt7NNBDKImxV3kv>177.87.121.473469034h  -Y+ ossec13001iExim Auth failed2025-11-17 17:28:56 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:49155: 535 Incorrect authentication data (set_id=adriana)181.188.149.2433923057   -#) ossec13001i|Exim Auth failed2025-11-17 17:28:44 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:35237: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)178.140.95.22120173701  e=# ossec9710inDovecot Auth failed on disconnected session.Nov 17 17:28:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991   -) ossec13001i^Exim Auth failed2025-11-17 17:28:14 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:51613: 535 Incorrect authentication data (set_id=laudicea.aquino@vidaengenharia.com.br)220.246.42.2271819730'  e%' ossec9710ipDovecot Auth failed on disconnected session.Nov 17 17:28:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991d  -Q+ ossec13001ilExim Auth failed2025-11-17 17:28:27 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:43300: 535 Incorrect authentication data (set_id=laudicea.aquino)122.187.227.1991269750e  S5# ossec11000ilLogin failed on the cpanel service.[2025-11-17 17:28:27 -0300] info [cpaneld] 45.61.54.87 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified45.61.54.876252001'  e%' ossec9710i\Dovecot Auth failed on disconnected session.Nov 17 17:28:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084  -) ossec13001iExim Auth failed2025-11-17 17:29:04 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:43184: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)170.233.29.1753865483h  -_% ossec13001iExim Auth failed2025-11-17 17:28:51 dovecot_login authenticator failed for ([58.34.174.90]) [58.34.174.90]:59229: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)58.34.174.9018149911  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:28:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841 W' ossec9708ipDovecot Aborted Login with empty userNov 17 17:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  { Il6`z/ W' ossec9708i%Dovecot Aborted Login with empty userNov 17 17:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u.  -w' ossec13001i Exim Auth failed2025-11-17 17:31:28 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:24081: 535 Incorrect authentication data (set_id=pedagogico@educacionalevangelico.com.br)14.161.31.1721562822s-  -s' ossec13001i=Exim Auth failed2025-11-17 17:31:56 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:34502: 535 Incorrect authentication data (set_id=505657469286137@maringasoldas.com.br)182.42.113.101814991_,  -G+ ossec13001i1Exim Auth failed2025-11-17 17:31:43 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:53902: 535 Incorrect authentication data (set_id=pedagogico)122.187.227.1991269750e+  -W' ossec13001iExim Auth failed2025-11-17 17:30:29 dovecot_login authenticator failed for 111-70-25-161.emome-ip.hinet.net [111.70.25.161]:54426: 535 Incorrect authentication data (set_id=edineia)111.70.25.1611668284b*  -U# ossec13001iExim Auth failed2025-11-17 17:30:21 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:27040: 535 Incorrect authentication data (set_id=ivanski.rodrigo)60.8.73.1741814991R)  -5% ossec13001iExim Auth failed2025-11-17 17:30:05 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:33423: 535 Incorrect authentication data (set_id=edineia)41.220.3.1012260742(  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:30:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822Y'  -C% ossec13001iExim Auth failed2025-11-17 17:30:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64868: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758.&  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:30:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991% W' ossec9708iDovecot Aborted Login with empty userNov 17 17:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q$  -k+ ossec13001iExim Auth failed2025-11-17 17:29:22 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:39298: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)177.236.145.1883996063#  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0hVDNtBDGpSxV3kv>177.87.121.473469034"  - ) ossec13001iExim Auth failed2025-11-17 17:29:55 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:39937: 535 Incorrect authentication data (set_id=ivanski.rodrigo@vidaengenharia.com.br)178.150.135.19690791U!  ;+% ossec13008iMail Recipient rejected2025-11-17 17:29:42 H=(195.3.134.135) [179.0.178.53]:57841 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57841 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034  5 Z i B 8 INhwTP7VcX?  -?' ossec13001iExim Auth failed2025-11-17 17:33:36 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:57493: 535 Incorrect authentication data (set_id=financeiro)196.0.107.158226074o>  -k' ossec13001iExim Auth failed2025-11-17 17:33:21 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:35600: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)188.231.3.2463017382]=  -K# ossec13001iGExim Auth failed2025-11-17 17:32:06 dovecot_login authenticator failed for ([111.61.97.5]) [111.61.97.5]:61526: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)111.61.97.51814991<  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034;  - ) ossec13001iwExim Auth failed2025-11-17 17:32:54 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:53171: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)110.25.112.1451668284:  k' ossec9709iaMultiple Dovecot Aborted Logins with empty userNov 17 17:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8pI0P9BDTuGxV3kv>177.87.121.473469034m9  -i% ossec13001iGExim Auth failed2025-11-17 17:32:06 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:44110: 535 Incorrect authentication data (set_id=505657469286137)71.62.34.2166252001b8  -M+ ossec13001iExim Auth failed2025-11-17 17:33:03 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:7646: 535 Incorrect authentication data (set_id=bianca.user.it)119.204.125.1241835841w7  -y) ossec13001iwExim Auth failed2025-11-17 17:32:54 dovecot_login authenticator failed for ([46.148.100.210]) [46.148.100.210]:54130: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)46.148.100.2102017370k6  -_+ ossec13001iqExim Auth failed2025-11-17 17:32:47 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37560: 535 Incorrect authentication data (set_id=mecati)119.160.166.23718208145  -) ossec13001ieExim Auth failed2025-11-17 17:32:36 dovecot_login authenticator failed for syn-108-188-178-023.biz.spectrum.com [108.188.178.23]:51789: 535 Incorrect authentication data (set_id=bianca.user.it@globalmedica.com.br)108.188.178.236252001#4  e!# ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:31:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001m3  -c+ ossec13001iExim Auth failed2025-11-17 17:31:09 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:54818: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)154.144.255.2102542007W2  -9) ossec13001i-Exim Auth failed2025-11-17 17:31:39 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:33526: 535 Incorrect authentication data (set_id=jesse)192.34.128.2026252001g1  -]% ossec13001i#Exim Auth failed2025-11-17 17:31:29 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:47902: 535 Incorrect authentication data (set_id=jesse@vidaengenharia.com.br)119.6.108.131814991\0  -C) ossec13001iExim Auth failed2025-11-17 17:31:23 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:32580: 535 Incorrect authentication data (set_id=formula316)111.61.177.1901814991 ! 2 = # = ? N  W' ossec9708i3Dovecot Aborted Login with empty userNov 17 17:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4p+5S9BD5tqxV3kv>177.87.121.473469034M  So+ ossec11000iLogin failed on the cpanel service.[2025-11-17 17:34:26 -0300] info [webmaild] 195.181.163.129 - junior.gomes@sindeesfort.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect195.181.163.1296252001eL  -U) ossec13001iExim Auth failed2025-11-17 17:34:21 dovecot_login authenticator failed for (159-179-77-186.enitel.net.ni) [186.77.179.159]:54642: 535 Incorrect authentication data (set_id=contato)186.77.179.1593617476jK  -c% ossec13001iExim Auth failed2025-11-17 17:34:37 dovecot_login authenticator failed for (ftth-139-60-85-21.hamiltoncom.net) [139.60.85.21]:45431: 535 Incorrect authentication data (set_id=alex.vendas)139.60.85.216252001J W' ossec9708iDovecot Aborted Login with empty userNov 17 17:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6dFPRtBDqKixV3kv>177.87.121.473469034I  Sm) ossec11000iLogin failed on the cpanel service.[2025-11-17 17:34:27 -0300] info [webmaild] 200.110.153.22 - junior.gomes@sindeesfort.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect200.110.153.223703430H  - + ossec13001iExim Auth failed2025-11-17 17:34:26 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:57135: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)165.220.169.11326351673G  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822zF  -) ossec13001iExim Auth failed2025-11-17 17:34:06 dovecot_login authenticator failed for (92.84.8.221.adsl-pool.jlccptt.net.cn) [222.169.71.110]:8949: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)222.169.71.1101814991bE  -M+ ossec13001iExim Auth failed2025-11-17 17:33:31 dovecot_login authenticator failed for ([183.131.243.102]) [183.131.243.102]:35606: 535 Incorrect authentication data (set_id=paulo.user.it)183.131.243.1021814991D W' ossec9708iDovecot Aborted Login with empty userNov 17 17:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qC  -s% ossec13001iExim Auth failed2025-11-17 17:33:24 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:39164: 535 Incorrect authentication data (set_id=ferramentaria)5.199.161.79597427kB  -i% ossec13001iExim Auth failed2025-11-17 17:33:10 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:50981: 535 Incorrect authentication data (set_id=paulo.user.it@louvoreterno.com.br)65.20.174.6399237XA  -?% ossec13001iExim Auth failed2025-11-17 17:33:58 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:33440: 535 Incorrect authentication data (set_id=bruno.garcia)183.99.89.741835841@  - ) ossec13001iExim Auth failed2025-11-17 17:33:47 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:33508: 535 Incorrect authentication data (set_id=bruno.garcia@deproi.com.br)123.193.152.641668284 j <]CjU_  -7' ossec13001iExim Auth failed2025-11-17 17:37:34 dovecot_login authenticator failed for ([116.232.46.23]) [116.232.46.23]:48481: 535 Incorrect authentication data (set_id=cpfnc2)116.232.46.231814991^  3G' ossec11301iNew FTP connection.Nov 17 17:37:21 hosting pure-ftpd: (?@41.84.146.238) [INFO] New connection from 41.84.146.23841.84.146.238192950l]  -e' ossec13001i9Exim Auth failed2025-11-17 17:36:08 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:45129: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)175.115.29.391835841\\  -C) ossec13001iqExim Auth failed2025-11-17 17:37:04 dovecot_login authenticator failed for (User) [177.74.174.120]:63986: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)177.74.174.1203469034#[  3K) ossec11301icNew FTP connection.Nov 17 17:36:49 hosting pure-ftpd: (?@198.235.24.107) [INFO] New connection from 198.235.24.107198.235.24.1076252001[Z  -A) ossec13001iGExim Auth failed2025-11-17 17:36:22 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:53982: 535 Incorrect authentication data90.161.217.2282510769\Y  -C) ossec13001i9Exim Auth failed2025-11-17 17:36:07 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:30842: 535 Incorrect authentication data (set_id=assessoria)111.61.175.1181814991hX  -[) ossec13001iqExim Auth failed2025-11-17 17:37:05 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:56744: 535 Incorrect authentication data (set_id=contato)43.245.186.1211643084vW  -u+ ossec13001ieExim Auth failed2025-11-17 17:36:52 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35158: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)197.219.228.2421036973kV  -c' ossec13001icExim Auth failed2025-11-17 17:36:51 dovecot_login authenticator failed for ([58.240.26.106]) [58.240.26.106]:64673: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)58.240.26.1061814991]U  -K# ossec13001icExim Auth failed2025-11-17 17:36:50 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:38572: 535 Incorrect authentication data (set_id=contato)121.6.81.591880251T W' ossec9708iQDovecot Aborted Login with empty userNov 17 17:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_S  -K' ossec13001iOExim Auth failed2025-11-17 17:36:30 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57472: 535 Incorrect authentication data (set_id=xavier)152.231.25.643686110pR  -m' ossec13001i/Exim Auth failed2025-11-17 17:35:57 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:40763: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)190.85.134.203686110(Q  e'' ossec9710i-Dovecot Auth failed on disconnected session.Nov 17 17:35:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084P  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jO  -_) ossec13001i5Exim Auth failed2025-11-17 17:36:03 dovecot_login authenticator failed for ([70.174.168.100]) [70.174.168.100]:45095: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)70.174.168.1006252001  xMliPu}dn  -W% ossec13001iExim Auth failed2025-11-17 17:38:18 dovecot_login authenticator failed for ([14.248.94.49]) [14.248.94.49]:47394: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)14.248.94.491562822tm  -s) ossec13001iExim Auth failed2025-11-17 17:38:16 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:44047: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)115.141.143.581835841Wl  -?' ossec13001iExim Auth failed2025-11-17 17:38:06 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:34861: 535 Incorrect authentication data (set_id=formula316)65.20.171.11699237k  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\i  -E' ossec13001iExim Auth failed2025-11-17 17:38:46 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:44232: 535 Incorrect authentication data (set_id=ferramentaria)88.84.205.1042017370]h -C) ossec13001iwExim Auth failed2025-11-17 17:37:10 dovecot_login authenticator failed for (User) [177.74.174.120]:63986: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)177.74.174.1203469034'g  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:37:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358413f  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:37:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.20222333875e  eC% ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:37:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382vd  -y' ossec13001iExim Auth failed2025-11-17 17:37:31 dovecot_login authenticator failed for 111-70-31-135.emome-ip.hinet.net [111.70.31.135]:36096: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)111.70.31.1351668284c W' ossec9708iDovecot Aborted Login with empty userNov 17 17:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Ub  -7' ossec13001i{Exim Auth failed2025-11-17 17:37:14 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:43413: 535 Incorrect authentication data (set_id=cpfnc2)37.79.255.10420173706a  eA) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:38:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084m`  -c+ ossec13001iExim Auth failed2025-11-17 17:37:53 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:60397: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)200.149.213.2423469034 f*H   ~tj`VLB8.$\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $     R z H > p 4 f * \  bXvlND:0&|rh^T"J@6,PFx<ndZ2( j`~tVLB8.$zRHpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (zpf>4*  vlbXND:0& i c i b i d i ` i _ i ^ i ] i \ i [ i Z i Y i X i W i V i U i T i S i R i Q i P i O i N iv M ip L ih K i^ J i^ I iV H i G i F i8 E i2 D i* C i" B i A i @ i ? i > i = i < i ; i : i 9 i 8 i 7 i 6 i 5 i 4 i 3 i 2 i 1 i 0 i / i . i - i , i + i * i ) i ( i ' i & iu % im $ ie # i_ " i ! i i=  i3  i1  i#  i!  i  iO  i?  i)  i%  i  i  i  i  i  i  i  i  i i i i i i  i  i  i  i  i  i  i  i i i} iY iA i i i% i i i i i i i i i i i i i i i i iw i i i i i i{ i i i i iq iq ie ic ic ic iQ iO iG i9 i9 i5 i3 i/ i- i i i i i i i i i i i i i i i i i i i iw iw iq ie iv k ir d il c ij o i i i i i i i i i iy ib iL i> i6  i ~ i } i | i { i v i u i t i z i y i x i w i q i p i o it n ir s ip r il h if g ib m iZ l iL k iL j i4 i i* a i" f i e ia iG iG i= i1 i- i% i# i i i i i i i i i i i i i i i i i i i i i i| ip ip in il il i^ i\ iZ iP iJ iH iB  i i@ i4 i i i i i i i i i i i i i } i | i v i u i { i z i y i  i x i ~ i w i n i g i t i f i s i e i r i i i q i m i p i l i h    E G WynT4}  e?' ossec9710iYDovecot Auth failed on disconnected session.Nov 17 17:40:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084| W' ossec9708iADovecot Aborted Login with empty userNov 17 17:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1tbNW9BDBpCxV3kv>177.87.121.473469034){  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:39:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750z  -+ ossec13001iExim Auth failed2025-11-17 17:39:06 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:39375: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)201.173.216.1043996063]y  -G) ossec13001i%Exim Auth failed2025-11-17 17:40:04 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:40326: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549x W' ossec9708iDovecot Aborted Login with empty userNov 17 17:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Sw  -5% ossec13001iExim Auth failed2025-11-17 17:39:25 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:60413: 535 Incorrect authentication data (set_id=contato)94.50.162.662017370Zv  -E# ossec13001iExim Auth failed2025-11-17 17:39:19 dovecot_login authenticator failed for ([111.4.78.74]) [111.4.78.74]:41456: 535 Incorrect authentication data (set_id=comercial.user.it)111.4.78.741814991lu  -a+ ossec13001iExim Auth failed2025-11-17 17:38:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51889: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651zt  -' ossec13001iExim Auth failed2025-11-17 17:38:42 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:56900: 535 Incorrect authentication data (set_id=comercial.user.it@inovasite.com)82.65.140.2183017382Vs  -7) ossec13001iExim Auth failed2025-11-17 17:38:33 dovecot_login authenticator failed for ([123.24.148.249]) [123.24.148.249]:34627: 535 Incorrect authentication data (set_id=maia)123.24.148.2491562822nr  -k% ossec13001iExim Auth failed2025-11-17 17:38:32 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:60280: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)1.212.225.991835841gq  -Y) ossec13001iExim Auth failed2025-11-17 17:38:26 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:57857: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)218.67.123.2021814991Xp  -;) ossec13001iExim Auth failed2025-11-17 17:38:46 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:56310: 535 Incorrect authentication data (set_id=eliezer)122.186.200.101269750$o  e## ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:38:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991 0Wquh[NA_RE8+ f -  r e X K > 1 $ 0cVxk^Q</"UH;.!}pob | s  G :  tgZM@3&  v i \ O B 5 (    =d~4'`SF9,   zm~qdWJ=0#yIJlD7 { n*  Y L ? 2 %   Y % ? 2 L f ] P C 6 )    1814991$ 1814991( 1814991* 1814991#c 1814991( 1814991#g 1814991( 1814991( 1814991#v 1814991#u 1814991( 1814991( 1814991# 1814991# 1814991# 1814991# 1814991#w 1814991)e 1814991)a 1814991( 1814991( 1814991# 1814991# 1814991# 1814991# 1814991# 1814991) 1814991) 1814991)| 1814991)t 1814991* 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991# 1814991# 1814991# 1814991# 1814991* 1814991* 1814991* 1814991* 1814991*M 1814991*8 1814991* 1814991* 1814991* 1814991) 1814991$9 1814991$2 1814991$% 1814991$! 1814991%c 1814991%^ 1814991%Q 1814991* 1814991$ 1814991$ 1814991% 1814991% 1814991%~ 1814991%j 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991's 1814991'^ 1814991'W 1814991'? 1814991'5 1814991& 1814991& 1814991& 1814991$S 1814991$? 1814991+e 1814991+b 1814991+_ 1814991+= 1814991+, 1814991+ 1814991* 1814991%O 1814991%B 1814991%; 1814991%1 1814991%* 1814991% 1814991% 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991& 1814991& 1814991% 1814991&' 1814991&$ 1814991&U 1814991* 1814991&j 1814991* 1814991&w 1814991& 1814991& 1814991& 1814991+ 1814991+ 1814991+ 1814991+ 1814991+k 1814991$Z 1814991& 1814991& 1814991% 1814991% 1814991% ' 1814991+ 1814991+ 1814991+ 1814991+ 1814991&7 T 1814991$\ 1814991&o 1814991&Z  1814991+* 1814991+ 1814991+ 1814991+ 1814991+U 1814991+R 1814991+N 1814991+>A 1814991$ 1814991$ 1814991$v 1814991$u 1814991$p 1814991$n 1814991$l 1814991$k 1814991$j 1814991$^ 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991(y 1814991(k 1814991(h 1814991(C 1814991(B 1814991(9 1814991(3 1814991(. 1814991() 1814991($ 1814991' 1814991)\ 1814991)[ 1814991)X 1814991)U 1814991)D 1814991)? 1814991)6 1814991). 1814991)' 1814991)$ 1814991)" 1814991) 1814991) 1814991) 1814991) 1814991) 1814991( 1814991( 1814991* 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991* 1814991* 1814991*} 1814991*x 1814991*u 1814991*m 1814991*l 1814991*j 1814991*g 1814991*N 1814991* 1814991* 1814991* 1814991* 1814991$ 1814991$ 1814991$ 1814991&  tpr  -o) ossec13001i Exim Auth failed2025-11-17 17:43:54 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:50412: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)181.115.237.193923057[  -E% ossec13001i Exim Auth failed2025-11-17 17:43:52 dovecot_login authenticator failed for ([78.37.60.135]) [78.37.60.135]:51290: 535 Incorrect authentication data (set_id=administrativo1)78.37.60.1352017370] -C) ossec13001iExim Auth failed2025-11-17 17:43:18 dovecot_login authenticator failed for (User) [177.74.174.120]:50204: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)177.74.174.12034690340  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:44:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991   -#) ossec13001iExim Auth failed2025-11-17 17:44:01 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:58466: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)123.193.152.641668284k  -c) ossec13001iExim Auth failed2025-11-17 17:44:03 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:24875: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)196.190.180.19337996p  -o% ossec13001iExim Auth failed2025-11-17 17:43:15 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:40936: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)46.8.246.1832017370Y  -=) ossec13001iExim Auth failed2025-11-17 17:43:32 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:54548: 535 Incorrect authentication data (set_id=contato)192.34.128.20262520014  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:42:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822 W' ossec9708iDovecot Aborted Login with empty userNov 17 17:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -;# ossec13001iExim Auth failed2025-11-17 17:42:18 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:41768: 535 Incorrect authentication data (set_id=fernandabrum)113.59.34.51814991r  -m+ ossec13001iExim Auth failed2025-11-17 17:42:10 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:33168: 535 Incorrect authentication data (set_id=fernandabrum@prafebrum.com.br)218.146.133.1171835841  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:41:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<3lDgX9BDgMkkMrBu>36.50.176.1101562822~  k' ossec9709i}Multiple Dovecot Aborted Logins with empty userNov 17 17:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+kBfX9BDsrqxV3kv>177.87.121.473469034    BP`k]  -G' ossec13001i#Exim Auth failed2025-11-17 17:44:19 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:36634: 535 Incorrect authentication data (set_id=isabellylisboa)182.95.223.461269750S  -5% ossec13001i!Exim Auth failed2025-11-17 17:44:17 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:40003: 535 Incorrect authentication data (set_id=contato)59.98.144.361269750Y ;-) ossec13008iMail Recipient rejected2025-11-17 17:44:15 H=(localhost) [187.16.187.141]:17786 F= rejected RCPT <3BZGXETqqjZYA24@box911.com.br>: Sender verify failed187.16.187.1413469034  W' ossec9708iODovecot Aborted Login with empty userNov 17 17:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001i?Exim Auth failed2025-11-17 17:44:47 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:50766: 535 Incorrect authentication data (set_id=rafael)182.149.67.2001814991l  -c) ossec13001i)Exim Auth failed2025-11-17 17:44:24 dovecot_login authenticator failed for ([103.251.31.154]) [103.251.31.154]:51128: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)103.251.31.1541269750n  -i' ossec13001i%Exim Auth failed2025-11-17 17:44:21 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:61578: 535 Incorrect authentication data (set_id=formula316)34.84.162.1771861060V  -;% ossec13001iExim Auth failed2025-11-17 17:44:10 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:54300: 535 Incorrect authentication data (set_id=financeiro)111.26.63.871814991e  -Y% ossec13001iExim Auth failed2025-11-17 17:44:07 dovecot_login authenticator failed for 111-70-13-23.emome-ip.hinet.net [111.70.13.23]:37495: 535 Incorrect authentication data (set_id=financeiro)111.70.13.231668284w  -y) ossec13001iExim Auth failed2025-11-17 17:43:40 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:52586: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)221.234.48.1471814991 W' ossec9708iDovecot Aborted Login with empty userNov 17 17:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -I) ossec13001iExim Auth failed2025-11-17 17:43:27 dovecot_login authenticator failed for (rev.perfectinternet.in) [103.12.132.157]:58738: 535 Incorrect authentication data (set_id=adriana)103.12.132.1571269750i  -a% ossec13001iExim Auth failed2025-11-17 17:43:11 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:50492: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)211.196.31.21835841-  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:44:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822m  -g' ossec13001i Exim Auth failed2025-11-17 17:43:53 dovecot_login authenticator failed for ([61.150.11.135]) [61.150.11.135]:43492: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)61.150.11.1351814991p  -m' ossec13001i Exim Auth failed2025-11-17 17:43:55 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:36469: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)187.58.241.903469034  t+ W' ossec9708iDovecot Aborted Login with empty userNov 17 17:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b*  -W# ossec13001iExim Auth failed2025-11-17 17:46:19 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:58620: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)194.31.8.12614540k)  -a) ossec13001iExim Auth failed2025-11-17 17:46:13 dovecot_login authenticator failed for ([223.243.24.178]) [223.243.24.178]:60286: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)223.243.24.1781814991Z(  -A' ossec13001iExim Auth failed2025-11-17 17:47:04 dovecot_login authenticator failed for ([36.135.107.56]) [36.135.107.57]:54192: 535 Incorrect authentication data (set_id=atendimento)36.135.107.571814991y'  -}) ossec13001iExim Auth failed2025-11-17 17:46:58 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:44712: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)221.120.57.1251668284W&  -=% ossec13001iExim Auth failed2025-11-17 17:46:44 dovecot_login authenticator failed for ([118.42.52.79]) [118.42.52.79]:56971: 535 Incorrect authentication data (set_id=atendimento)118.42.52.791835841V%  -9' ossec13001iuExim Auth failed2025-11-17 17:45:41 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:36590: 535 Incorrect authentication data (set_id=contato)111.26.79.1121814991$ W' ossec9708imDovecot Aborted Login with empty userNov 17 17:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6kmwbdBDoM+xV3kv>177.87.121.4734690340#  e9' ossec9710ieDovecot Auth failed on disconnected session.Nov 17 17:45:25 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.238.166.52, lip=200.150.196.245, TLS, session=91.238.166.52798544m"  -e) ossec13001i_Exim Auth failed2025-11-17 17:45:18 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:43469: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)111.85.118.1471814991a!  -O' ossec13001iExim Auth failed2025-11-17 17:46:05 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58076: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.721819730m  -e) ossec13001iExim Auth failed2025-11-17 17:45:52 dovecot_login authenticator failed for ([124.67.120.106]) [124.67.120.106]:60019: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)124.67.120.1061814991$  e!' ossec9710i=Dovecot Auth failed on disconnected session.Nov 17 17:44:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758(  e+# ossec9710i3Dovecot Auth failed on disconnected session.Nov 17 17:44:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001  k' ossec9709i1Multiple Dovecot Aborted Logins with empty userNov 17 17:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034     " E O[8izY;  -C% ossec13001iExim Auth failed2025-11-17 17:47:56 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:57637: 535 Incorrect authentication data (set_id=isabellylisboa)195.43.5.222357994d:  -W% ossec13001iExim Auth failed2025-11-17 17:47:47 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:49262: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)58.16.201.521814991y9  -}) ossec13001iExim Auth failed2025-11-17 17:47:44 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:58729: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)103.168.241.321269750Z8  -=+ ossec13001iExim Auth failed2025-11-17 17:47:34 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:48582: 535 Incorrect authentication data (set_id=contato)128.185.254.1621269750s7  -u' ossec13001iExim Auth failed2025-11-17 17:47:31 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:45631: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)94.207.20.193290557k6  -a) ossec13001iExim Auth failed2025-11-17 17:47:23 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:55456: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)175.43.184.2021814991K5  -+ ossec13001iExim Auth failed2025-11-17 17:47:21 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:60816: 535 Incorrect authentication data211.198.128.12418358414  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p3  -k) ossec13001iExim Auth failed2025-11-17 17:47:15 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:42244: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)113.219.177.951814991r2  -q' ossec13001iExim Auth failed2025-11-17 17:47:06 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:49734: 535 Incorrect authentication data (set_id=eduardo)118.212.79.211814991Y1  -=) ossec13001iExim Auth failed2025-11-17 17:46:32 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:55766: 535 Incorrect authentication data (set_id=eduardo)122.187.220.301269750w0  -}% ossec13001iExim Auth failed2025-11-17 17:46:25 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:55560: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)92.189.80.732510769}/  -' ossec13001iExim Auth failed2025-11-17 17:46:13 dovecot_login authenticator failed for (h-91-126-245-87.wholesale.adamo.es) [91.126.245.87]:40914: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)91.126.245.872510769n.  -g) ossec13001iExim Auth failed2025-11-17 17:47:00 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:40982: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)119.201.59.2241835841w-  -w+ ossec13001iExim Auth failed2025-11-17 17:46:42 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:46933: 535 Incorrect authentication data (set_id=atualizacoes)122.187.229.2471269750q,  -o' ossec13001iExim Auth failed2025-11-17 17:46:38 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:58587: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)103.148.92.571168579  h A'DI W' ossec9708i^Dovecot Aborted Login with empty userNov 17 17:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5EX9e9BDloCxV3kv>177.87.121.473469034.H  e3' ossec9710iVDovecot Auth failed on disconnected session.Nov 17 17:49:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991dG  -W% ossec13001iExim Auth failed2025-11-17 17:48:21 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:57530: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)182.95.54.101269750wF  -}% ossec13001iExim Auth failed2025-11-17 17:48:12 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:51319: 535 Incorrect authentication data (set_id=andre.nascimento)31.199.10.823175395:E  eG+ ossec9710i8Dovecot Auth failed on disconnected session.Nov 17 17:48:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001*D  e)) ossec9710i2Dovecot Auth failed on disconnected session.Nov 17 17:48:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750_C  -K' ossec13001i*Exim Auth failed2025-11-17 17:48:40 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:34788: 535 Incorrect authentication data (set_id=andre.nascimento)120.157.13.612077456B W' ossec9708i"Dovecot Aborted Login with empty userNov 17 17:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#A  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.1371307581@  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:47:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387t?  -s+ ossec13001iExim Auth failed2025-11-17 17:47:34 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:55850: 535 Incorrect authentication data (set_id=financeiro)178.183.110.215798544>  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:47:28 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.38, lip=191.243.196.56, TLS, session=87.236.176.3826351671=  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:47:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822<  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  X  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wW  -w+ ossec13001iExim Auth failed2025-11-17 17:50:42 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:33922: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)165.220.130.1602510769V  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qU  -m) ossec13001iExim Auth failed2025-11-17 17:50:28 dovecot_login authenticator failed for ([208.69.161.241]) [208.69.161.241]:56220: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)208.69.161.2416252001)T  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:50:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758sS  -q) ossec13001iExim Auth failed2025-11-17 17:50:41 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:44354: 535 Incorrect authentication data (set_id=alex.vendas)122.186.244.341269750UR  -;% ossec13001iExim Auth failed2025-11-17 17:50:36 dovecot_login authenticator failed for ([41.60.23.246]) [41.60.23.246]:34072: 535 Incorrect authentication data (set_id=financeiro)41.60.23.246895949aQ -I+ ossec13001iExim Auth failed2025-11-17 17:50:27 dovecot_login authenticator failed for (radiosarabrasil.fm.br) [111.122.211.212]:64282: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991^P  -I' ossec13001iExim Auth failed2025-11-17 17:50:20 dovecot_login authenticator failed for ([60.216.89.122]) [60.216.89.122]:44976: 535 Incorrect authentication data (set_id=administrativo1)60.216.89.12218149914O  e=) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:51:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044SN  -7# ossec13001iExim Auth failed2025-11-17 17:51:01 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:36867: 535 Incorrect authentication data (set_id=marialuiza)60.174.86.41814991pM  -o) ossec13001ivExim Auth failed2025-11-17 17:49:56 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:44520: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)196.216.81.12649518(L  e#+ ossec9710ipDovecot Auth failed on disconnected session.Nov 17 17:49:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001tK  -u' ossec13001ihExim Auth failed2025-11-17 17:49:43 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:36110: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)182.95.115.3812697506J  e?+ ossec9710i^Dovecot Auth failed on disconnected session.Nov 17 17:49:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 O wYOg  -' ossec13001ifExim Auth failed2025-11-17 17:53:57 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:53578: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)93.85.230.107630336'f  e#) ossec9710i"Dovecot Auth failed on disconnected session.Nov 17 17:52:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.18.166.128, lip=200.150.196.245, TLS, session=103.18.166.1281269750oe  -i) ossec13001iExim Auth failed2025-11-17 17:52:43 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:60285: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)180.137.151.931814991d W' ossec9708iDovecot Aborted Login with empty userNov 17 17:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  - ) ossec13001iExim Auth failed2025-11-17 17:52:15 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:39630: 535 Incorrect authentication data (set_id=andressa.financeiro)162.84.155.1906252001:b  eK' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:52:15 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=177.85.138.85, lip=200.150.196.245, TLS, session=177.85.138.853469034ia  -_' ossec13001i*Exim Auth failed2025-11-17 17:52:57 dovecot_login authenticator failed for (nsg-static-121.34.76.182-airtel.com) [182.78.93.170]:46098: 535 Incorrect authentication data (set_id=xavier)182.78.93.1701269750,`  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:52:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841j_  -c% ossec13001iExim Auth failed2025-11-17 17:52:17 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:35082: 535 Incorrect authentication data (set_id=info.user.it)71.229.1.1866252001p^  -q# ossec13001iExim Auth failed2025-11-17 17:52:04 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:47128: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)1.180.62.411814991p]  -m' ossec13001iExim Auth failed2025-11-17 17:51:45 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:35668: 535 Incorrect authentication data (set_id=andre.nascimento.it)200.89.159.593865483y\  -{+ ossec13001iExim Auth failed2025-11-17 17:51:34 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:15190: 535 Incorrect authentication data (set_id=info.user.it@lixadoracuritiba.com.br)122.225.203.1061814991[ W' ossec9708iDovecot Aborted Login with empty userNov 17 17:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$Z  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991wY  -{' ossec13001iExim Auth failed2025-11-17 17:51:16 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:43936: 535 Incorrect authentication data (set_id=andre.nascimento.it@calcautomacao.com.br)195.24.215.702233387  f}ev -W% ossec13001iExim Auth failed2025-11-17 17:55:54 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.213.8]:32808: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)104.28.213.83469034eu -W% ossec13001iExim Auth failed2025-11-17 17:55:43 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.213.9]:42682: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)104.28.213.93469034t W' ossec9708iDovecot Aborted Login with empty userNov 17 17:55:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0YV3kdBD2NaxV3kv>177.87.121.473469034^s  -G) ossec13001irExim Auth failed2025-11-17 17:54:09 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:22859: 535 Incorrect authentication data (set_id=fabio.vendas)171.244.61.1371562822ir  -a% ossec13001ipExim Auth failed2025-11-17 17:54:08 dovecot_login authenticator failed for (187.95.21.18.netjacarei.nipcable.com) [187.95.21.18]:46570: 535 Incorrect authentication data (set_id=contato)187.95.21.183469034qq  -o' ossec13001iExim Auth failed2025-11-17 17:54:57 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:47054: 535 Incorrect authentication data (set_id=contato@compensadosparana.com.br)118.121.234.51814991ep  -U+ ossec13001iExim Auth failed2025-11-17 17:54:43 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:49494: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795o W' ossec9708iDovecot Aborted Login with empty userNov 17 17:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|n  -% ossec13001itExim Auth failed2025-11-17 17:54:11 dovecot_login authenticator failed for (contabilidadefollador.com.br) [60.2.243.174]:43882: 535 Incorrect authentication data (set_id=admin@contabilidadefollador.com.br)60.2.243.1741814991+m  e+) ossec9710ibDovecot Auth failed on disconnected session.Nov 17 17:53:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841al  -Q% ossec13001iZExim Auth failed2025-11-17 17:53:46 dovecot_login authenticator failed for (contabilidadefollador.com.br) [60.2.243.174]:40556: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991vk  -w) ossec13001iLExim Auth failed2025-11-17 17:53:31 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:49321: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)46.212.110.2373144096j  k' ossec9709iLMultiple Dovecot Aborted Logins with empty userNov 17 17:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5hhEitBDcJexV3kv>177.87.121.4734690342i  e7+ ossec9710i4Dovecot Auth failed on disconnected session.Nov 17 17:53:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001h  W' ossec9708ilDovecot Aborted Login with empty userNov 17 17:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0I4VjNBDPquxV3kv>177.87.121.473469034 o  2   o  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  -y' ossec13001iExim Auth failed2025-11-17 17:58:49 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:53534: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)82.65.140.2183017382 W' ossec9708iyDovecot Aborted Login with empty userNov 17 17:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+r0rnNBD8MCxV3kv>177.87.121.473469034,  e-) ossec9710ibDovecot Auth failed on disconnected session.Nov 17 17:58:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=103.56.148.1081643084(  e#+ ossec9710iLDovecot Auth failed on disconnected session.Nov 17 17:57:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841 W' ossec9708i>Dovecot Aborted Login with empty userNov 17 17:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -S+ ossec13001i6Exim Auth failed2025-11-17 17:57:25 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55597: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651~  W' ossec9708iDovecot Aborted Login with empty userNov 17 17:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l}  -e' ossec13001iExim Auth failed2025-11-17 17:57:01 dovecot_login authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:60096: 535 Incorrect authentication data (set_id=contato)85.30.248.2132017370}|  -' ossec13001i Exim Auth failed2025-11-17 17:56:41 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:52472: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)152.231.25.643686110{  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 17:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\z  -E' ossec13001iExim Auth failed2025-11-17 17:55:32 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:42694: 535 Incorrect authentication data (set_id=envios)51.68.226.1713017382cy  -U% ossec13001iExim Auth failed2025-11-17 17:55:20 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:38500: 535 Incorrect authentication data (set_id=envios@comercial.art.br)31.173.2.1822017370Tx  -9' ossec13001iExim Auth failed2025-11-17 17:55:18 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:38321: 535 Incorrect authentication data (set_id=contato)65.20.237.19199237+w  U7+ ossec11001iDeferred login on the cpanel service[2025-11-17 17:55:13 -0300] info [webmaild] 177.135.232.235 - diretoria@eaglebpo.com.br "GET /cpsess6120534665/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect177.135.232.2353469034 C xC.  A[# ossec11302iFTP Authentication failed.Nov 17 18:01:13 hosting pure-ftpd: (?@5.38.115.28) [WARNING] Authentication failed for user [anonymous]5.38.115.28290557r  -m+ ossec13001iExim Auth failed2025-11-17 18:01:06 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:38172: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)122.224.154.1661814991v  SQ) ossec11000iLogin failed on the cpanel service.[2025-11-17 18:01:06 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect191.177.160.6434690348  E ossec2501iUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127k  -c' ossec13001iExim Auth failed2025-11-17 18:00:56 dovecot_login authenticator failed for ([111.26.100.77]) [111.26.100.77]:35760: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)111.26.100.771814991$  e## ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:00:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001[  -A) ossec13001iExim Auth failed2025-11-17 18:00:50 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:40670: 535 Incorrect authentication data (set_id=venesselume)187.50.194.1823469034 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:00:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -?' ossec13001iExim Auth failed2025-11-17 18:00:29 dovecot_login authenticator failed for ([83.143.205.50]) [83.143.205.50]:41753: 535 Incorrect authentication data (set_id=formula316)83.143.205.50690791g  -[' ossec13001iExim Auth failed2025-11-17 18:00:16 dovecot_login authenticator failed for ([125.23.235.41]) [182.95.49.186]:52816: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)182.95.49.18612697500 UA) ossec11001iDeferred login on the cpanel service[2025-11-17 18:01:02 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034^  -K' ossec13001iExim Auth failed2025-11-17 17:59:06 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:41388: 535 Incorrect authentication data (set_id=ieqcampocomprido)91.239.23.149458258  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p  -k) ossec13001iExim Auth failed2025-11-17 18:00:02 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:8072: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)216.194.174.276252001-  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 17:59:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<3HCooNBDdNad5hjP>157.230.24.20729210440 UA) ossec11001iDeferred login on the cpanel service[2025-11-17 17:59:42 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034   4 J I lIM:!i$  -_' ossec13001i{Exim Auth failed2025-11-17 18:02:49 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:59661: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)186.5.178.22938654835# UK) ossec11001iiDeferred login on the cpanel service[2025-11-17 18:02:31 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess5074341100/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034"  -%+ ossec13001iWExim Auth failed2025-11-17 18:02:13 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:32863: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)107.135.117.2456252001!  -+ ossec13001iExim Auth failed2025-11-17 18:03:01 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:59264: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)103.203.210.1191269750  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9DE9rNBDPNmxV3kv>177.87.121.473469034  --% ossec13001iqExim Auth failed2025-11-17 18:02:40 dovecot_login authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:53864: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)95.79.57.2212017370x  -y+ ossec13001imExim Auth failed2025-11-17 18:02:35 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:36684: 535 Incorrect authentication data (set_id=secretarioadjunto)190.121.193.1263595528  k' ossec9709iiMultiple Dovecot Aborted Logins with empty userNov 17 18:02:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001iOExim Auth failed2025-11-17 18:02:06 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:60612: 535 Incorrect authentication data (set_id=adriana)92.126.223.1752017370}  - % ossec13001iAExim Auth failed2025-11-17 18:01:51 dovecot_login authenticator failed for (host87-89-16-178.reedlan.com) [178.16.89.87]:34061: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)178.16.89.87690791f  -Y' ossec13001i-Exim Auth failed2025-11-17 18:01:31 dovecot_login authenticator failed for (156.32.245.49.unknown.m1.com.sg) [49.245.32.156]:45623: 535 Incorrect authentication data (set_id=contato)49.245.32.1561880251X  -=' ossec13001iExim Auth failed2025-11-17 18:01:16 dovecot_login authenticator failed for ([59.144.100.41]) [182.95.57.158]:46080: 535 Incorrect authentication data (set_id=sec.geral)182.95.57.1581269750  3?# ossec11301iNew FTP connection.Nov 17 18:01:09 hosting pure-ftpd: (?@5.38.115.28) [INFO] New connection from 5.38.115.285.38.115.28290557 W' ossec9708i-Dovecot Aborted Login with empty userNov 17 18:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345 UK) ossec11001i-Deferred login on the cpanel service[2025-11-17 18:01:31 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess5074341100/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034   ( S W x ^_f4  -W) ossec13001iExim Auth failed2025-11-17 18:04:53 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:53504: 535 Incorrect authentication data (set_id=design@inovasite.com)103.251.143.1412697503 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f2  -Y' ossec13001iExim Auth failed2025-11-17 18:03:33 dovecot_login authenticator failed for ([140.235.89.71]) [162.213.224.4]:52150: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)162.213.224.46252001[1  -C' ossec13001iExim Auth failed2025-11-17 18:03:14 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:59366: 535 Incorrect authentication data (set_id=atualizacoes)182.95.52.1941269750\0  -A+ ossec13001iExim Auth failed2025-11-17 18:03:06 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:40511: 535 Incorrect authentication data (set_id=contato)194.179.135.1742661886U/  -7' ossec13001iExim Auth failed2025-11-17 18:04:02 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:58910: 535 Incorrect authentication data (set_id=rafael)183.171.53.821733045'.  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:04:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387s-  -u% ossec13001iExim Auth failed2025-11-17 18:03:48 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:43287: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)61.72.58.2421835841Y,  -?' ossec13001iExim Auth failed2025-11-17 18:03:45 dovecot_login authenticator failed for ([111.57.17.169]) [111.57.17.169]:51738: 535 Incorrect authentication data (set_id=financeiro)111.57.17.1691814991+ W' ossec9708iDovecot Aborted Login with empty userNov 17 18:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[*  -C) ossec13001iExim Auth failed2025-11-17 18:03:13 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:50216: 535 Incorrect authentication data (set_id=financeiro)94.131.211.168690791x)  -y+ ossec13001iExim Auth failed2025-11-17 18:03:05 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:44636: 535 Incorrect authentication data (set_id=administrativo1)166.195.195.1696252001Q(  -/' ossec13001iExim Auth failed2025-11-17 18:03:45 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:51382: 535 Incorrect authentication data (set_id=ti)222.104.76.941835841s'  -w# ossec13001iExim Auth failed2025-11-17 18:03:44 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:64707: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)113.28.86.11819730i&  -_' ossec13001iExim Auth failed2025-11-17 18:02:57 dovecot_login authenticator failed for ([111.26.61.237]) [111.26.61.238]:44784: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)111.26.61.2381814991p%  -k) ossec13001i}Exim Auth failed2025-11-17 18:02:52 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:48164: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)123.209.78.1312077456 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034~ 3469034v 3469034u 3469034r 3469034f 3469034c 3469034[ 3469034O 3469034K 3469034G 3469034B 34690349 34690345 3469034- 3469034% 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034~ 3469034v 3469034u 3469034p 3469034c 3469034a 3469034[ 3469034Y 3469034U 3469034S 3469034N 3469034K 3469034J 3469034H 3469034C 3469034@ 3469034; 3469034: 34690342 3469034/ 3469034* 3469034( 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034~ 3469034t 3469034p 3469034o 3469034l 3469034k 3469034f 3469034[ 3469034T 3469034Q 3469034I 3469034F 3469034: 34690346 3469034) 3469034( 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034~ 3469034x 3469034u 3469034n 3469034l 3469034b 3469034` 3469034] 3469034U 3469034K 3469034I 3469034E 3469034; 3469034: 3469034* 3469034' 3469034& 3469034# 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034} 3469034y 3469034t 3469034q 3469034l 3469034k 3469034b 3469034] 3469034S 3469034R 3469034N 3469034K ' x^0@D'B  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:07:59 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.5, lip=191.243.196.56, TLS, session=<5XXxvdBDNuvCpGsF>194.164.107.56252001xA  -}) ossec13001ioExim Auth failed2025-11-17 18:06:55 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:45110: 535 Incorrect authentication data (set_id=atualizacoes)195.142.25.183298795l@  -c) ossec13001icExim Auth failed2025-11-17 18:06:42 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:38667: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)61.150.123.1061814991*?  e)) ossec9710iYDovecot Auth failed on disconnected session.Nov 17 18:06:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387> W' ossec9708iYDovecot Aborted Login with empty userNov 17 18:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&=  e!) ossec9710iIDovecot Auth failed on disconnected session.Nov 17 18:06:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841k<  Iq ossec5403i[First time user executed sudo.Nov 17 18:06:34 hosting sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=radio107 ; COMMAND=/bin/test -e /home/radio107/wordpress-backupsn;  -e+ ossec13001iExim Auth failed2025-11-17 18:05:24 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:46612: 535 Incorrect authentication data (set_id=contato)128.185.228.13412697502:  e;' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 18:05:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822m9  -e) ossec13001iExim Auth failed2025-11-17 18:05:09 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:41808: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)221.209.48.20318149918  W' ossec9708i;Dovecot Aborted Login with empty userNov 17 18:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n7  -g) ossec13001i)Exim Auth failed2025-11-17 18:05:44 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:60618: 535 Incorrect authentication data (set_id=design)122.187.230.1312697506  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$5  e## ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:04:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991   x E .qP  -k+ ossec13001iExim Auth failed2025-11-17 18:09:45 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:36675: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)222.108.177.11018358410O  e;# ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:08:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991N  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034yM  -}) ossec13001iExim Auth failed2025-11-17 18:08:32 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:33754: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)210.177.143.611819730nL  -i' ossec13001iExim Auth failed2025-11-17 18:08:19 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:57830: 535 Incorrect authentication data (set_id=financeiro)184.57.39.1706252001K  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,J  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:08:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<4CXuwNBDfseGx8nN>134.199.201.2056252001]I  -G' ossec13001iExim Auth failed2025-11-17 18:08:50 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:50878: 535 Incorrect authentication data (set_id=isabellylisboa)193.46.192.2025107692H  e=% ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:08:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<1NwdwNBDoLbSATzz>210.1.60.2431605651/G  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:07:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822F  -' ossec13001iExim Auth failed2025-11-17 18:07:41 dovecot_login authenticator failed for (pppoe-78-111-249-76.dynamic.tvingo.ru) [78.111.249.76]:47877: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)78.111.249.7620173707E  eC) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:07:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750D W' ossec9708iDovecot Aborted Login with empty userNov 17 18:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(C  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:08:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 5 i f S%*5^_  -I' ossec13001iExim Auth failed2025-11-17 18:11:51 dovecot_login authenticator failed for ([62.182.132.94]) [62.182.132.94]:50284: 535 Incorrect authentication data (set_id=administrativo1)62.182.132.942017370l^  -g% ossec13001iExim Auth failed2025-11-17 18:11:38 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:60860: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)144.24.107.11269750]  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w\  -y) ossec13001iyExim Auth failed2025-11-17 18:11:20 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:50046: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)121.73.168.1812186224*[  e+' ossec9710iUDovecot Auth failed on disconnected session.Nov 17 18:10:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.19718358410Z  e5) ossec9710iODovecot Auth failed on disconnected session.Nov 17 18:10:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841Y W' ossec9708iIDovecot Aborted Login with empty userNov 17 18:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034uX  -u) ossec13001i3Exim Auth failed2025-11-17 18:10:10 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43084: 535 Incorrect authentication data (set_id=ieqcampocomprido)90.161.217.2282510769kW  -_+ ossec13001iExim Auth failed2025-11-17 18:09:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64903: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651YV  -=) ossec13001i)Exim Auth failed2025-11-17 18:10:01 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:50578: 535 Incorrect authentication data (set_id=rodrigo)190.67.106.2213686110U  -+ ossec13001iExim Auth failed2025-11-17 18:09:42 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:63722: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)128.106.196.1501880251T W' ossec9708i Dovecot Aborted Login with empty userNov 17 18:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(S  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:09:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991)R  e-# ossec9710i-Dovecot Auth failed on disconnected session.Nov 17 18:10:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001 Q  e# ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:09:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001    ,rn  -m+ ossec13001iIExim Auth failed2025-11-17 18:14:48 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:43294: 535 Incorrect authentication data (set_id=eliezer)122.185.176.1261269750m  k' ossec9709i9Multiple Dovecot Aborted Logins with empty userNov 17 18:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l  -+ ossec13001i1Exim Auth failed2025-11-17 18:14:24 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:58502: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)201.183.225.15636583943k  e9+ ossec9710i+Dovecot Auth failed on disconnected session.Nov 17 18:14:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822ij  -_' ossec13001iYExim Auth failed2025-11-17 18:15:04 dovecot_login authenticator failed for ([111.26.167.37]) [111.26.167.36]:44634: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)111.26.167.361814991ji  -]+ ossec13001iExim Auth failed2025-11-17 18:13:50 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:65174: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)202.179.189.1951643084Vh  -9' ossec13001iExim Auth failed2025-11-17 18:13:41 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:51536: 535 Incorrect authentication data (set_id=contato)103.249.19.341643084g W' ossec9708iDovecot Aborted Login with empty userNov 17 18:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5vDI0dBD4MyxV3kv>177.87.121.473469034yf  -{+ ossec13001iExim Auth failed2025-11-17 18:13:17 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:55982: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)213.238.254.1562661886fe  -[% ossec13001iExim Auth failed2025-11-17 18:12:46 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:53909: 535 Incorrect authentication data (set_id=alex.vendas)201.172.26.33996063d W' ossec9708iDovecot Aborted Login with empty userNov 17 18:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8P8/ztBD3q6xV3kv>177.87.121.473469034c  Ss) ossec11000iLogin failed on the cpanel service.[2025-11-17 18:12:21 -0300] info [cpaneld] 103.152.105.37 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password103.152.105.371210997|b  -' ossec13001iExim Auth failed2025-11-17 18:12:17 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:61798: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)202.82.20.2411819730a  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\`  -C) ossec13001iExim Auth failed2025-11-17 18:11:54 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:44338: 535 Incorrect authentication data (set_id=financeiro)121.73.169.1492186224 y 9SyV~  -7) ossec13001iExim Auth failed2025-11-17 18:16:13 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:50590: 535 Incorrect authentication data (set_id=info)85.116.125.2392017370b}  -U# ossec13001iExim Auth failed2025-11-17 18:16:11 dovecot_login authenticator failed for 111-70-51-5.emome-ip.hinet.net [111.70.51.5]:49305: 535 Incorrect authentication data (set_id=jornalismo)111.70.51.51668284W|  -=% ossec13001iExim Auth failed2025-11-17 18:16:59 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:46312: 535 Incorrect authentication data (set_id=vendas.luiz)218.22.0.2001814991g{  -[' ossec13001iExim Auth failed2025-11-17 18:16:48 dovecot_login authenticator failed for (66.20.167.124.adsl-pool.sx.cn) [124.167.20.66]:41257: 535 Incorrect authentication data (set_id=marialuiza)124.167.20.661814991zz  -) ossec13001iExim Auth failed2025-11-17 18:16:19 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:48549: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)46.212.127.1283144096Xy  -;) ossec13001iExim Auth failed2025-11-17 18:16:08 dovecot_login authenticator failed for ([111.26.106.115]) [111.26.106.115]:39372: 535 Incorrect authentication data (set_id=xavier)111.26.106.1151814991ux  -u) ossec13001iExim Auth failed2025-11-17 18:15:53 dovecot_login authenticator failed for (dm229.dialup.novoch.ru) [80.254.102.229]:40146: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)80.254.102.2292017370)w  e)' ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 18:15:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084iv  -_' ossec13001igExim Auth failed2025-11-17 18:15:19 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:51324: 535 Incorrect authentication data (set_id=comercial)89.179.78.2472017370bu -Q% ossec13001i]Exim Auth failed2025-11-17 18:15:08 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.245.9]:29956: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)104.28.245.93469034*t  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:15:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<19pa2tBD0dC317Oa>183.215.179.1541814991ns  -g) ossec13001iExim Auth failed2025-11-17 18:16:01 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:43757: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)58.228.105.1921835841qr  -m) ossec13001iExim Auth failed2025-11-17 18:15:52 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:60453: 535 Incorrect authentication data (set_id=jornalismo@89fmjoinville.com.br)223.167.203.561814991q W' ossec9708iuDovecot Aborted Login with empty userNov 17 18:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p  W' ossec9708iWDovecot Aborted Login with empty userNov 17 18:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7Nos19BDPIaxV3kv>177.87.121.473469034bo -Q% ossec13001iQExim Auth failed2025-11-17 18:14:57 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.245.7]:64677: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)104.28.245.73469034 2 - T ;  +k  -c' ossec13001iBExim Auth failed2025-11-17 18:18:57 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:38856: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)182.78.93.1901269750u  -s+ ossec13001i6Exim Auth failed2025-11-17 18:18:45 dovecot_login authenticator failed for ([175.198.180.129]) [175.198.180.129]:49758: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)175.198.180.1291835841 W' ossec9708i*Dovecot Aborted Login with empty userNov 17 18:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -_% ossec13001i$Exim Auth failed2025-11-17 18:18:27 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:62745: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)217.33.89.472635167r  -m+ ossec13001iExim Auth failed2025-11-17 18:18:06 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:47750: 535 Incorrect authentication data (set_id=j.martin@maringasoldas.com.br)122.187.227.1991269750#  e!# ossec9710i.Dovecot Auth failed on disconnected session.Nov 17 18:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=8.141.13.531814991Q  -3# ossec13001i&Exim Auth failed2025-11-17 18:18:28 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:34630: 535 Incorrect authentication data (set_id=j.martin)60.174.86.418149914  e;+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:18:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822i  -a% ossec13001iExim Auth failed2025-11-17 18:17:42 dovecot_login authenticator failed for ([121.8.209.94]) [121.8.209.94]:63849: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)121.8.209.941814991  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708i Dovecot Aborted Login with empty userNov 17 18:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -7' ossec13001iExim Auth failed2025-11-17 18:17:54 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:45612: 535 Incorrect authentication data (set_id=xavier)182.95.54.1941269750g  -Y) ossec13001iExim Auth failed2025-11-17 18:16:35 dovecot_login authenticator failed for ([211.43.107.179]) [211.43.107.179]:46008: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)211.43.107.1791835841 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034J  -'# ossec13001iExim Auth failed2025-11-17 18:16:26 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:39871: 535 Incorrect authentication data2.55.126.88294640 f*H   ~tj`VLB8.$\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    > z p f \ R H 4 *  vlXND:0&b|^"TJ@r6h,xndZPF<2( tj`~V.$LB8RHzpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (zpf>4*  vlbXND:0& ia iY iy is ik ic iC i) i% i% i i i i i i  i ~ i } iq | iN { iA z i- y i' x i w i9 v i7 u i5 t i s i r i q i p i o i n i m i l i k i j i i i h i g i f i e i d i c i b i a ip ` i _ iv ^ iv ] it \ ir [ iX Z iF Y i, X i, W i V i U i T i" S i R i Q i P i O i( N i M i L i K i J i I i H i G i F i E i D i C i B i A i @ i ? i > i = ij < iV ; iF : it 9 ip 8 in 7 iV 6 iT 5 iT 4 i` 3 i6 2 i4 1 i 0 i / i . i - i , i + i * i ) i ( i ' i & i % i $ i # i " i ! i i  i  i  i  i  i|  ir  iZ  iN  i  i~  i~  ih  if  i^  iP  i  iJ  iB i6 i.  i* i&  i$ i  i i  i  i  i  i i i  i i i i i i i i i i i~ iu ig i] iY iW iQ iI i9 i1 i+ i i i i i i i i i i i i i i i i i i i i i i i iy ig ig ie i_ iW iQ iO i; i- i i i i i i i i i i i i i i i i i i i i i i i i i iy iU iO iI i3 i- i) i i i i i i i i i i i i i i i i i i i i io ic i[ iY iY iI i; i) i  i i i i i i i i i i i i i i i i i i i i i i i} i{ iq im ii ii iW iO iA i- i- i- i i i i i   -  : E %;M[wvl  -c) ossec13001iExim Auth failed2025-11-17 18:20:23 dovecot_login authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:45457: 535 Incorrect authentication data (set_id=fabio.vendas)60.223.245.1201814991}  -) ossec13001iExim Auth failed2025-11-17 18:20:21 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:54244: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)122.187.230.131269750`  -K) ossec13001iExim Auth failed2025-11-17 18:20:04 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:58975: 535 Incorrect authentication data (set_id=vinicius.costa)190.223.53.2343932488n  -g) ossec13001i|Exim Auth failed2025-11-17 18:19:55 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:42873: 535 Incorrect authentication data (set_id=vinicius.costa@deproi.com.br)120.29.140.1401835841j  -c% ossec13001irExim Auth failed2025-11-17 18:19:45 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:43688: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)211.196.31.21835841f  -Y' ossec13001iZExim Auth failed2025-11-17 18:19:21 dovecot_login authenticator failed for ([128.185.10.66]) [128.185.10.66]:49791: 535 Incorrect authentication data (set_id=envios@comercial.art.br)128.185.10.661269750^  -G) ossec13001iNExim Auth failed2025-11-17 18:19:09 dovecot_login authenticator failed for ([95.191.196.220]) [95.191.196.220]:51546: 535 Incorrect authentication data (set_id=fabio.vendas)95.191.196.2202017370  - + ossec13001iExim Auth failed2025-11-17 18:20:05 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:6730: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)213.227.245.1546907916  eE% ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 18:19:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382q  -o) ossec13001i~Exim Auth failed2025-11-17 18:19:58 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:51216: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)94.204.185.231290557U  -7' ossec13001ihExim Auth failed2025-11-17 18:19:35 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:41436: 535 Incorrect authentication data (set_id=envios)182.95.224.621269750 W' ossec9708ifDovecot Aborted Login with empty userNov 17 18:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -9' ossec13001i^Exim Auth failed2025-11-17 18:19:24 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:41966: 535 Incorrect authentication data (set_id=rodrigo)65.20.237.19199237  - ' ossec13001iPExim Auth failed2025-11-17 18:19:11 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:39813: 535 Incorrect authentication data (set_id=rodrigo)179.184.33.863469034|  -' ossec13001iExim Auth failed2025-11-17 18:18:20 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:51804: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)73.128.150.676252001t  -s) ossec13001iJExim Auth failed2025-11-17 18:19:06 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:48510: 535 Incorrect authentication data (set_id=contato)50.127.177.1946252001  r,  -o) ossec13001iExim Auth failed2025-11-17 18:22:12 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:33976: 535 Incorrect authentication data (set_id=paulosogabe@maringasoldas.com.br)221.165.172.381835841V+  -7) ossec13001iExim Auth failed2025-11-17 18:21:39 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:39638: 535 Incorrect authentication data (set_id=edna)182.95.176.2061269750g*  -[' ossec13001iExim Auth failed2025-11-17 18:21:34 dovecot_login authenticator failed for 110-25-107-43.adsl.fetnet.net [110.25.107.43]:42537: 535 Incorrect authentication data (set_id=fabio.vendas)110.25.107.431668284) W' ossec9708iDovecot Aborted Login with empty userNov 17 18:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*(  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750}'  -+ ossec13001iExim Auth failed2025-11-17 18:21:25 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:39252: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)190.121.193.1263595528j&  -_) ossec13001iExim Auth failed2025-11-17 18:21:21 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:53698: 535 Incorrect authentication data (set_id=fabio.vendas)202.241.189.221861060)%  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:22:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991X$  -?% ossec13001iExim Auth failed2025-11-17 18:20:47 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:57286: 535 Incorrect authentication data (set_id=fabio.vendas)94.50.162.662017370k#  -a) ossec13001iExim Auth failed2025-11-17 18:20:45 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:61530: 535 Incorrect authentication data (set_id=contato)116.48.149.12318197305"  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:20:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084S!  -5% ossec13001iExim Auth failed2025-11-17 18:20:32 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:42545: 535 Incorrect authentication data (set_id=eliezer)102.53.15.562542007  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`  -O% ossec13001iExim Auth failed2025-11-17 18:21:03 dovecot_login authenticator failed for (22.32.117.87.donpac.ru) [87.117.32.22]:59520: 535 Incorrect authentication data (set_id=fabio.vendas)87.117.32.222017370  t ^;  -G) ossec13001iVExim Auth failed2025-11-17 18:23:32 dovecot_login authenticator failed for ([111.206.233.34]) [221.218.37.145]:41997: 535 Incorrect authentication data (set_id=junior.gomes)221.218.37.1451814991y:  -' ossec13001iFExim Auth failed2025-11-17 18:23:18 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:38067: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)31.151.70.15027504059  W' ossec9708itDovecot Aborted Login with empty userNov 17 18:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V8  -9' ossec13001ipExim Auth failed2025-11-17 18:23:59 dovecot_login authenticator failed for ([111.26.101.76]) [111.26.101.77]:38862: 535 Incorrect authentication data (set_id=leandro)111.26.101.771814991X7  -;) ossec13001inExim Auth failed2025-11-17 18:23:57 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:40746: 535 Incorrect authentication data (set_id=envios)111.26.106.1191814991e6  ;K% ossec13008iVMail Recipient rejected2025-11-17 18:23:32 H=(195.3.134.135) [179.0.178.53]:50073 F= rejected RCPT : Nenhuma pessoa no endereço.179.0.178.533469034j5  -a' ossec13001iTExim Auth failed2025-11-17 18:23:31 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:60712: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)121.73.163.6121862244  k' ossec9709iTMultiple Dovecot Aborted Logins with empty userNov 17 18:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2yON9dBDQpaxV3kv>177.87.121.473469034f3  -Y' ossec13001i`Exim Auth failed2025-11-17 18:23:43 dovecot_login authenticator failed for ([95.66.220.207]) [95.66.220.207]:24327: 535 Incorrect authentication data (set_id=envios@comercial.art.br)95.66.220.2072017370\2  -C) ossec13001i6Exim Auth failed2025-11-17 18:23:01 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:39364: 535 Incorrect authentication data90.160.139.1632510769'1  e%' ossec9710i4Dovecot Auth failed on disconnected session.Nov 17 18:22:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822)0  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:22:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841/ W' ossec9708iDovecot Aborted Login with empty userNov 17 18:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345.  e?) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:22:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387]-  -C+ ossec13001iExim Auth failed2025-11-17 18:22:26 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.233.190]:56991: 535 Incorrect authentication data (set_id=paulosogabe)183.108.233.1901835841   6 YmkK  -c' ossec13001iExim Auth failed2025-11-17 18:24:35 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:50458: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)95.220.47.2422017370J W' ossec9708iDovecot Aborted Login with empty userNov 17 18:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gI  -]% ossec13001iExim Auth failed2025-11-17 18:24:25 dovecot_login authenticator failed for ([222.180.2.62]) [222.180.2.62]:34199: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)222.180.2.621814991`H  -M' ossec13001iExim Auth failed2025-11-17 18:24:56 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:64705: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730eG  -Y% ossec13001iExim Auth failed2025-11-17 18:24:54 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:42109: 535 Incorrect authentication data (set_id=marialuiza)111.70.32.491668284 F  -) ossec13001iExim Auth failed2025-11-17 18:24:19 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:49520: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)122.180.249.321269750iE  -g! ossec13001iExim Auth failed2025-11-17 18:24:16 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:54896: 535 Incorrect authentication data (set_id=paulo.user.legal@louvoreterno.com.br)5.30.78.23290557VD  -9' ossec13001iExim Auth failed2025-11-17 18:25:00 dovecot_login authenticator failed for ([27.123.105.41]) [182.95.52.206]:35504: 535 Incorrect authentication data (set_id=contato)182.95.52.2061269750hC  -[) ossec13001iExim Auth failed2025-11-17 18:24:41 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:49070: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)182.95.225.1141269750YB  -=) ossec13001iExim Auth failed2025-11-17 18:24:27 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:54881: 535 Incorrect authentication data (set_id=leandro)210.219.232.341835841cA  -Q) ossec13001iExim Auth failed2025-11-17 18:24:27 dovecot_login authenticator failed for ([218.156.93.206]) [218.156.93.206]:56215: 535 Incorrect authentication data (set_id=bianca.user.legal)218.156.93.2061835841l@  -e' ossec13001iExim Auth failed2025-11-17 18:24:26 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:59434: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)85.117.232.422017370Y?  -=+ ossec13001iExim Auth failed2025-11-17 18:24:14 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.132.212]:52098: 535 Incorrect authentication data (set_id=leandro)154.177.132.2123579941>  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:24:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991b=  -O) ossec13001iExim Auth failed2025-11-17 18:24:38 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:54940: 535 Incorrect authentication data (set_id=paulo.user.legal)140.84.188.1403996063w<  -y) ossec13001ijExim Auth failed2025-11-17 18:23:53 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:57762: 535 Incorrect authentication data (set_id=bianca.user.legal@globalmedica.com.br)182.149.67.2001814991   *4/ @*Z  e'+ ossec9710iXDovecot Auth failed on disconnected session.Nov 17 18:27:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822Y W' ossec9708iFDovecot Aborted Login with empty userNov 17 18:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344X  e?' ossec9710i,Dovecot Auth failed on disconnected session.Nov 17 18:27:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<79cpAtFD/pGdQi/y>157.66.47.2421562822WW  -9) ossec13001i,Exim Auth failed2025-11-17 18:27:07 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:50000: 535 Incorrect authentication data (set_id=lucas)210.177.143.611819730mV  -e) ossec13001iExim Auth failed2025-11-17 18:26:52 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:33254: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)221.10.226.1961814991U  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 17 18:26:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -' ossec13001iExim Auth failed2025-11-17 18:26:23 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:57261: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)42.200.70.1341819730rS  -o) ossec13001i"Exim Auth failed2025-11-17 18:26:57 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:35144: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)182.95.176.2061269750eR  -U) ossec13001i Exim Auth failed2025-11-17 18:26:56 dovecot_login authenticator failed for (ADMIN) [83.136.210.199]:56122: 535 Incorrect authentication data (set_id=financeiro@projetolucas.com.br)83.136.210.1993017382rQ  -o) ossec13001iExim Auth failed2025-11-17 18:26:37 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:48819: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)150.129.47.2141269750VP  -9' ossec13001iExim Auth failed2025-11-17 18:26:38 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:58678: 535 Incorrect authentication data (set_id=contato)182.78.111.341269750nO  -k' ossec13001iExim Auth failed2025-11-17 18:26:13 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:34798: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)82.102.158.36294640N  W' ossec9708i(Dovecot Aborted Login with empty userNov 17 18:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034M W' ossec9708iDovecot Aborted Login with empty userNov 17 18:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034tL  -y# ossec13001iExim Auth failed2025-11-17 18:24:37 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:48098: 535 Incorrect authentication data (set_id=secretarioadjunto)189.56.0.193469034  * .i  e3' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:29:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991h  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vg  -7) ossec13001iExim Auth failed2025-11-17 18:29:26 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:36830: 535 Incorrect authentication data (set_id=edna)221.165.172.381835841kf  -_+ ossec13001iExim Auth failed2025-11-17 18:29:14 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:43955: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)121.142.165.1111835841ge  -Y) ossec13001iExim Auth failed2025-11-17 18:29:08 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:45182: 535 Incorrect authentication data (set_id=edna)182.239.80.1551819730d  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:30:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c W' ossec9708iDovecot Aborted Login with empty userNov 17 18:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ib  -_' ossec13001iExim Auth failed2025-11-17 18:28:50 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:53008: 535 Incorrect authentication data (set_id=edna)122.186.91.501269750$a  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:28:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758d`  -Q+ ossec13001ipExim Auth failed2025-11-17 18:28:15 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:60834: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.23116056510_  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:28:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.208.189.187, lip=200.150.196.245, TLS, session=185.208.189.18731753950^  e5) ossec9710ivDovecot Auth failed on disconnected session.Nov 17 18:28:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044&]  3O+ ossec11301ivNew FTP connection.Nov 17 18:28:20 hosting pure-ftpd: (?@147.185.132.108) [INFO] New connection from 147.185.132.108147.185.132.1086252001+\  e)+ ossec9710itDovecot Auth failed on disconnected session.Nov 17 18:28:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001y[  -% ossec13001irExim Auth failed2025-11-17 18:28:17 dovecot_login authenticator failed for 4.red-79-154-111.dynamicip.rima-tde.net [79.154.111.4]:44476: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)79.154.111.42510769 # 2Sx  -7# ossec13001i'Exim Auth failed2025-11-17 18:31:17 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:46480: 535 Incorrect authentication data (set_id=escritura1)39.74.74.441814991+w  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:31:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697505v  e=+ ossec9710i9Dovecot Auth failed on disconnected session.Nov 17 18:31:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001{u  -+ ossec13001i7Exim Auth failed2025-11-17 18:31:33 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:58130: 535 Incorrect authentication data (set_id=rsimoesdiretoria)122.187.227.1991269750t W' ossec9708i5Dovecot Aborted Login with empty userNov 17 18:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034cs  -S' ossec13001iExim Auth failed2025-11-17 18:31:00 dovecot_login authenticator failed for ([111.26.69.160]) [111.26.69.160]:44824: 535 Incorrect authentication data (set_id=comercial.user.legal)111.26.69.1601814991ir  -a' ossec13001iExim Auth failed2025-11-17 18:30:58 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:54038: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795pq  -m' ossec13001iExim Auth failed2025-11-17 18:30:53 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:42330: 535 Incorrect authentication data (set_id=compras)189.56.202.863469034lp  -g' ossec13001iExim Auth failed2025-11-17 18:30:24 dovecot_login authenticator failed for ([188.59.145.27]) [188.59.145.27]:38008: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)188.59.145.27298795to  -u' ossec13001iExim Auth failed2025-11-17 18:31:00 dovecot_login authenticator failed for ([70.174.168.45]) [70.174.168.45]:59143: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)70.174.168.456252001qn  -o' ossec13001iExim Auth failed2025-11-17 18:30:42 dovecot_login authenticator failed for ([178.66.185.88]) [178.66.185.88]:60244: 535 Incorrect authentication data (set_id=comercial.user.legal@inovasite.com)178.66.185.882017370.m  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:30:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<7Um0DtFDcPtxoZB3>113.161.144.1191562822l W' ossec9708iDovecot Aborted Login with empty userNov 17 18:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ik  -a% ossec13001iExim Auth failed2025-11-17 18:30:10 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:37790: 535 Incorrect authentication data (set_id=programador)71.62.34.2166252001lj  -i% ossec13001iExim Auth failed2025-11-17 18:29:59 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:35621: 535 Incorrect authentication data (set_id=programador@radiosarabrasil.fm.br)94.200.20.66290557  J 1g  -_# ossec13001i%Exim Auth failed2025-11-17 18:35:32 dovecot_login authenticator failed for (5x3x179x215.dynamic.spb.ertelecom.ru) [5.3.179.215]:56648: 535 Incorrect authentication data (set_id=contato)5.3.179.2152017370  k' ossec9709i%Multiple Dovecot Aborted Logins with empty userNov 17 18:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6l+BINFDlrOxV3kv>177.87.121.473469034o  -i) ossec13001iExim Auth failed2025-11-17 18:35:18 dovecot_login authenticator failed for ([95.165.182.238]) [95.165.182.238]:60084: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)95.165.182.2382017370  -)+ ossec13001iExim Auth failed2025-11-17 18:35:03 dovecot_login authenticator failed for (122.251.142.219.broad.bj.bj.dynamic.163data.com.cn) [219.142.251.122]:41078: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)219.142.251.1221814991 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -G) ossec13001iExim Auth failed2025-11-17 18:33:59 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:45882: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:33:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387~  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347}  eA+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:32:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822|  k' ossec9709iqMultiple Dovecot Aborted Logins with empty userNov 17 18:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034${  e' ossec9710iNDovecot Auth failed on disconnected session.Nov 17 18:31:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.9718149917z  eA+ ossec9710iADovecot Auth failed on disconnected session.Nov 17 18:31:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001qy  -o' ossec13001i-Exim Auth failed2025-11-17 18:31:23 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:34722: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)111.61.97.1081814991 $   mSc_\  -C) ossec13001iExim Auth failed2025-11-17 18:38:43 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:35606: 535 Incorrect authentication data (set_id=financeiro)118.91.176.2441269750  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:38:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  - ' ossec13001iExim Auth failed2025-11-17 18:38:27 dovecot_login authenticator failed for 138-97-64-146.westlink.net.br [138.97.64.146]:51076: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)138.97.64.1463469034Y  -C% ossec13001iExim Auth failed2025-11-17 18:38:57 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55401: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758l  -c) ossec13001iExim Auth failed2025-11-17 18:38:55 dovecot_login authenticator failed for ([124.197.22.130]) [124.197.22.130]:48710: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)124.197.22.1301562822 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:37:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<6AgxJtFDYt6d5hjP>157.230.24.2072921044 W' ossec9708iaDovecot Aborted Login with empty userNov 17 18:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  e1+ ossec9710iYDovecot Auth failed on disconnected session.Nov 17 18:36:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841j  -]+ ossec13001iyExim Auth failed2025-11-17 18:36:56 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:34967: 535 Incorrect authentication data (set_id=alex.vendas)187.115.144.10334690347  eE' ossec9710isDovecot Auth failed on disconnected session.Nov 17 18:36:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=177.44.71.150, lip=200.150.196.245, TLS, session=177.44.71.1503469034  -% ossec13001ikExim Auth failed2025-11-17 18:36:42 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:33770: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)34.146.248.71861060s  -s' ossec13001icExim Auth failed2025-11-17 18:36:35 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:53579: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)193.46.192.202510769  W' ossec9708iCDovecot Aborted Login with empty userNov 17 18:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001i)Exim Auth failed2025-11-17 18:35:35 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:38586: 535 Incorrect authentication data (set_id=rafael)140.84.179.1283996063  !A8VGc[%  -C' ossec13001iOExim Auth failed2025-11-17 18:40:31 dovecot_login authenticator failed for ([78.111.249.76]) [78.111.249.76]:53719: 535 Incorrect authentication data (set_id=misterthomas)78.111.249.762017370`$  -I+ ossec13001igExim Auth failed2025-11-17 18:40:55 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:60990: 535 Incorrect authentication data (set_id=misterthomas)122.185.176.1261269750 #  -+ ossec13001igExim Auth failed2025-11-17 18:40:55 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:34582: 535 Incorrect authentication data (set_id=coordenacao@maringasoldas.com.br)122.187.230.1541269750^"  -I' ossec13001i-Exim Auth failed2025-11-17 18:39:57 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:43228: 535 Incorrect authentication data (set_id=isabellylisboa)152.52.192.741269750!  -+ ossec13001iExim Auth failed2025-11-17 18:39:28 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:53286: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)207.200.180.1746252001\  -C) ossec13001i Exim Auth failed2025-11-17 18:39:24 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:56198: 535 Incorrect authentication data (set_id=financeiro)210.219.232.341835841X  -?% ossec13001iExim Auth failed2025-11-17 18:39:09 dovecot_login authenticator failed for ([151.0.50.123]) [151.0.50.123]:38340: 535 Incorrect authentication data (set_id=atualizacoes)151.0.50.1232017370  - ) ossec13001iExim Auth failed2025-11-17 18:39:07 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:41216: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)118.200.42.1121880251 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  -_+ ossec13001iExim Auth failed2025-11-17 18:39:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55652: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651\  -A+ ossec13001iExim Auth failed2025-11-17 18:39:07 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:50739: 535 Incorrect authentication data (set_id=contato)171.244.199.1681562822Z  -E% ossec13001iExim Auth failed2025-11-17 18:38:38 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:51640: 535 Incorrect authentication data (set_id=administrativo1)37.211.94.35289688-  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:38:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841m  -g' ossec13001iExim Auth failed2025-11-17 18:38:23 dovecot_login authenticator failed for ([211.141.61.62]) [211.141.61.63]:38716: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)211.141.61.631814991  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6/kDLdFDHKOxV3kv>177.87.121.473469034x  -% ossec13001iExim Auth failed2025-11-17 18:38:49 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:39504: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)179.42.49.343469034 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1835841K 1835841B 18358411 18358410 1835841/ 1835841% 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841p 1835841S 1835841O 18358411 1835841+ 1835841) 1835841( 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841~ 1835841q 1835841p 1835841I 1835841= 1835841, 1835841+ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841X 1835841S 1835841E 18358418 18358417 18358415 1835841. 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841q 1835841` 1835841] 1835841[ 1835841H 1835841> 18358416 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841f 1835841b 1835841Q 1835841L 1835841G 18358410 1835841, 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841h 1835841W 1835841S 1835841O 1835841M 18358418 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841} 1835841k 1835841_ 1835841T 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841o 1835841i 1835841_ 1835841G 1835841= 18358415 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841s 1835841L 1835841E 18358419 1835841( 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841v 1835841p 1835841j 1835841h 1835841[ 1835841C 1835841> 1835841. 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841} 1835841g 1835841a 1835841W 1835841R 1835841I 1835841F 18358413 18358411 1835841   % F e di4^4  -M% ossec13001iExim Auth failed2025-11-17 18:42:35 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:54200: 535 Incorrect authentication data (set_id=andressa.financeiro)37.211.94.352896883 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y2  -=) ossec13001iExim Auth failed2025-11-17 18:42:30 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:42252: 535 Incorrect authentication data (set_id=contato)140.84.179.12839960631  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+0  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:41:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<3whTN9FD6JN9gnHM>125.130.113.20418358411/  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<4h8ON9FDxrk+PIOL>62.60.131.139130758w.  -{' ossec13001iExim Auth failed2025-11-17 18:41:39 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:54468: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)182.78.240.941269750-  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z,  -=+ ossec13001iExim Auth failed2025-11-17 18:41:21 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:4800: 535 Incorrect authentication data (set_id=rafael)196.200.112.2372328926]+  -E) ossec13001iyExim Auth failed2025-11-17 18:41:12 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:50274: 535 Incorrect authentication data (set_id=coordenacao)112.162.18.1501835841[*  -E' ossec13001i_Exim Auth failed2025-11-17 18:40:46 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:49660: 535 Incorrect authentication data (set_id=anderson)62.74.225.186390903j)  -c% ossec13001i;Exim Auth failed2025-11-17 18:40:11 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:60356: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)36.135.62.871814991`(  -S! ossec13001ieExim Auth failed2025-11-17 18:40:52 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:39428: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)14.33.96.31835841k'  -_+ ossec13001iWExim Auth failed2025-11-17 18:40:39 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:33444: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)103.194.243.1871269750& W' ossec9708iQDovecot Aborted Login with empty userNov 17 18:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 7 ,   + .F-6.)EC  ec' ossec9710ipDovecot Auth failed on disconnected session.Nov 17 18:45:18 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.138.16.231, lip=200.150.196.245, TLS: Connection closed, session=45.138.16.231798544gB  -[' ossec13001iExim Auth failed2025-11-17 18:45:56 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:37882: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)111.93.80.1581269750A W' ossec9708i~Dovecot Aborted Login with empty userNov 17 18:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034@  -+ ossec13001i3Exim Auth failed2025-11-17 18:44:18 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:35079: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)166.201.209.1526252001s?  -u% ossec13001i/Exim Auth failed2025-11-17 18:44:15 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:58372: 535 Incorrect authentication data (set_id=info.user.legal@lixadoracuritiba.com.br)84.54.115.461512440>  W' ossec9708i_Dovecot Aborted Login with empty userNov 17 18:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7LpyQtFDENuxV3kv>177.87.121.473469034d=  -Q+ ossec13001iGExim Auth failed2025-11-17 18:44:38 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:44354: 535 Incorrect authentication data (set_id=info.user.legal)103.194.243.1871269750V<  -9' ossec13001iEExim Auth failed2025-11-17 18:44:36 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:35264: 535 Incorrect authentication data (set_id=contato)180.92.235.701210997;  k' ossec9709iAMultiple Dovecot Aborted Logins with empty userNov 17 18:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4lemQNFDzM+xV3kv>177.87.121.473469034b:  -S% ossec13001iExim Auth failed2025-11-17 18:43:49 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:46110: 535 Incorrect authentication data (set_id=andre.nascimento.legal)78.81.209.762017370}9  -) ossec13001iExim Auth failed2025-11-17 18:43:34 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:55012: 535 Incorrect authentication data (set_id=andre.nascimento.legal@calcautomacao.com.br)221.209.48.20318149918 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5McWPdFDNLKxV3kv>177.87.121.4734690347  -) ossec13001iExim Auth failed2025-11-17 18:42:16 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:42594: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)101.165.208.122077456V6  -9' ossec13001iExim Auth failed2025-11-17 18:42:54 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:44774: 535 Incorrect authentication data (set_id=contato)125.19.195.661269750k5  -c' ossec13001iExim Auth failed2025-11-17 18:42:43 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:50740: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)182.95.115.701269750  `FY|xUumR  -g' ossec13001i Exim Auth failed2025-11-17 18:47:52 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:59885: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)161.8.241.1712077456gQ  -Y) ossec13001iExim Auth failed2025-11-17 18:47:51 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:47760: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)211.44.170.1541835841\P  -E' ossec13001iExim Auth failed2025-11-17 18:47:36 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:53989: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001O  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034N  W) ossec9708iDovecot Aborted Login with empty userNov 17 18:48:05 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.197.27, lip=186.233.225.118, session=185.226.197.272264397eM  -Y% ossec13001iExim Auth failed2025-11-17 18:47:03 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:51150: 535 Incorrect authentication data (set_id=vendas3)179.42.49.343469034YL  -=) ossec13001iExim Auth failed2025-11-17 18:46:40 dovecot_login authenticator failed for ([14.244.171.134]) [14.244.171.134]:46107: 535 Incorrect authentication data (set_id=contato)14.244.171.1341562822iK  -_' ossec13001iExim Auth failed2025-11-17 18:46:37 dovecot_login authenticator failed for ([61.189.61.162]) [61.189.61.162]:44684: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)61.189.61.1621814991J W' ossec9708iDovecot Aborted Login with empty userNov 17 18:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5N/SR9FDfpixV3kv>177.87.121.473469034/I  SE' ossec11000iLogin failed on the cpanel service.[2025-11-17 18:46:20 -0300] info [webmaild] 143.244.33.80 - gerson@89fmjoinville.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)143.244.33.8018802511H  SG) ossec11000iLogin failed on the cpanel service.[2025-11-17 18:46:15 -0300] info [webmaild] 172.245.13.114 - gerson@89fmjoinville.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)172.245.13.1146252001.G  e3' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:46:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822vF  -w) ossec13001iExim Auth failed2025-11-17 18:46:22 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:46224: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)218.156.93.2021835841ZE  -A' ossec13001iExim Auth failed2025-11-17 18:46:18 dovecot_login authenticator failed for ([182.95.2.153]) [125.20.224.62]:45426: 535 Incorrect authentication data (set_id=atualizacoes)125.20.224.621269750*D  U9' ossec11001ivDeferred login on the cpanel service[2025-11-17 18:45:24 -0300] info [webmaild] 189.40.71.182 - liana@projetocircense.com.br "GET /cpsess6022075013/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.40.71.1823469034 :3 L 3  ? KrBSvNM:Va  -9' ossec13001iZExim Auth failed2025-11-17 18:49:13 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:50094: 535 Incorrect authentication data (set_id=eliezer)125.23.228.8612697505`  eC% ossec9710iXDovecot Auth failed on disconnected session.Nov 17 18:49:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651}_  - % ossec13001iExim Auth failed2025-11-17 18:50:00 dovecot_login authenticator failed for (82-156-58-61.tinp.net.tw) [61.58.156.82]:38786: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)61.58.156.821668284$^  e) ossec9710iLDovecot Auth failed on disconnected session.Nov 17 18:48:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<2Up4UNFDHqyl0iHB>165.210.33.1932233387Y]  -=) ossec13001i:Exim Auth failed2025-11-17 18:48:40 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:46290: 535 Incorrect authentication data (set_id=eliezer)182.149.67.2001814991k\  -g# ossec13001iExim Auth failed2025-11-17 18:48:07 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:42714: 535 Incorrect authentication data (set_id=financeiro)103.59.4.361269750,[  e-) ossec9710i2Dovecot Auth failed on disconnected session.Nov 17 18:48:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387UZ  -=% ossec13001i$Exim Auth failed2025-11-17 18:48:19 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:35647: 535 Incorrect authentication data (set_id=aureovieira)65.20.133.5699237pY  -u ossec13001iExim Auth failed2025-11-17 18:48:07 dovecot_login authenticator failed for (5x3x64x66.dynamic.ulsk.ertelecom.ru) [5.3.64.66]:46813: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)5.3.64.662017370VX  -9' ossec13001iLExim Auth failed2025-11-17 18:48:58 dovecot_login authenticator failed for ([14.49.180.201]) [14.49.180.201]:38990: 535 Incorrect authentication data (set_id=eliezer)14.49.180.2011835841W W' ossec9708i2Dovecot Aborted Login with empty userNov 17 18:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034cU  -U' ossec13001iExim Auth failed2025-11-17 18:47:46 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:59930: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795]T  -O# ossec13001iExim Auth failed2025-11-17 18:47:32 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:53624: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)65.20.202.499237hS  -[) ossec13001iExim Auth failed2025-11-17 18:47:59 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:32810: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)106.245.246.261835841  e hNW o  k' ossec9709i\Multiple Dovecot Aborted Logins with empty userNov 17 18:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n W' ossec9708i"Dovecot Aborted Login with empty userNov 17 18:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340m  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:51:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001tl  -s) ossec13001iExim Auth failed2025-11-17 18:51:30 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:49140: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)212.225.255.822510769vk  -w) ossec13001iExim Auth failed2025-11-17 18:51:23 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:51656: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)182.95.176.1301269750Uj  ;+% ossec13008iMail Recipient rejected2025-11-17 18:52:05 H=(195.3.134.135) [179.0.178.53]:58110 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:58110 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034si  -s' ossec13001iExim Auth failed2025-11-17 18:51:51 dovecot_login authenticator failed for (18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:59656: 535 Incorrect authentication data (set_id=adm)222.212.91.181814991h W' ossec9708iDovecot Aborted Login with empty userNov 17 18:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g  W' ossec9708iDovecot Aborted Login with empty userNov 17 18:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6KfxV9FDoKexV3kv>177.87.121.473469034`f  -K) ossec13001iExim Auth failed2025-11-17 18:50:37 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:19286: 535 Incorrect authentication data (set_id=isabellylisboa)171.244.61.1371562822e  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+d  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:50:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822+c  e-' ossec9710i|Dovecot Auth failed on disconnected session.Nov 17 18:49:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991b W' ossec9708inDovecot Aborted Login with empty userNov 17 18:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 B -  & 5 (,!)=Bw  -y) ossec13001iExim Auth failed2025-11-17 18:55:20 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:52434: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)120.157.65.1082077456h~  -[) ossec13001iExim Auth failed2025-11-17 18:55:52 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:51566: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)121.73.163.1812186224t}  -q+ ossec13001iExim Auth failed2025-11-17 18:55:41 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:2327: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)196.200.112.2372328926m|  -e) ossec13001iExim Auth failed2025-11-17 18:55:39 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:33446: 535 Incorrect authentication data (set_id=administrativo1)203.128.10.1381168579{ W' ossec9708iDovecot Aborted Login with empty userNov 17 18:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034xz  -y+ ossec13001iExim Auth failed2025-11-17 18:55:07 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:48826: 535 Incorrect authentication data (set_id=thiagorodrigo)122.187.229.1941269750Vy  -;% ossec13001iExim Auth failed2025-11-17 18:55:56 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:52501: 535 Incorrect authentication data (set_id=financeiro)59.27.93.1381835841ex  -S+ ossec13001iExim Auth failed2025-11-17 18:55:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57804: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651w W' ossec9708iDovecot Aborted Login with empty userNov 17 18:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,v  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:55:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084mu  -e) ossec13001iExim Auth failed2025-11-17 18:54:54 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:59474: 535 Incorrect authentication data (set_id=thiagorodrigo@1075fm.com.br)111.61.176.2421814991jt  -]+ ossec13001iFExim Auth failed2025-11-17 18:53:10 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:48264: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)190.238.101.2093932488s  W' ossec9708izDovecot Aborted Login with empty userNov 17 18:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1lajYtFDKIyxV3kv>177.87.121.473469034lr  -c+ ossec13001irExim Auth failed2025-11-17 18:53:54 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:45278: 535 Incorrect authentication data (set_id=eliezer)213.130.207.177597427dq  -U' ossec13001ijExim Auth failed2025-11-17 18:53:45 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:55530: 535 Incorrect authentication data (set_id=derly)103.51.26.1981269750wp  -w+ ossec13001i^Exim Auth failed2025-11-17 18:53:34 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:47788: 535 Incorrect authentication data (set_id=derly@educacionalevangelico.com.br)169.211.232.1821835841 31 A V _ lA1?[]DM3 W' ossec9708iNDovecot Aborted Login with empty userNov 17 18:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s  -q) ossec13001iLExim Auth failed2025-11-17 18:57:32 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:43105: 535 Incorrect authentication data (set_id=anderson)187.237.47.2143996063  W' ossec9708i0Dovecot Aborted Login with empty userNov 17 18:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z  -) ossec13001i$Exim Auth failed2025-11-17 18:56:52 dovecot_plain authenticator failed for (tbo6ttnb746j5fplscguz6kjn9dhxjr) [123.26.133.168]:2157: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)123.26.133.1681562822`  -M' ossec13001iExim Auth failed2025-11-17 18:56:44 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:59607: 535 Incorrect authentication data (set_id=contato)103.148.92.471168579n  -i' ossec13001iExim Auth failed2025-11-17 18:56:40 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:33996: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)120.157.6.1472077456Y  -?' ossec13001iExim Auth failed2025-11-17 18:56:20 dovecot_login authenticator failed for ([111.26.61.243]) [111.26.61.244]:37422: 535 Incorrect authentication data (set_id=assessoria)111.26.61.2441814991/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:56:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822'  e%' ossec9710i0Dovecot Auth failed on disconnected session.Nov 17 18:57:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841o  -g+ ossec13001iExim Auth failed2025-11-17 18:56:46 dovecot_login authenticator failed for ([176.125.137.232]) [176.125.137.232]:56652: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)176.125.137.2322017370  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034P  -3# ossec13001iExim Auth failed2025-11-17 18:56:21 dovecot_login authenticator failed for ([2.55.68.141]) [2.55.68.141]:58458: 535 Incorrect authentication data (set_id=eleicoes)2.55.68.141294640g  -Y) ossec13001iExim Auth failed2025-11-17 18:56:20 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:37084: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)122.186.243.781269750l  -i% ossec13001iExim Auth failed2025-11-17 18:56:05 dovecot_login authenticator failed for ([188.59.6.176]) [188.59.6.176]:57521: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)188.59.6.176298795g  -[) ossec13001iExim Auth failed2025-11-17 18:56:06 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:42863: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)185.112.148.66130758`  -S% ossec13001iExim Auth failed2025-11-17 18:55:33 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:56252: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)65.20.175.7599237  3 U o  d  -U' ossec13001iExim Auth failed2025-11-17 18:59:29 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:59669: 535 Incorrect authentication data (set_id=xavier)111.70.23.2461668284l  -e' ossec13001iExim Auth failed2025-11-17 18:59:18 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:32958: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)182.95.57.15812697508  eG' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:00:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084t  -u' ossec13001iExim Auth failed2025-11-17 18:59:39 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:36020: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)82.209.148.602661886Y  -A' ossec13001iExim Auth failed2025-11-17 18:59:00 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:39133: 535 Incorrect authentication data (set_id=design)62.74.225.186390903Z  -A' ossec13001iExim Auth failed2025-11-17 18:58:54 dovecot_login authenticator failed for ([222.116.7.209]) [222.116.7.209]:41197: 535 Incorrect authentication data (set_id=atendimento)222.116.7.2091835841y  -}) ossec13001iExim Auth failed2025-11-17 18:58:53 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:45298: 535 Incorrect authentication data (set_id=design@inovasite.com)123.193.152.641668284 W' ossec9708iDovecot Aborted Login with empty userNov 17 18:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -7' ossec13001iExim Auth failed2025-11-17 18:58:55 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50286: 535 Incorrect authentication data (set_id=mecati)103.174.34.491269750t  -y# ossec13001iExim Auth failed2025-11-17 18:58:47 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:59102: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)70.120.1.746252001h  -]' ossec13001i~Exim Auth failed2025-11-17 18:58:21 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:57461: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)119.192.59.801835841Z  -A' ossec13001izExim Auth failed2025-11-17 18:58:17 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:61309: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001b  -S% ossec13001i<Exim Auth failed2025-11-17 18:57:15 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:50720: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)119.6.108.131814991Z  -A' ossec13001i4Exim Auth failed2025-11-17 18:57:08 dovecot_login authenticator failed for ([62.192.226.83]) [62.192.226.83]:40488: 535 Incorrect authentication data (set_id=alex.vendas)62.192.226.832017370V  -9' ossec13001i`Exim Auth failed2025-11-17 18:57:52 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:59716: 535 Incorrect authentication data (set_id=contato)178.68.91.1192017370o  -i) ossec13001iTExim Auth failed2025-11-17 18:57:40 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:34093: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)46.212.110.2373144096 *  mm.N4X**.  e'+ ossec9710iSDovecot Auth failed on disconnected session.Nov 17 19:01:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991X-  -;) ossec13001iGExim Auth failed2025-11-17 19:01:41 dovecot_login authenticator failed for ([218.94.104.181]) [218.94.104.180]:54207: 535 Incorrect authentication data (set_id=xavier)218.94.104.1801814991, W' ossec9708i?Dovecot Aborted Login with empty userNov 17 19:01:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+iyAfdFDIomxV3kv>177.87.121.473469034\+  -C) ossec13001iExim Auth failed2025-11-17 19:00:52 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:33670: 535 Incorrect authentication data (set_id=atendimento)192.81.229.1816252001;*  eI+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:00:37 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.187.227.199, lip=200.150.196.245, TLS, session=<1efleNFDtIx6u+PH>122.187.227.1991269750) W' ossec9708iDovecot Aborted Login with empty userNov 17 19:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b(  -U# ossec13001iExim Auth failed2025-11-17 19:00:32 dovecot_login authenticator failed for ([59.6.203.38]) [59.6.203.38]:47788: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)59.6.203.381835841'  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:00:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.107.36.18, lip=200.150.196.245, TLS, session=103.107.36.181269750-&  e5# ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:59:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001|%  -' ossec13001iExim Auth failed2025-11-17 18:59:50 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:49908: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)181.177.9.11938654830$  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 18:59:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822#  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X"  -?% ossec13001iExim Auth failed2025-11-17 19:00:02 dovecot_login authenticator failed for ([58.34.174.90]) [58.34.174.90]:40953: 535 Incorrect authentication data (set_id=junior.gomes)58.34.174.901814991o!  -g+ ossec13001iExim Auth failed2025-11-17 18:59:57 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:47040: 535 Incorrect authentication data (set_id=aureovieira)187.103.196.1243469034  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 18:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  vFWa=  -K+ ossec13001i Exim Auth failed2025-11-17 19:04:57 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:46492: 535 Incorrect authentication data (set_id=bruno)128.199.118.2341880251U<  -9' ossec13001iExim Auth failed2025-11-17 19:03:17 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3681: 535 Incorrect authentication data (set_id=envios)213.55.85.202337996S;  -5% ossec13001iExim Auth failed2025-11-17 19:03:14 dovecot_login authenticator failed for ([60.12.215.34]) [60.12.215.34]:65510: 535 Incorrect authentication data (set_id=contato)60.12.215.341814991k:  -_+ ossec13001iExim Auth failed2025-11-17 19:03:55 dovecot_login authenticator failed for ([122.224.164.194]) [122.224.164.194]:36727: 535 Incorrect authentication data (set_id=secretaria@cieadep.com)122.224.164.1941814991,9  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:03:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697508 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903437  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:03:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387R6  -3% ossec13001imExim Auth failed2025-11-17 19:02:20 dovecot_login authenticator failed for ([1.83.124.138]) [1.83.124.138]:3281: 535 Incorrect authentication data (set_id=contato)1.83.124.138181499165  eE% ossec9710iaDovecot Auth failed on disconnected session.Nov 17 19:02:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382i4  -]) ossec13001iExim Auth failed2025-11-17 19:03:03 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:33865: 535 Incorrect authentication data (set_id=envios@comercial.art.br)61.184.176.25218149913  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:03:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|2  -) ossec13001iExim Auth failed2025-11-17 19:02:59 dovecot_login authenticator failed for (213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:49567: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)213.142.48.14320173701  k' ossec9709iyMultiple Dovecot Aborted Logins with empty userNov 17 19:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r0  -m+ ossec13001i2Exim Auth failed2025-11-17 19:01:22 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:38842: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)200.149.213.2423469034/  -' ossec13001i]Exim Auth failed2025-11-17 19:02:04 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:45464: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)118.212.79.211814991 * n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f 4 * \ R H >   b0XND:vl&rh^|@TJ6,"nxPF<2dZ (j`VL~Bt8$.pfz \RH>4* | r h ^ T J @ 6 , "    x vlbXND:0& i i* i i i i i i i i i i i i i i i i i i i i i i i i i i i i iv iv ir ip i i i i it ip iV i: i2 iV i i i i i i i i i i i i i i i i i iI i=  i/ ~ ij } ih | iU { iO z i+ y i x i w i v i u i t i s i r i% q i p i o i n i m i l i k ia j iY i iQ h iu g ii f i1 e i d i c i b i a i ` i _ i ^ i ] i \ i [ i Z i Y i X i W i V i U i T i S i R i Q i P i O i N iO M iO L i} K i{ J io I ii H i G iK F iG E iA D i- C i B i A i @ i ? i > i = i < i ; i : i 9 i 8 i 7 i 4 i 3 i 2 iy 1 im 6 ia 5 i] / iS . iG - i? , i2 0 i ' i + i * i ) i ( i  i # i " i ! i & i % i $ i  i i  i  i  i  i  i  i  i  i~  iz  i`  iT  iN  iL  i<  i4  i i i~ iv ip i_ iG iE iA i3 i/ i i i ii iT iR iP iF i6 i2 i" i i i i i i i i i i i i i i i ih if ib i^ i\ iR iL iL i: i8 i6 i. i0 i0  i$ i  i i i  i  i i  i  i  i  i i i i i i i i i i i i iz ir ij i^ i\ iF i" i i i i i i i i i i < i i i| in iZ iX iL iL i: i2 i2 i$ i i i i i i i i i i i i i i i i i i i $   eL  -U+ ossec13001iOExim Auth failed2025-11-17 19:06:06 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:53487: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795)K  e%+ ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 19:06:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001[J  -?+ ossec13001i{Exim Auth failed2025-11-17 19:06:50 dovecot_login authenticator failed for ([177.236.145.124]) [177.236.145.124]:55424: 535 Incorrect authentication data (set_id=envios)177.236.145.1243996063`I  -Q# ossec13001ioExim Auth failed2025-11-17 19:06:37 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:44986: 535 Incorrect authentication data (set_id=envios@comercial.art.br)182.78.87.21269750H W' ossec9708iiDovecot Aborted Login with empty userNov 17 19:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lG  -a+ ossec13001iExim Auth failed2025-11-17 19:05:16 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56305: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.2311605651F  W' ossec9708iKDovecot Aborted Login with empty userNov 17 19:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034aE  -O' ossec13001iGExim Auth failed2025-11-17 19:05:58 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:60577: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.7218197304D  e?' ossec9710iADovecot Auth failed on disconnected session.Nov 17 19:05:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991C  k' ossec9709i-Multiple Dovecot Aborted Logins with empty userNov 17 19:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034sB  -s' ossec13001iExim Auth failed2025-11-17 19:04:41 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:47129: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)61.51.184.1941814991A W' ossec9708iDovecot Aborted Login with empty userNov 17 19:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]@ -C) ossec13001iExim Auth failed2025-11-17 19:04:26 dovecot_login authenticator failed for (User) [177.74.174.120]:56876: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)177.74.174.1203469034*?  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:04:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822X>  -=' ossec13001iExim Auth failed2025-11-17 19:04:13 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:20762: 535 Incorrect authentication data (set_id=secretaria)14.161.31.1721562822   [  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YZ  -C# ossec13001iExim Auth failed2025-11-17 19:08:54 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:35512: 535 Incorrect authentication data (set_id=marcelo.pinheiro)46.8.240.442017370bY  -O) ossec13001iExim Auth failed2025-11-17 19:08:53 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:48056: 535 Incorrect authentication data (set_id=desenvolvimento2)120.29.140.1401835841X  -' ossec13001iExim Auth failed2025-11-17 19:08:39 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:42868: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)41.59.202.241149590W  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -' ossec13001iExim Auth failed2025-11-17 19:08:27 dovecot_login authenticator failed for 111-70-23-239.emome-ip.hinet.net [111.70.23.239]:45347: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)111.70.23.2391668284U W' ossec9708iDovecot Aborted Login with empty userNov 17 19:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^T  -K' ossec13001iExim Auth failed2025-11-17 19:07:52 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:49932: 535 Incorrect authentication data (set_id=gerson)82.193.122.91690791kS  -c' ossec13001iExim Auth failed2025-11-17 19:07:45 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:57598: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)188.72.74.1302017370mR  -e) ossec13001iExim Auth failed2025-11-17 19:07:40 dovecot_login authenticator failed for ([218.108.143.34]) [218.108.143.34]:59944: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)218.108.143.341814991#Q  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:07:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758*P  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:07:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841YO  -=) ossec13001iExim Auth failed2025-11-17 19:08:02 dovecot_login authenticator failed for ([218.17.217.141]) [218.17.217.141]:40293: 535 Incorrect authentication data (set_id=contato)218.17.217.1411814991iN  -e% ossec13001iExim Auth failed2025-11-17 19:07:55 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:50617: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)65.20.147.45992370M  e5) ossec9710iODovecot Auth failed on disconnected session.Nov 17 19:06:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044 9 ] 5 U ^ m?!ej  -W' ossec13001iaExim Auth failed2025-11-17 19:10:40 dovecot_login authenticator failed for ([168.126.53.11]) [168.126.53.11]:43219: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)168.126.53.111835841i W' ossec9708iYDovecot Aborted Login with empty userNov 17 19:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)h  e%+ ossec9710iQDovecot Auth failed on disconnected session.Nov 17 19:10:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991/g  e5' ossec9710iuDovecot Auth failed on disconnected session.Nov 17 19:10:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991cf  -S) ossec13001iiExim Auth failed2025-11-17 19:10:48 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:57664: 535 Incorrect authentication data (set_id=anderson)178.150.135.196907913e  e9+ ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 19:09:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001*d  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:09:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822c W' ossec9708iDovecot Aborted Login with empty userNov 17 19:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0a4TmtFDTIuxV3kv>177.87.121.473469034Sb  -5% ossec13001iExim Auth failed2025-11-17 19:09:20 dovecot_login authenticator failed for ([61.79.227.51]) [61.79.227.51]:42894: 535 Incorrect authentication data (set_id=contato)61.79.227.511835841sa  -s' ossec13001iExim Auth failed2025-11-17 19:09:07 dovecot_login authenticator failed for ([218.200.9.182]) [218.200.9.182]:34701: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)218.200.9.1821814991\`  -C) ossec13001iExim Auth failed2025-11-17 19:08:53 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:43792: 535 Incorrect authentication data (set_id=marialuiza)221.234.48.1471814991$_  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:08:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758X^  -?% ossec13001iExim Auth failed2025-11-17 19:08:27 dovecot_login authenticator failed for ([65.181.79.60]) [65.181.79.60]:58291: 535 Incorrect authentication data (set_id=junior.gomes)65.181.79.601819730[]  -C' ossec13001iExim Auth failed2025-11-17 19:08:14 dovecot_login authenticator failed for ([223.167.75.86]) [223.167.75.86]:46166: 535 Incorrect authentication data (set_id=junior.gomes)223.167.75.861814991d\  -U' ossec13001iExim Auth failed2025-11-17 19:08:06 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:55051: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)192.34.164.136252001 ( V < `V%5(sx  -o+ ossec13001iExim Auth failed2025-11-17 19:13:48 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:47710: 535 Incorrect authentication data (set_id=venesselume)201.234.106.2153865483vw  -y' ossec13001iExim Auth failed2025-11-17 19:13:35 dovecot_login authenticator failed for 111-70-23-252.emome-ip.hinet.net [111.70.23.252]:34962: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)111.70.23.2521668284~v  - ' ossec13001iExim Auth failed2025-11-17 19:13:35 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:59486: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)85.225.19.1442661886u W' ossec9708i Dovecot Aborted Login with empty userNov 17 19:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lt  -e' ossec13001iExim Auth failed2025-11-17 19:13:23 dovecot_login authenticator failed for (89fmjoinville.com) [112.122.54.54]:7944: 535 Incorrect authentication data (set_id=postmaster@89fmjoinville.com)112.122.54.541814991-s  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:13:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750%r  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:13:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991]q  -E) ossec13001i%Exim Auth failed2025-11-17 19:13:57 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:47999: 535 Incorrect authentication data (set_id=formula316)175.43.184.2021814991Xp  -=' ossec13001iExim Auth failed2025-11-17 19:12:58 dovecot_login authenticator failed for (89fmjoinville.com) [112.122.54.54]:20303: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991o W' ossec9708iDovecot Aborted Login with empty userNov 17 19:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.n  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:12:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.11915628228m  eG' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:11:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822l  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  z ;- .  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:16:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387}  -+ ossec13001iExim Auth failed2025-11-17 19:16:26 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:38941: 535 Incorrect authentication data (set_id=paulo.user.marketing@louvoreterno.com.br)122.225.203.1061814991x  -}' ossec13001iExim Auth failed2025-11-17 19:17:01 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:53542: 535 Incorrect authentication data (set_id=bianca.user.marketing@globalmedica.com.br)111.26.95.1201814991|  -' ossec13001iExim Auth failed2025-11-17 19:16:47 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:60136: 535 Incorrect authentication data (set_id=paulo.user.marketing)108.30.14.2216252001 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l  -c) ossec13001iExim Auth failed2025-11-17 19:16:04 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:43656: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)177.174.95.2453469034  k' ossec9709iIMultiple Dovecot Aborted Logins with empty userNov 17 19:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   -) ossec13001i=Exim Auth failed2025-11-17 19:14:21 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:42138: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)125.23.155.1101269750;~  eI+ ossec9710i/Dovecot Auth failed on disconnected session.Nov 17 19:14:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001)}  e') ossec9710ijDovecot Auth failed on disconnected session.Nov 17 19:15:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044|  W' ossec9708ihDovecot Aborted Login with empty userNov 17 19:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<13vArdFD8MqxV3kv>177.87.121.473469034){  e+' ossec9710iUDovecot Auth failed on disconnected session.Nov 17 19:14:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758Xz  -=' ossec13001iOExim Auth failed2025-11-17 19:14:39 dovecot_login authenticator failed for ([220.80.221.68]) [220.80.221.68]:38473: 535 Incorrect authentication data (set_id=novamanha)220.80.221.6818358413y  e9+ ossec9710i+Dovecot Auth failed on disconnected session.Nov 17 19:14:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 >  ,  "(>F,/>m  -k# ossec13001ipExim Auth failed2025-11-17 19:19:26 dovecot_login authenticator failed for ([1.30.20.238]) [1.30.20.238]:56032: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)1.30.20.2381814991y  -}) ossec13001iVExim Auth failed2025-11-17 19:19:01 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:56163: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)220.246.42.2121819730 W' ossec9708i:Dovecot Aborted Login with empty userNov 17 19:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t  -u' ossec13001i2Exim Auth failed2025-11-17 19:18:25 dovecot_login authenticator failed for 176-170-1-244.abo.bbox.fr [176.170.1.244]:56885: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)176.170.1.2443017382\  -A+ ossec13001iVExim Auth failed2025-11-17 19:19:01 dovecot_login authenticator failed for ([120.157.143.104]) [120.157.143.104]:39006: 535 Incorrect authentication data (set_id=contato)120.157.143.1042077456K  -'# ossec13001iExim Auth failed2025-11-17 19:17:36 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:59064: 535 Incorrect authentication data (set_id=ti)46.8.240.2620173707  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:17:23 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=190.89.137.87, lip=200.150.196.245, TLS, session=190.89.137.873469034X  -=' ossec13001iExim Auth failed2025-11-17 19:17:20 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:41248: 535 Incorrect authentication data (set_id=comercial)128.185.187.21269750w  -}% ossec13001i Exim Auth failed2025-11-17 19:17:44 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:56122: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)91.126.40.542510769  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0Vq3ttFD+qmxV3kv>177.87.121.473469034m  -i% ossec13001iExim Auth failed2025-11-17 19:17:16 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:49402: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)103.90.27.831643084  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001iExim Auth failed2025-11-17 19:17:57 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:47764: 535 Incorrect authentication data (set_id=rafael)121.73.169.1492186224X  -A# ossec13001iExim Auth failed2025-11-17 19:17:48 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:51767: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999~  -+ ossec13001iExim Auth failed2025-11-17 19:16:42 dovecot_login authenticator failed for ([211.198.128.204]) [211.198.128.204]:49911: 535 Incorrect authentication data (set_id=bianca.user.marketing@globalmedica.com.br)211.198.128.2041835841 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 8 W k   &  -+ ossec13001iExim Auth failed2025-11-17 19:20:41 dovecot_login authenticator failed for host173.186-125-122.telecom.net.ar [186.125.122.173]:60998: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)186.125.122.1733865483/%  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:20:35 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=109.125.247.218, lip=200.150.196.245, TLS, session=<7uNWwNFD8r5tfffa>109.125.247.218798544$  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034P# -/% ossec13001iExim Auth failed2025-11-17 19:20:21 dovecot_login authenticator failed for (Pl7V0y) [141.98.11.11]:60894: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427"  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_!  -G+ ossec13001iExim Auth failed2025-11-17 19:20:05 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:53556: 535 Incorrect authentication data (set_id=alex.vendas)122.186.219.1501269750_  -G+ ossec13001iExim Auth failed2025-11-17 19:19:50 dovecot_login authenticator failed for ([123.129.196.119]) [123.129.196.119]:33109: 535 Incorrect authentication data (set_id=formula316)123.129.196.1191814991 W' ossec9708ivDovecot Aborted Login with empty userNov 17 19:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001ivExim Auth failed2025-11-17 19:19:33 dovecot_login authenticator failed for ([202.111.183.30]) [202.111.183.30]:50660: 535 Incorrect authentication data (set_id=doninha)202.111.183.301814991|  -' ossec13001irExim Auth failed2025-11-17 19:19:29 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:42874: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)181.177.9.1193865483\  -A+ ossec13001ipExim Auth failed2025-11-17 19:19:27 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:35704: 535 Incorrect authentication data (set_id=doninha)209.115.177.2126251999Q  -3% ossec13001iExim Auth failed2025-11-17 19:19:57 dovecot_login authenticator failed for (vysOIEvT) [141.98.11.11]:58569: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427h  -a# ossec13001iExim Auth failed2025-11-17 19:19:50 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:40055: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)14.6.16.1371835841]  -E) ossec13001iExim Auth failed2025-11-17 19:19:47 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:43802: 535 Incorrect authentication data (set_id=venesselume)103.250.160.761269750V  -9' ossec13001iExim Auth failed2025-11-17 19:19:42 dovecot_login authenticator failed for ([218.58.73.238]) [218.58.73.238]:37316: 535 Incorrect authentication data (set_id=adriana)218.58.73.2381814991j  -_) ossec13001itExim Auth failed2025-11-17 19:19:31 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:34372: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)122.186.243.781269750 e" J v m &2C[^+Ie`7  -K) ossec13001iExim Auth failed2025-11-17 19:22:17 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:58130: 535 Incorrect authentication data (set_id=isabellylisboa)12.222.177.1466252001^6  -I' ossec13001iExim Auth failed2025-11-17 19:21:15 dovecot_login authenticator failed for ([46.149.34.226]) [46.149.34.226]:59704: 535 Incorrect authentication data (set_id=administrativo1)46.149.34.2262017370/5  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:21:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841y4  -}) ossec13001iExim Auth failed2025-11-17 19:22:04 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:56176: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)103.147.248.441269750d3  -Q+ ossec13001iExim Auth failed2025-11-17 19:21:06 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63939: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651k2  -c' ossec13001iExim Auth failed2025-11-17 19:21:06 dovecot_login authenticator failed for (globalmedica.com.br) [61.50.119.110]:31020: 535 Incorrect authentication data (set_id=test@globalmedica.com.br)61.50.119.1101814991p1  -k) ossec13001iExim Auth failed2025-11-17 19:21:06 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:48138: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)85.116.125.2392017370[0  -?+ ossec13001iExim Auth failed2025-11-17 19:21:32 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:55591: 535 Incorrect authentication data (set_id=wesley)200.149.213.2423469034V/  -;% ossec13001iExim Auth failed2025-11-17 19:21:24 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:51185: 535 Incorrect authentication data (set_id=financeiro)58.16.201.521814991h.  -_% ossec13001iExim Auth failed2025-11-17 19:21:54 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:57405: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)112.30.127.91814991- 3C% ossec11301iNew FTP connection.Nov 17 19:21:44 hosting pure-ftpd: (?@34.52.204.70) [INFO] New connection from 34.52.204.7034.52.204.702802361, W' ossec9708iDovecot Aborted Login with empty userNov 17 19:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k+  -c' ossec13001iExim Auth failed2025-11-17 19:21:18 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:45062: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)222.120.176.61835841P* -/% ossec13001iExim Auth failed2025-11-17 19:21:06 dovecot_login authenticator failed for (XvYxbH) [141.98.11.11]:52436: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.115974271)  A]% ossec11302iFTP Authentication failed.Nov 17 19:21:51 hosting pure-ftpd: (?@34.52.204.70) [WARNING] Authentication failed for user [anonymous]34.52.204.702802361(  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:20:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.15.171.156, lip=200.150.196.245, TLS, session=<5OO+wdFDUt+5D6uc>185.15.171.1563175395Z'  -A' ossec13001iExim Auth failed2025-11-17 19:20:41 dovecot_login authenticator failed for (globalmedica.com.br) [61.50.119.110]:26388: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991  ' 0 B evRG -3% ossec13001iLExim Auth failed2025-11-17 19:23:07 dovecot_login authenticator failed for (iD1CVcIG) [141.98.11.11]:62728: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427F  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lE  -i# ossec13001iExim Auth failed2025-11-17 19:24:00 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:29445: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)61.32.68.661835841.D  e1) ossec9710ibDovecot Auth failed on disconnected session.Nov 17 19:23:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841pC  -k+ ossec13001iRExim Auth failed2025-11-17 19:23:14 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:37388: 535 Incorrect authentication data (set_id=presidencia)213.130.207.177597427uB  -w' ossec13001iLExim Auth failed2025-11-17 19:23:07 dovecot_login authenticator failed for ([36.135.100.48]) [36.135.100.48]:50716: 535 Incorrect authentication data (set_id=comercial.user.marketing@inovasite.com)36.135.100.481814991PA -/% ossec13001iExim Auth failed2025-11-17 19:22:10 dovecot_login authenticator failed for (98AAwk) [141.98.11.11]:60703: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427r@  -o) ossec13001i:Exim Auth failed2025-11-17 19:22:50 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:46986: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)220.178.246.431814991k?  -c' ossec13001iExim Auth failed2025-11-17 19:22:17 dovecot_login authenticator failed for ([150.129.138.198]) [112.96.228.60]:37718: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)112.96.228.601814991Y>  -=) ossec13001iExim Auth failed2025-11-17 19:22:10 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:48912: 535 Incorrect authentication data (set_id=contato)220.80.223.1441835841j=  -c% ossec13001iExim Auth failed2025-11-17 19:22:09 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:53654: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)157.15.67.201643084s<  -o+ ossec13001i8Exim Auth failed2025-11-17 19:22:47 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:60216: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)196.203.231.2202464461^;  -I' ossec13001i6Exim Auth failed2025-11-17 19:22:46 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:21844: 535 Incorrect authentication data (set_id=flavio.oliveira)175.115.29.391835841`:  -I+ ossec13001i.Exim Auth failed2025-11-17 19:22:37 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:32951: 535 Incorrect authentication data (set_id=atualizacoes)186.238.247.23834690349 W' ossec9708i*Dovecot Aborted Login with empty userNov 17 19:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u8  -u) ossec13001i Exim Auth failed2025-11-17 19:22:24 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:54372: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)188.81.132.1142264397    D .%# V  W' ossec9708i6Dovecot Aborted Login with empty userNov 17 19:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8eKk2NFD4NqxV3kv>177.87.121.473469034~U  - ' ossec13001i2Exim Auth failed2025-11-17 19:26:57 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:39552: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.78.159.821269750kT  -c' ossec13001iExim Auth failed2025-11-17 19:25:32 dovecot_login authenticator failed for ([178.35.150.58]) [178.35.150.58]:53574: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)178.35.150.582017370S W' ossec9708iDovecot Aborted Login with empty userNov 17 19:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034SR -5% ossec13001iExim Auth failed2025-11-17 19:25:17 dovecot_login authenticator failed for (fHXwBQEtd) [141.98.11.11]:60043: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427lQ  -c) ossec13001iExim Auth failed2025-11-17 19:24:31 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:56796: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)103.140.18.1861269750P W' ossec9708iDovecot Aborted Login with empty userNov 17 19:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0uqzz9FDBpGxV3kv>177.87.121.473469034O  - ) ossec13001iExim Auth failed2025-11-17 19:24:25 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:54121: 535 Incorrect authentication data (set_id=paulinho.vendas)201.15.149.2543469034,N  e3# ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:24:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001PM -/% ossec13001iExim Auth failed2025-11-17 19:24:56 dovecot_login authenticator failed for (rk6DS3) [141.98.11.11]:52749: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427YL  -=) ossec13001iExim Auth failed2025-11-17 19:24:45 dovecot_login authenticator failed for ([183.99.158.244]) [183.99.158.244]:50102: 535 Incorrect authentication data (set_id=contato)183.99.158.2441835841oK  -i) ossec13001ihExim Auth failed2025-11-17 19:23:36 dovecot_login authenticator failed for (188x186x183x88.dynamic.tmn.ertelecom.ru) [188.186.183.88]:44292: 535 Incorrect authentication data (set_id=rafael)188.186.183.882017370J  k' ossec9709ifMultiple Dovecot Aborted Logins with empty userNov 17 19:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034hI  -[) ossec13001i^Exim Auth failed2025-11-17 19:23:24 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.227]:41412: 535 Incorrect authentication data (set_id=comercial.user.marketing)185.137.75.2273017382H  -+ ossec13001i\Exim Auth failed2025-11-17 19:23:22 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:52628: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)122.187.227.1521269750 7 D !  C)7]f  -G) ossec13001iExim Auth failed2025-11-17 19:28:34 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:51496: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549[e  -C' ossec13001iExim Auth failed2025-11-17 19:28:30 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:51562: 535 Incorrect authentication data (set_id=atualizacoes)65.191.211.336252001kd  -c' ossec13001iExim Auth failed2025-11-17 19:28:27 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:58036: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)92.100.39.1802017370c W' ossec9708iDovecot Aborted Login with empty userNov 17 19:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nb  -o% ossec13001iExim Auth failed2025-11-17 19:28:21 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:38384: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)65.20.191.1299237a -) ossec13001iExim Auth failed2025-11-17 19:28:18 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:59342: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)101.165.208.122077456'`  e%' ossec9710iiDovecot Auth failed on disconnected session.Nov 17 19:27:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084_ W' ossec9708iTDovecot Aborted Login with empty userNov 17 19:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034O^  -/% ossec13001iRExim Auth failed2025-11-17 19:27:29 dovecot_login authenticator failed for (g6rG67) [141.98.11.11]:65214: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427~]  -) ossec13001iPExim Auth failed2025-11-17 19:27:28 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:47590: 535 Incorrect authentication data (set_id=atualizacoes)203.132.133.541269750V\  -9' ossec13001iFExim Auth failed2025-11-17 19:27:17 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:48120: 535 Incorrect authentication data (set_id=contato)103.68.19.1701269750+[  e)+ ossec9710i"Dovecot Auth failed on disconnected session.Nov 17 19:26:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<98VO19FDLs99gnHM>125.130.113.2041835841Z  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:26:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034TY -7% ossec13001iExim Auth failed2025-11-17 19:26:24 dovecot_login authenticator failed for (zBERpA8bd5) [141.98.11.11]:53604: 535 Incorrect authentication data (set_id=louvoreterno)141.98.11.11597427pX  -i+ ossec13001iExim Auth failed2025-11-17 19:26:21 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:42605: 535 Incorrect authentication data (set_id=sec.geral)203.198.173.1371819730lW  -e' ossec13001i Exim Auth failed2025-11-17 19:26:20 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:36412: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)58.222.184.181814991  v~$u  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:29:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<332N4NFDnpnSchJs>210.114.18.1081835841pt  -m) ossec13001iExim Auth failed2025-11-17 19:29:07 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:54329: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)185.241.208.83798544]s -C) ossec13001iExim Auth failed2025-11-17 19:29:53 dovecot_login authenticator failed for (User) [177.74.174.120]:54611: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)177.74.174.1203469034r  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 q  -+ ossec13001iExim Auth failed2025-11-17 19:29:31 dovecot_login authenticator failed for (nsg-corporate-150.144.185.122.airtel.in) [122.185.144.150]:38140: 535 Incorrect authentication data (set_id=hcpontagrossa@hipercesta.com.br)122.185.144.1501269750p  - ) ossec13001iExim Auth failed2025-11-17 19:29:23 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:34885: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)172.248.47.1146252001}o  -) ossec13001iExim Auth failed2025-11-17 19:29:32 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:49934: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)201.173.92.1003996063bn  -M+ ossec13001iExim Auth failed2025-11-17 19:29:47 dovecot_login authenticator failed for ([119.198.191.180]) [119.198.191.180]:32774: 535 Incorrect authentication data (set_id=hcpontagrossa)119.198.191.1801835841Xm  -=' ossec13001iExim Auth failed2025-11-17 19:29:39 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:57232: 535 Incorrect authentication data (set_id=comercial)74.208.177.566252001l  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345k  eC% ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:30:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651*j  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:29:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<03Zj4tFD9Lel0xnK>165.211.25.2022233387\i  -A+ ossec13001iExim Auth failed2025-11-17 19:28:44 dovecot_login authenticator failed for ([200.149.213.242]) [200.149.213.242]:59340: 535 Incorrect authentication data (set_id=brizola)200.149.213.2423469034qh -m) ossec13001iExim Auth failed2025-11-17 19:28:43 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:53320: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)185.241.208.837985441g  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:28:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822 1) R r n|>J1j  -]+ ossec13001iUExim Auth failed2025-11-17 19:31:47 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:37394: 535 Incorrect authentication data (set_id=isabellylisboa)128.199.118.2341880251'  e%' ossec9710i9Dovecot Auth failed on disconnected session.Nov 17 19:31:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991p  -m' ossec13001icExim Auth failed2025-11-17 19:32:01 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:51602: 535 Incorrect authentication data (set_id=atendimento@lorussoimoveis.com.br)182.95.177.781269750:  eI) ossec9710icDovecot Auth failed on disconnected session.Nov 17 19:32:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750n  -g) ossec13001iSExim Auth failed2025-11-17 19:31:45 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:57048: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)210.177.143.611819730 W' ossec9708iEDovecot Aborted Login with empty userNov 17 19:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y  -}) ossec13001iEExim Auth failed2025-11-17 19:31:31 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:60804: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)125.19.248.1701269750+~  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:30:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822}  -) ossec13001iExim Auth failed2025-11-17 19:30:10 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:42809: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)122.187.226.131269750k|  -_+ ossec13001iExim Auth failed2025-11-17 19:30:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51047: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651]{ -C) ossec13001iExim Auth failed2025-11-17 19:30:09 dovecot_login authenticator failed for (User) [177.74.174.120]:54611: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)177.74.174.1203469034`z  -O' ossec13001iExim Auth failed2025-11-17 19:30:54 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64004: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795\y  -C) ossec13001iExim Auth failed2025-11-17 19:30:42 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:36192: 535 Incorrect authentication data (set_id=financeiro)220.93.167.14418358419x  -% ossec13001i Exim Auth failed2025-11-17 19:30:36 dovecot_login authenticator failed for (eiazX4) [141.98.11.11]:62129: 535 Incorrect authentication data141.98.11.11597427w W' ossec9708i Dovecot Aborted Login with empty userNov 17 19:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0bQr5dFDys6xV3kv>177.87.121.473469034Sv  -5% ossec13001iExim Auth failed2025-11-17 19:29:52 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:51560: 535 Incorrect authentication data (set_id=contato)14.97.77.1821269750  "+9\( W' ossec9708iDovecot Aborted Login with empty userNov 17 19:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:33:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:33:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001Y  -;+ ossec13001iExim Auth failed2025-11-17 19:34:04 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:51242: 535 Incorrect authentication data (set_id=info)103.194.243.1871269750n  -g) ossec13001iExim Auth failed2025-11-17 19:33:50 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:38366: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)128.185.194.221269750s  -s' ossec13001iExim Auth failed2025-11-17 19:32:32 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:40296: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)103.249.19.341643084j  -_) ossec13001iExim Auth failed2025-11-17 19:32:31 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:59145: 535 Incorrect authentication data (set_id=isabella@eloempresas.com)62.140.234.1142017370S  -3' ossec13001iwExim Auth failed2025-11-17 19:32:22 dovecot_login authenticator failed for ([222.85.202.86]) [59.51.142.242]:47274: 535 Incorrect authentication data (set_id=info)59.51.142.2421814991  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b  -Q' ossec13001iExim Auth failed2025-11-17 19:32:45 dovecot_login authenticator failed for (dynamic-adsl.viettel.vn) [171.243.93.89]:45406: 535 Incorrect authentication data (set_id=atendimento)171.243.93.891562822]  -C+ ossec13001iExim Auth failed2025-11-17 19:32:46 dovecot_login authenticator failed for ([176.100.124.153]) [176.100.124.153]:55174: 535 Incorrect authentication data (set_id=isabella)176.100.124.1532017370  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -a' ossec13001iaExim Auth failed2025-11-17 19:31:59 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:44880: 535 Incorrect authentication data (set_id=info)202.53.94.2421269750$  e) ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 19:31:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<6Xww6tFDtJml0iHB>165.210.33.1932233387 | 7)M^|^$  -M% ossec13001iWExim Auth failed2025-11-17 19:36:06 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:41771: 535 Incorrect authentication data (set_id=info.user.marketing)37.25.36.197294640k#  -e% ossec13001iAExim Auth failed2025-11-17 19:35:44 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:41730: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)50.217.40.116252001X"  -;) ossec13001i-Exim Auth failed2025-11-17 19:35:24 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:37302: 535 Incorrect authentication data (set_id=gerson)211.228.113.271835841q!  -o' ossec13001i)Exim Auth failed2025-11-17 19:35:20 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:13158: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)111.61.176.581814991  W' ossec9708iSDovecot Aborted Login with empty userNov 17 19:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -7' ossec13001i1Exim Auth failed2025-11-17 19:35:28 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:42200: 535 Incorrect authentication data (set_id=sociais)123.31.12.1871562822g  -[' ossec13001i%Exim Auth failed2025-11-17 19:35:16 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:53502: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)111.61.97.1081814991Z  -A' ossec13001iSExim Auth failed2025-11-17 19:36:03 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:35774: 535 Incorrect authentication data (set_id=vanessalima)182.95.115.701269750(  e'' ossec9710i;Dovecot Auth failed on disconnected session.Nov 17 19:35:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084w  -}% ossec13001i5Exim Auth failed2025-11-17 19:35:33 dovecot_login authenticator failed for ([49.207.15.25]) [49.207.15.25]:54439: 535 Incorrect authentication data (set_id=info.user.marketing@lixadoracuritiba.com.br)49.207.15.251269750r  -o) ossec13001i/Exim Auth failed2025-11-17 19:35:27 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:36154: 535 Incorrect authentication data (set_id=jotadeschamps)57.132.150.1626252001p  -i+ ossec13001i#Exim Auth failed2025-11-17 19:35:15 dovecot_login authenticator failed for ([122.224.164.194]) [122.224.164.194]:55519: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)122.224.164.1941814991x  -{) ossec13001i!Exim Auth failed2025-11-17 19:35:13 dovecot_login authenticator failed for 110-25-110-136.adsl.fetnet.net [110.25.110.136]:55773: 535 Incorrect authentication data (set_id=andre.nascimento.marketing)110.25.110.1361668284r  -m+ ossec13001iWExim Auth failed2025-11-17 19:36:06 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:44451: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)177.236.146.2093996063  k' ossec9709i5Multiple Dovecot Aborted Logins with empty userNov 17 19:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}  - ' ossec13001iExim Auth failed2025-11-17 19:34:57 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:57743: 535 Incorrect authentication data (set_id=andre.nascimento.marketing@calcautomacao.com.br)94.201.22.158290557   3  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034S2  -3' ossec13001iExim Auth failed2025-11-17 19:38:00 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:46984: 535 Incorrect authentication data (set_id=info)39.165.183.7018149911  e% ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:37:39 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=65.20.250.63, lip=200.150.196.245, TLS, session=65.20.250.6399237\0  -C) ossec13001iExim Auth failed2025-11-17 19:37:26 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:51268: 535 Incorrect authentication data (set_id=financeiro)125.19.154.15812697501/  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:37:20 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=49.207.15.25, lip=200.150.196.245, TLS, session=49.207.15.251269750r.  -o) ossec13001iExim Auth failed2025-11-17 19:37:12 dovecot_login authenticator failed for ([122.185.145.54]) [122.185.145.54]:54552: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)122.185.145.541269750g-  -Y) ossec13001iExim Auth failed2025-11-17 19:37:48 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:42778: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)122.184.124.461269750,  - ) ossec13001iExim Auth failed2025-11-17 19:37:42 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:57738: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)200.141.211.583469034+ W' ossec9708iDovecot Aborted Login with empty userNov 17 19:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d*  -Q+ ossec13001iExim Auth failed2025-11-17 19:37:27 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:49080: 535 Incorrect authentication data (set_id=administrativo1)197.219.228.2501036973/)  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:37:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822p(  -i+ ossec13001iExim Auth failed2025-11-17 19:36:57 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:50248: 535 Incorrect authentication data (set_id=administrativo1)121.202.195.1941819730'  -) ossec13001isExim Auth failed2025-11-17 19:36:34 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:36244: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)192.46.237.1332921044& W' ossec9708iqDovecot Aborted Login with empty userNov 17 19:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c%  -S' ossec13001igExim Auth failed2025-11-17 19:36:22 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:62301: 535 Incorrect authentication data (set_id=recepcao)87.103.126.542264397 m% G $ G \ |qsYgw?KfmuC  SU# ossec11000ihLogin failed on the cpanel service.[2025-11-17 19:40:39 -0300] info [webmaild] 182.9.35.62 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect182.9.35.621643084aB  -K+ ossec13001iNExim Auth failed2025-11-17 19:40:13 dovecot_login authenticator failed for ([222.236.155.146]) [222.236.155.146]:52610: 535 Incorrect authentication data (set_id=junior.gomes)222.236.155.1461835841pA  -i+ ossec13001iJExim Auth failed2025-11-17 19:40:09 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:35852: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)111.171.127.19018358414@  e?' ossec9710ihDovecot Auth failed on disconnected session.Nov 17 19:40:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084l?  -e' ossec13001iTExim Auth failed2025-11-17 19:40:19 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47772: 535 Incorrect authentication data (set_id=leandro)213.124.221.22750405n>  -i' ossec13001iBExim Auth failed2025-11-17 19:40:00 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:51279: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)14.37.206.1361835841= W' ossec9708i%Dovecot Aborted Login with empty userNov 17 19:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z<  -' ossec13001iExim Auth failed2025-11-17 19:39:23 dovecot_login authenticator failed for 47-206-95-195.static.bhpk.fl.ip.frontiernet.net [47.206.95.195]:45158: 535 Incorrect authentication data (set_id=ferramentaria)47.206.95.1956252001;  -' ossec13001iExim Auth failed2025-11-17 19:39:12 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:56884: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)77.37.162.1172017370\:  -A+ ossec13001i Exim Auth failed2025-11-17 19:39:09 dovecot_login authenticator failed for ([154.203.239.222]) [154.203.239.222]:60979: 535 Incorrect authentication data (set_id=contato)154.203.239.2223374766g9  -a# ossec13001iExim Auth failed2025-11-17 19:38:55 dovecot_login authenticator failed for (static20.byfly.gomel.by) [93.84.78.69]:51427: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)93.84.78.69630336Y8 ;1% ossec13008iMail Recipient rejected2025-11-17 19:38:42 H=(localhost) [201.131.26.6]:52553 F= rejected RCPT : Sender verify failed201.131.26.634690347  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z6  -A' ossec13001iExim Auth failed2025-11-17 19:38:21 dovecot_login authenticator failed for ([180.159.43.35]) [180.159.43.35]:56466: 535 Incorrect authentication data (set_id=alex.vendas)180.159.43.351814991V5  -9' ossec13001iExim Auth failed2025-11-17 19:38:19 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:60507: 535 Incorrect authentication data (set_id=contato)27.223.98.1171814991}4  -' ossec13001iExim Auth failed2025-11-17 19:38:08 dovecot_login authenticator failed for 64.85.222.240.reverse.socket.net [64.85.222.240]:46858: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)64.85.222.2406252001  sI0P%IE(Q  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001P  - ) ossec13001iExim Auth failed2025-11-17 19:42:12 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:60642: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)213.33.204.1302017370XO  -?' ossec13001iExim Auth failed2025-11-17 19:42:52 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:60294: 535 Incorrect authentication data (set_id=magda)62.74.225.186390903'N  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:42:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841\M  -I% ossec13001iExim Auth failed2025-11-17 19:41:10 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60565: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758L  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:42:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345K  eC% ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:41:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<2SDwDdJDhM0zTY0d>51.77.141.293017382mJ  -e) ossec13001iExim Auth failed2025-11-17 19:41:34 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:40505: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)62.140.234.1142017370I  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034mH  -e) ossec13001iExim Auth failed2025-11-17 19:41:21 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:40032: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)121.73.161.1432186224G  W) ossec9708iDovecot Aborted Login with empty userNov 17 19:41:20 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=200.138.15.198, lip=200.150.207.122, TLS, session=200.138.15.1983469034F W' ossec9708ibDovecot Aborted Login with empty userNov 17 19:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034E  -) ossec13001iRExim Auth failed2025-11-17 19:40:17 dovecot_login authenticator failed for broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:42802: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)109.173.39.10320173700D  e3+ ossec9710ijDovecot Auth failed on disconnected session.Nov 17 19:40:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 r  6 T j wsx_ria  -]) ossec13001iFExim Auth failed2025-11-17 19:44:21 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:43248: 535 Incorrect authentication data (set_id=envios@comercial.art.br)218.67.123.2021814991`  W' ossec9708ipDovecot Aborted Login with empty userNov 17 19:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w_  -{' ossec13001i"Exim Auth failed2025-11-17 19:43:46 dovecot_login authenticator failed for (10.197.54.123.broad.zm.ha.dynamic.163data.com.cn) [123.54.197.10]:35336: 535 Incorrect authentication data (set_id=contato)123.54.197.1018149910^  e5) ossec9710i Dovecot Auth failed on disconnected session.Nov 17 19:43:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044] W' ossec9708iDovecot Aborted Login with empty userNov 17 19:43:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o\  -i) ossec13001iExim Auth failed2025-11-17 19:43:33 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:38406: 535 Incorrect authentication data (set_id=janaina)122.187.229.361269750m[  -e) ossec13001iExim Auth failed2025-11-17 19:43:30 dovecot_login authenticator failed for ([128.185.224.14]) [122.186.244.34]:51284: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)122.186.244.341269750\Z  -A+ ossec13001i$Exim Auth failed2025-11-17 19:43:48 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:34362: 535 Incorrect authentication data (set_id=rodrigo)169.211.232.1821835841nY  -g) ossec13001iExim Auth failed2025-11-17 19:43:37 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:39262: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)50.217.255.1716252001oX  -i) ossec13001i Exim Auth failed2025-11-17 19:43:21 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:29744: 535 Incorrect authentication data (set_id=janaina@vidaengenharia.com.br)111.61.177.1901814991fW  -[% ossec13001iExim Auth failed2025-11-17 19:42:27 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=magda@vidaengenharia.com.br)8.243.166.663686110^V  -G) ossec13001iExim Auth failed2025-11-17 19:42:24 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:35860: 535 Incorrect authentication data (set_id=fabio.vendas)111.61.176.2441814991ZU  -=+ ossec13001iExim Auth failed2025-11-17 19:43:01 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:35558: 535 Incorrect authentication data (set_id=magda)154.144.255.2102542007XT  -;) ossec13001iExim Auth failed2025-11-17 19:42:59 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:45644: 535 Incorrect authentication data (set_id=xavier)121.73.163.1812186224rS  -m+ ossec13001iExim Auth failed2025-11-17 19:42:46 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:59242: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)178.178.194.1922017370R W' ossec9708iDovecot Aborted Login with empty userNov 17 19:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 p*> 2 (   ~tj`VLB8.$f\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p 4 * f R H > \  vD:0&lbXN|@rh,^T6J"xndZPF< 2(~tj`VL$B8.\>RHzpf | r h ^ T J @ 6 , "    x n d Z P F <zp4*  vlbXND:0& i i i i i i i i i i i i i i i i i i i ii i] iO iI i? im iU iM i5 i i i i i i# i! i i i i i i i i i i i i i i i i i i ir id i\ iL iD i~ i@ i' i! i i i i i i i i i im iY i i i1 iM i iS iM iC i1 i/ i i i i i i i ig i i} i{ iy is is iW iE iA i; i5 i1  i1 ~ ic } ia | iS { iA z i" y i" x i w i v i u i t i s i r i q i p i o i n i m i l i k i j i i i h iR g iL f in e i\ d iZ c ip ` iT b iF a i$ Z i" _ i ^ i Y i ] i \ i [ i X i U i T i O i N i S i R i Q i W i V i P i L i K i J i I i H i G i M ij D ih C ih @ ib F iT ? iR E iN B iJ A iB > i% = i < i ; i : i 3 i i i i i i i i i i i i i i i i i i i i i i| iz ir if if i[ iW iE iE i? i= i9 i7 i- i i i i i i i i i i i i 9 i 8 i 7 i 6 i 5 i 4 i 2 i - i , i 1 i + i 0 i * i / i ) i . i ( is ' iq & ig % iW $ iW  iS iS  iA # i;  i5  i5  i1  i/  i- " i) ! i%  i#  i!  i  i  i  i  i  i  i  i i i i i  i i  iw ic  ic  ia  i_  iU  iS  iE iE i9  i i i i i i i i i i i i i i i i i i i i y( 3 v\hykp  -c' ossec13001iExim Auth failed2025-11-17 19:47:03 dovecot_login authenticator failed for (Y9wmJS) [91.92.243.111]:63735: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)91.92.243.1116252001po  -k) ossec13001iExim Auth failed2025-11-17 19:46:58 dovecot_login authenticator failed for ([178.232.51.135]) [178.232.51.135]:53497: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)178.232.51.1353144096n W' ossec9708iDovecot Aborted Login with empty userNov 17 19:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*m  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:46:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<0AKjHdJDzuUkMrBu>36.50.176.1101562822`l  -M' ossec13001iExim Auth failed2025-11-17 19:45:57 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:65472: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730-k  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:45:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750[j  -G# ossec13001iExim Auth failed2025-11-17 19:45:31 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:46310: 535 Incorrect authentication data (set_id=marcos@louvoreterno.com.br)84.54.33.832750405i W' ossec9708iDovecot Aborted Login with empty userNov 17 19:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342h  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:45:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001g  k' ossec9709iRMultiple Dovecot Aborted Logins with empty userNov 17 19:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kf  -c' ossec13001iLExim Auth failed2025-11-17 19:44:27 dovecot_login authenticator failed for ([14.225.32.239]) [14.225.32.239]:54780: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)14.225.32.23915628225e  e?) ossec9710inDovecot Auth failed on disconnected session.Nov 17 19:45:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<67TQGNJD/sql0xnK>165.211.25.2022233387Sd  -5% ossec13001i\Exim Auth failed2025-11-17 19:44:43 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:52518: 535 Incorrect authentication data (set_id=contato)50.217.40.116252001c  W' ossec9708iZDovecot Aborted Login with empty userNov 17 19:44:40 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=123.58.213.20, lip=186.233.225.118, TLS, session=123.58.213.201819730Tb  -7' ossec13001iTExim Auth failed2025-11-17 19:44:36 dovecot_login authenticator failed for ([41.59.228.160]) [41.59.228.160]:52236: 535 Incorrect authentication data (set_id=envios)41.59.228.160149590 G2 J ' ?  "GW -9' ossec13001i5Exim Auth failed2025-11-17 19:48:19 dovecot_login authenticator failed for (K5sF26) [91.92.243.111]:60354: 535 Incorrect authentication data (set_id=andre.nascimento)91.92.243.1116252001t  -u' ossec13001i1Exim Auth failed2025-11-17 19:48:16 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:44148: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)70.174.168.996252001m~  -c+ ossec13001i1Exim Auth failed2025-11-17 19:48:16 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:57634: 535 Incorrect authentication data (set_id=envios)218.103.120.1501819730i}  -a) ossec13001icExim Auth failed2025-11-17 19:49:05 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:41318: 535 Incorrect authentication data (set_id=contato@adlondrina.com.br)196.216.81.12649518k|  -c' ossec13001iaExim Auth failed2025-11-17 19:49:03 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:48753: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)187.6.121.2463469034[{  -A) ossec13001iSExim Auth failed2025-11-17 19:48:49 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:40503: 535 Incorrect authentication data (set_id=escritura1)177.61.176.1103469034z W' ossec9708iADovecot Aborted Login with empty userNov 17 19:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fy  -Y' ossec13001i"Exim Auth failed2025-11-17 19:48:02 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:42118: 535 Incorrect authentication data (set_id=envios@comercial.art.br)111.26.61.2441814991x  W' ossec9708i"Dovecot Aborted Login with empty userNov 17 19:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$w  e!' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 19:48:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.1371307580v  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:47:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991du  -W% ossec13001iExim Auth failed2025-11-17 19:47:51 dovecot_login authenticator failed for n7-c210.client.tomica.ru [78.140.7.210]:55316: 535 Incorrect authentication data (set_id=desenvolvimento2)78.140.7.2102017370t  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ds  -Q+ ossec13001i Exim Auth failed2025-11-17 19:47:40 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51190: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651Xr -;' ossec13001iExim Auth failed2025-11-17 19:47:29 dovecot_login authenticator failed for (hUhJAgY) [91.92.243.111]:49518: 535 Incorrect authentication data (set_id=andre.nascimento)91.92.243.1116252001nq  -i' ossec13001iExim Auth failed2025-11-17 19:47:20 dovecot_login authenticator failed for 93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:45840: 535 Incorrect authentication data (set_id=desenvolvimento2)93.42.227.2513175395   , EG-!y  -{+ ossec13001iExim Auth failed2025-11-17 19:50:18 dovecot_login authenticator failed for ([125.138.166.217]) [125.138.166.217]:49392: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)125.138.166.2171835841  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f  -]# ossec13001iExim Auth failed2025-11-17 19:50:38 dovecot_login authenticator failed for (static.38.23.53.80.macminivault.com) [38.23.53.80]:54439: 535 Incorrect authentication data (set_id=contato)38.23.53.806252001  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:50:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[ -A' ossec13001igExim Auth failed2025-11-17 19:49:09 dovecot_login authenticator failed for (ltPbA1f3jU) [91.92.243.111]:62494: 535 Incorrect authentication data (set_id=andre.nascimento)91.92.243.1116252001)  e-# ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:49:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<9z1zKdJDtJkXXz9j>23.95.63.996252001 W' ossec9708i}Dovecot Aborted Login with empty userNov 17 19:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z  -) ossec13001i{Exim Auth failed2025-11-17 19:49:30 dovecot_login authenticator failed for (94x181x191x152.static-business.penza.ertelecom.ru) [94.181.191.152]:45748: 535 Incorrect authentication data (set_id=contato)94.181.191.1522017370c  -W# ossec13001iyExim Auth failed2025-11-17 19:49:27 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:40098: 535 Incorrect authentication data (set_id=derly@educacionalevangelico.com.br)84.54.33.832750405g  -]% ossec13001isExim Auth failed2025-11-17 19:49:22 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39814: 535 Incorrect authentication data (set_id=contato)71.41.202.126252001[  -A) ossec13001isExim Auth failed2025-11-17 19:49:21 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:54714: 535 Incorrect authentication data (set_id=sec.geral)196.28.226.1241036973w  -y) ossec13001iWExim Auth failed2025-11-17 19:48:54 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:58256: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)49.206.201.2531269750w  -y) ossec13001iEExim Auth failed2025-11-17 19:48:35 dovecot_login authenticator failed for ([186.177.88.122]) [186.177.88.122]:53563: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)186.177.88.1223624060_  -G+ ossec13001iAExim Auth failed2025-11-17 19:48:31 dovecot_login authenticator failed for ([123.235.187.158]) [123.235.187.158]:45918: 535 Incorrect authentication data (set_id=escritura1)123.235.187.1581814991-  e-+ ossec9710i;Dovecot Auth failed on disconnected session.Nov 17 19:48:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0:  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034{ 3469034z 3469034y 3469034w 3469034m 3469034g 3469034e 3469034c 3469034^ 3469034V 3469034P 3469034M 3469034K 3469034J 3469034D 3469034? 3469034= 3469034: 34690343 3469034/ 3469034) 3469034( 3469034! 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034z 3469034v 3469034k 3469034j 3469034^ 3469034Y 3469034U 3469034S 3469034K 3469034F 3469034D 3469034C 3469034B 3469034@ 34690343 34690340 3469034( 3469034% 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034} 3469034w 3469034o 3469034m 3469034h 3469034a 3469034^ 3469034Z 3469034X 3469034M 3469034F 3469034A 3469034> 34690348 34690344 3469034- 3469034, 3469034' 3469034$ 3469034" 3469034! 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034x 3469034u 3469034k 3469034d 3469034b 3469034` 3469034_ 3469034] 3469034R 3469034L 3469034H 3469034G 3469034B 3469034? 3469034= 34690346 34690341 3469034% 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 # - F  2 [)  k' ossec9709imMultiple Dovecot Aborted Logins with empty userNov 17 19:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W  -?# ossec13001iYExim Auth failed2025-11-17 19:53:13 dovecot_login authenticator failed for ([14.48.112.8]) [14.48.112.8]:4778: 535 Incorrect authentication data (set_id=administrativo2)14.48.112.818358414  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:54:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822  W' ossec9708iDovecot Aborted Login with empty userNov 17 19:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708i1Dovecot Aborted Login with empty userNov 17 19:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  - ) ossec13001iMExim Auth failed2025-11-17 19:53:00 dovecot_login authenticator failed for ([116.234.68.221]) [116.234.68.221]:63152: 535 Incorrect authentication data (set_id=administrativo2@cleservicosindustriais.com.br)116.234.68.2211814991&  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:52:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<06w4MtJDQJOvfiX3>175.126.37.2471835841.  e3' ossec9710iSDovecot Auth failed on disconnected session.Nov 17 19:53:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991S  -5% ossec13001iMExim Auth failed2025-11-17 19:53:01 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:37042: 535 Incorrect authentication data (set_id=leandro)183.99.89.741835841c  -U% ossec13001iCExim Auth failed2025-11-17 19:52:51 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:60840: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)211.196.31.21835841)  e') ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 19:52:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044c  -S' ossec13001i/Exim Auth failed2025-11-17 19:52:30 dovecot_login authenticator failed for (static.vnpt.vn) [113.161.32.14]:59083: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)113.161.32.141562822X  -A# ossec13001iExim Auth failed2025-11-17 19:51:38 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:47654: 535 Incorrect authentication data (set_id=comercial@inovasite.com)84.54.33.832750405 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -C% ossec13001iExim Auth failed2025-11-17 19:51:22 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60943: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758 + p H n n<N+J1BX+)-  e%+ ossec9710iLDovecot Auth failed on disconnected session.Nov 17 19:57:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991f,  -]# ossec13001iDExim Auth failed2025-11-17 19:57:07 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:42528: 535 Incorrect authentication data (set_id=herbert.oliveira@maringasoldas.com.br)84.54.33.832750405k+  -g% ossec13001i~Exim Auth failed2025-11-17 19:58:05 dovecot_login authenticator failed for ([5.30.224.249]) [5.30.224.249]:52903: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)5.30.224.249290557*  W' ossec9708i@Dovecot Aborted Login with empty userNov 17 19:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034])  -K# ossec13001i'Exim Auth failed2025-11-17 19:56:38 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:43502: 535 Incorrect authentication data (set_id=administrativo@ilumix.com.br)84.54.33.832750405(  k' ossec9709i!Multiple Dovecot Aborted Logins with empty userNov 17 19:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j'  -e# ossec13001iExim Auth failed2025-11-17 19:55:11 dovecot_login authenticator failed for ([49.207.9.39]) [49.207.9.39]:55365: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)49.207.9.391269750.&  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:55:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750% W' ossec9708iDovecot Aborted Login with empty userNov 17 19:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b$ -S# ossec13001iExim Auth failed2025-11-17 19:55:33 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:39410: 535 Incorrect authentication data (set_id=louvoreterno@louvoreterno.com.br)84.54.33.832750405V#  -;% ossec13001iExim Auth failed2025-11-17 19:55:31 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:54944: 535 Incorrect authentication data (set_id=assessoria)12.26.236.106252001$"  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:55:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991;!  eI+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:55:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.20562520013  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:54:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  k<  -c) ossec13001iExim Auth failed2025-11-17 19:59:21 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:54494: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)102.214.44.117149590;  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g:  -[' ossec13001iExim Auth failed2025-11-17 19:59:54 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:44772: 535 Incorrect authentication data (set_id=rafael)71.235.27.1396252001t9  -u' ossec13001iExim Auth failed2025-11-17 19:59:04 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:42650: 535 Incorrect authentication data (set_id=andressa.financeiro)177.174.16.5534690348 W' ossec9708iDovecot Aborted Login with empty userNov 17 19:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7ldRSdJDQpqxV3kv>177.87.121.473469034s7  -o+ ossec13001iExim Auth failed2025-11-17 19:58:32 dovecot_login authenticator failed for ([175.203.199.118]) [175.203.199.118]:22108: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)175.203.199.1181835841f6  -[% ossec13001iExim Auth failed2025-11-17 19:58:25 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:39823: 535 Incorrect authentication data (set_id=vendas.luiz)111.70.3.1221668284m5  -g) ossec13001iExim Auth failed2025-11-17 19:59:05 dovecot_plain authenticator failed for ([185.241.208.80]) [185.241.208.80]:50310: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)185.241.208.80798544.4 UC# ossec11001iDeferred login on the cpanel service[2025-11-17 19:58:43 -0300] info [webmaild] 189.6.35.60 - diretoria@holdingsantahelena.agr.br "GET /cpsess2699940485/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.6.35.603469034e3  -Y% ossec13001iExim Auth failed2025-11-17 19:58:33 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:52838: 535 Incorrect authentication data (set_id=formula316)174.79.87.536252001w2  -# ossec13001iExim Auth failed2025-11-17 19:58:19 dovecot_login authenticator failed for (static.38.23.53.80.macminivault.com) [38.23.53.80]:51378: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)38.23.53.8062520011  -E) ossec13001iExim Auth failed2025-11-17 19:58:19 dovecot_login authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:60126: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)185.15.189.232201737070  eI% ossec9710irDovecot Auth failed on disconnected session.Nov 17 19:57:54 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=88.119.213.7, lip=200.150.196.245, TLS, session=88.119.213.7597427l/  -a+ ossec13001idExim Auth failed2025-11-17 19:57:39 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56415: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651. W' ossec9708i\Dovecot Aborted Login with empty userNov 17 19:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  27K W' ossec9708iMDovecot Aborted Login with empty userNov 17 20:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034TJ  -9# ossec13001i5Exim Auth failed2025-11-17 20:01:07 dovecot_login authenticator failed for ([1.30.20.238]) [1.30.20.238]:55294: 535 Incorrect authentication data (set_id=alex.vendas)1.30.20.2381814991%I  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:00:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.104.127.28, lip=200.150.196.245, TLS, session=103.104.127.281269750 H  -) ossec13001iExim Auth failed2025-11-17 20:00:38 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:56564: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)123.193.152.641668284G W' ossec9708iDovecot Aborted Login with empty userNov 17 20:00:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wF  -y) ossec13001i Exim Auth failed2025-11-17 20:00:28 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:34320: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)118.45.101.1591835841HE  -) ossec13001iExim Auth failed2025-11-17 20:00:09 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:45532: 535 Incorrect authentication data50.223.176.1716252001VD  -9' ossec13001i#Exim Auth failed2025-11-17 20:00:49 dovecot_login authenticator failed for ([103.66.12.197]) [103.66.12.197]:55015: 535 Incorrect authentication data (set_id=adriana)103.66.12.1971269750kC  -e' ossec13001i!Exim Auth failed2025-11-17 20:00:48 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:56566: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)102.221.51.50953987B  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 19:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 A  -' ossec13001iExim Auth failed2025-11-17 19:59:18 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:47214: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)50.212.27.1506252001Y@  -=) ossec13001iExim Auth failed2025-11-17 19:59:48 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:39834: 535 Incorrect authentication data (set_id=contato)137.131.24.1706252001.?  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 19:59:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387 > S}) ossec11000iLogin failed on the cpanel service.[2025-11-17 19:59:33 -0300] info [cpaneld] 185.241.208.80 - lixadoracuritiba "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadoracuritiba (has_cpuser_file failed)185.241.208.80798544f=  -Y' ossec13001iExim Auth failed2025-11-17 19:59:37 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:59900: 535 Incorrect authentication data (set_id=contato)96.56.228.1496252001  q}Z  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:02:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jY  -c% ossec13001iExim Auth failed2025-11-17 20:02:23 dovecot_login authenticator failed for ([14.161.44.92]) [14.161.44.92]:52840: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)14.161.44.921562822|X  -+ ossec13001iExim Auth failed2025-11-17 20:03:02 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:56110: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)197.219.228.2501036973W  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8uRvWdJD4rSxV3kv>177.87.121.473469034uV  -s+ ossec13001iExim Auth failed2025-11-17 20:02:47 dovecot_login authenticator failed for ([106.222.252.146]) [106.222.252.146]:49305: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)106.222.252.1461269750hU  -[) ossec13001iExim Auth failed2025-11-17 20:02:44 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:38845: 535 Incorrect authentication data (set_id=contato)201.173.92.1003996063vT  -w) ossec13001iExim Auth failed2025-11-17 20:02:29 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:48814: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)197.219.210.861036973aS  -M) ossec13001iExim Auth failed2025-11-17 20:02:24 dovecot_login authenticator failed for ([111.23.182.187]) [111.23.182.187]:48315: 535 Incorrect authentication data (set_id=administrativo1)111.23.182.1871814991pR  UI# ossec11001iiDeferred login on the cpanel service[2025-11-17 20:01:59 -0300] info [webmaild] 189.6.35.60 - diretoria@holdingsantahelena.agr.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing189.6.35.603469034(Q  e'' ossec9710i]Dovecot Auth failed on disconnected session.Nov 17 20:01:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822)P  e%+ ossec9710iODovecot Auth failed on disconnected session.Nov 17 20:01:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084&O  e'# ossec9710iIDovecot Auth failed on disconnected session.Nov 17 20:01:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730aN  -S# ossec13001i?Exim Auth failed2025-11-17 20:01:18 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:48334: 535 Incorrect authentication data (set_id=elton.alves@institutoeduc.com.br)84.54.33.832750405(M  e'' ossec9710imDovecot Auth failed on disconnected session.Nov 17 20:02:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001wL  -y) ossec13001iUExim Auth failed2025-11-17 20:01:41 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:51583: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)189.108.215.393469034 c  @  5[Z@Sqp?Mcfj  -Y' ossec13001iExim Auth failed2025-11-17 20:04:24 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:49274: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)124.246.98.761880251ni  -g+ ossec13001iExim Auth failed2025-11-17 20:04:18 dovecot_login authenticator failed for ([185.205.184.169]) [185.205.184.169]:59286: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)185.205.184.169146669-h  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:05:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730}g  -+ ossec13001iExim Auth failed2025-11-17 20:04:50 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:10948: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)182.239.109.2081819730^f  -G) ossec13001iExim Auth failed2025-11-17 20:03:46 dovecot_login authenticator failed for ([183.106.59.245]) [183.106.59.245]:44919: 535 Incorrect authentication data (set_id=misterthomas)183.106.59.2451835841ie  -a% ossec13001iExim Auth failed2025-11-17 20:03:26 dovecot_login authenticator failed for 221-120-4-38.emome-ip.hinet.net [221.120.4.38]:37249: 535 Incorrect authentication data (set_id=isabellylisboa)221.120.4.381668284d W' ossec9708iDovecot Aborted Login with empty userNov 17 20:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<90Y7W9JD2MOxV3kv>177.87.121.473469034}c  -) ossec13001iExim Auth failed2025-11-17 20:03:30 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:41708: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)179.185.29.2333469034Vb  -;% ossec13001iExim Auth failed2025-11-17 20:03:09 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:37595: 535 Incorrect authentication data (set_id=financeiro)221.145.5.141835841[a  -C' ossec13001iExim Auth failed2025-11-17 20:04:05 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:59694: 535 Incorrect authentication data (set_id=misterthomas)103.251.31.341269750(`  e+# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:03:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750Y_  -?' ossec13001iExim Auth failed2025-11-17 20:03:46 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:38122: 535 Incorrect authentication data (set_id=financeiro)182.95.52.1941269750l^  -e' ossec13001iExim Auth failed2025-11-17 20:03:00 dovecot_login authenticator failed for 24.115.167.85.res-cmts.mlf.ptd.net [24.115.167.85]:43877: 535 Incorrect authentication data (set_id=atualizacoes)24.115.167.856252001\]  -C) ossec13001iExim Auth failed2025-11-17 20:02:38 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:59350: 535 Incorrect authentication data (set_id=financeiro)221.224.133.981814991_\  -S! ossec13001iExim Auth failed2025-11-17 20:02:38 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:43550: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)5.30.78.23290557,[  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:02:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822   Sy  -7# ossec13001i-Exim Auth failed2025-11-17 20:05:16 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:58450: 535 Incorrect authentication data (set_id=rodrigo)182.95.47.21269750x  W' ossec9708i[Dovecot Aborted Login with empty userNov 17 20:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dw  -U' ossec13001iEExim Auth failed2025-11-17 20:05:41 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:55240: 535 Incorrect authentication data (set_id=contato)181.177.9.1193865483-v  e-+ ossec9710i9Dovecot Auth failed on disconnected session.Nov 17 20:05:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841hu  -]' ossec13001i7Exim Auth failed2025-11-17 20:05:26 dovecot_login authenticator failed for ([95.66.220.207]) [95.66.220.207]:5039: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)95.66.220.2072017370Vt  -=# ossec13001iWExim Auth failed2025-11-17 20:05:58 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:50294: 535 Incorrect authentication data (set_id=adriana@ilumix.com.br)84.54.33.832750405/s  e1+ ossec9710iEDovecot Auth failed on disconnected session.Nov 17 20:05:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084_r  -G+ ossec13001i?Exim Auth failed2025-11-17 20:05:35 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51515: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034q  k' ossec9709i=Multiple Dovecot Aborted Logins with empty userNov 17 20:05:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Xp -7+ ossec13001iExim Auth failed2025-11-17 20:04:32 dovecot_login authenticator failed for (inovasite.com) [111.122.211.212]:9360: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991o W' ossec9708iDovecot Aborted Login with empty userNov 17 20:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2JnAXtJDMuKxV3kv>177.87.121.473469034,n  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:04:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<2G+AXtJDhNIv+yzS>47.251.44.2106252001[m  -A+ ossec13001i Exim Auth failed2025-11-17 20:04:41 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:52100: 535 Incorrect authentication data (set_id=rodrigo)178.250.191.189458258Ol  -/# ossec13001iExim Auth failed2025-11-17 20:04:30 dovecot_login authenticator failed for ([37.83.68.49]) [37.83.68.49]:59030: 535 Incorrect authentication data (set_id=rafael)37.83.68.4929210441k  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:04:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758 ;;obUswj]PC6)naTG:- SF9, v i \ O B 5 (  s f Y L ? 2 %  | b H ; . !   x k ^ Q D *    t Z M 3 %fYL?2% =# dW~qz`*tgZM@3&  @ o0H|  |ob{UH;.!mJ.D:7GT   ;swj]PC6)na 1835841n 1835841( 1835841 1835841z 1835841q 1835841( 1835841 1835841%f 1835841%Y 1835841%R 1835841%8 1835841%6 1835841% 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841( 1835841( 1835841 O 1835841 ? 1835841  1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841( 1835841( 1835841 S 1835841 Q 1835841( 1835841( 1835841)7A 1835841 1835841 1835841 1835841 { 1835841 [ 1835841 W 1835841 T 1835841) 1835841) 1835841) 1835841( 1835841& 1835841(I 1835841) 1835841(1 1835841(( 1835841* 1835841' 1835841' 1835841' 1835841' 1835841' 1835841'h 1835841'e 1835841'd 1835841'\ 1835841'V 1835841'P 1835841* 1835841'A 1835841'% 1835841' 1835841' 1835841' 1835841' 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& g 1835841*E 1835841*? 1835841*$ 1835841*" 1835841* 1835841* 1835841) 1835841) 1835841) 1835841) 1835841)x 1835841*P 1835841)g 1835841)f 1835841)8 1835841)/ 1835841*S 1835841) 1835841) 1835841) 1835841( 1835841$ 1835841$ 1835841(J 1835841$f 1835841$e 7 1835841$H 1835841$@ 1835841$< 1835841$: 1835841$- 1835841$ 1835841$ 1835841(T 1835841$ 1835841$ 1835841$ 1835841# 1835841# 1835841# 1835841# U 1835841# 1835841# 1835841# 1835841# 1835841# 1835841# 1835841#s 1835841#o 1835841#i 1835841#^ 1835841#X 1835841#R 1835841#C 1835841(\ 1835841#1 1835841#* 1835841## 1835841# 1835841# 1835841" 1835841" 1835841" 1835841({ 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841"r 1835841"Z 1835841"S 1835841"R 1835841"P 1835841"+ 1835841" 1835841" 1835841" 1835841" 1835841" 1835841!mt 1835841! 1835841! 1835841! 1835841! 1835841! 1835841! 1835841! 1835841! 1835841! 1835841! 1835841!~ 1835841!v 1835841!u 1835841!n 1835841!a 1835841!M 1835841!G 1835841!A 1835841!@ 1835841!4 1835841!3 1835841! 1835841! 1835841 1835841 1835841&J 1835841& 1835841&" 1835841& 1835841% 1835841( 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841%x 1835841( 1835841%i 1835841% 1835841% 1835841& 1835841& 1835841& 1835841% 1835841% 1835841& 1835841&c 1835841&A 1835841&) 1835841& 1835841& y y-  e3% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:07:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<6x3pZ9JDHK1zR+4E>115.71.238.41835841+  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:07:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750n  -i' ossec13001iExim Auth failed2025-11-17 20:07:42 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:53381: 535 Incorrect authentication data (set_id=paulo.user.sales)111.70.23.2231668284S  -7# ossec13001iExim Auth failed2025-11-17 20:07:32 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:50682: 535 Incorrect authentication data (set_id=andre@tiajo.com.br)84.54.33.832750405 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#  e% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:07:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001f  -U+ ossec13001iExim Auth failed2025-11-17 20:07:10 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:50696: 535 Incorrect authentication data (set_id=bianca.user.sales)115.245.172.2141269750v  -w) ossec13001iExim Auth failed2025-11-17 20:07:08 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:58832: 535 Incorrect authentication data (set_id=paulo.user.sales@louvoreterno.com.br)178.176.229.362017370\ -G# ossec13001ifExim Auth failed2025-11-17 20:06:13 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:35972: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)84.54.33.832750405s  -u' ossec13001ifExim Auth failed2025-11-17 20:06:13 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:33481: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)85.29.246.199453733z~  -}+ ossec13001iExim Auth failed2025-11-17 20:06:45 dovecot_login authenticator failed for ([109.202.173.227]) [109.202.173.227]:37760: 535 Incorrect authentication data (set_id=bianca.user.sales@globalmedica.com.br)109.202.173.2272017370,}  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:06:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758*|  e)) ossec9710i|Dovecot Auth failed on disconnected session.Nov 17 20:06:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044{ W' ossec9708izDovecot Aborted Login with empty userNov 17 20:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2WftZdJDEKexV3kv>177.87.121.473469034hz  -[) ossec13001irExim Auth failed2025-11-17 20:06:24 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:57744: 535 Incorrect authentication data (set_id=contato)201.173.216.163996063 dDWJ=0# zm`SF9, v i \ O B 5 (    Q% |obUH;.!xk^DsfYL?2~q r e Z O D 9 . #   v j ^ R F : . "  z n b V J > 2 &    ~ r f Z N B 6 *   vj^RF:." znbVJ>2&~rfZNB6*vj^RF:." 2697j 1269750. 1269750, 1269750.w 1269750.I 1269750.G 1269750.? 1269750.: 1269750.3 1269750.1 1269750., 1269750. 1269750. 1269750. 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750-G 1269750-> 1269750-8 1269750- 1269750- 1269750- 1269750- 1269750, 1269750, 1269750, 1269750, 1269750, 1269750, 1269750/= 1269750/5 1269750/' 1269750/& 1269750/ 1269750. 1269750. 1269750. 1269750. 1269750. 1269750. 1269750. 130758 130758 130758o 130758R 130758+ 130758* 130758 130758 130758 130758 130758 130758 130758 130758N 130758 130758 130758 130758 130758 130758N 130758 130758 130758 130758o 130758k 130758I 130758 130758 130758 130758 130758 130758l 130758# 130758 130758 130758 130758Z 130758& 130758 130758 130758 130758 130758 130758\ 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758y 130758m 130758b 130758S 130758N 130758A 130758? 130758< 130758 130758 130758 130758I 130758+ 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758r 130758( 130758 130758- 130758 130758 130758 130758 130758 130758g 130758 130758 130758 130758| 130758I 130758 130758 130758 130758 w 130758 M 130758 { 130758 _ 130758 Q 130758  130758 130758 130758 a 130758 T 130758 A 130758  130758 130758 7 130758 130758 130758 130758 1307584 130758 130758 130758 130758 130758 130758 130758q 130758h 130758` 130758\ 130758X 130758P 130758J 130758H 1307585 130758* 130758( 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758} 130758s 130758o 130758_ 130758^ 130758W 130758S 130758I 1307585 130758* 130758) 130758( 130758 1282988#M 1282988" 1269750, 1269750, 1269750, 1269750, 1269750, 1269750, 1269750,y 1269750,m 1269750,d 1269750,N 1269750,K 1269750,C 1269750,: 1269750,3 1269750,2 1269750,* 1269750,& 1269750,$ 1269750,! 1269750, 1269750, 1269750, 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+X 1269750+W 1269750+D 1269750+4 1269750+ 1269750+ 1269750+ 1269750+ 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750*~ 1269750*z 1269750*n 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/j 1269750/g 1269750/d 1269750/a 1269750/J 1269750/@ = 0 A  , a|Ee`= S+ ossec11000i,Login failed on the cpanel service.[2025-11-17 20:09:31 -0300] info [cpaneld] 217.160.125.236 - cartoriopinheirinhocombr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cartoriopinheirinhocombr (has_cpuser_file failed)217.160.125.2362921044  - + ossec13001iExim Auth failed2025-11-17 20:09:12 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:49561: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)166.201.209.1526252001\  -I# ossec13001iExim Auth failed2025-11-17 20:09:12 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:59274: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)84.54.33.8327504053  eA# ossec9710i4Dovecot Auth failed on disconnected session.Nov 17 20:09:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483a  -K+ ossec13001i0Exim Auth failed2025-11-17 20:09:36 dovecot_login authenticator failed for ([125.138.166.217]) [125.138.166.217]:48372: 535 Incorrect authentication data (set_id=atualizacoes)125.138.166.2171835841+ e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:08:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:08:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:08:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730a  -S# ossec13001iExim Auth failed2025-11-17 20:08:15 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:34570: 535 Incorrect authentication data (set_id=engenharia3@maringasoldas.com.br)84.54.33.832750405,  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:07:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001k  -c' ossec13001iExim Auth failed2025-11-17 20:07:37 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:49236: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)45.194.15.2281168579Y  -=) ossec13001iExim Auth failed2025-11-17 20:07:34 dovecot_login authenticator failed for ([106.91.215.100]) [106.91.215.100]:52757: 535 Incorrect authentication data (set_id=contato)106.91.215.1001814991o  -i) ossec13001iExim Auth failed2025-11-17 20:07:20 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:50206: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)194.158.224.902658434 c *nc)&  e%+ ossec9710inDovecot Auth failed on disconnected session.Nov 17 20:10:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841Z% -?' ossec13001ijExim Auth failed2025-11-17 20:10:33 dovecot_login authenticator failed for (numesolucoes.com.br) [112.122.54.54]:7983: 535 Incorrect authentication data (set_id=nologin)112.122.54.5418149912$  e=% ossec9710ixDovecot Auth failed on disconnected session.Nov 17 20:10:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651(#  e'' ossec9710ipDovecot Auth failed on disconnected session.Nov 17 20:10:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001" W' ossec9708ihDovecot Aborted Login with empty userNov 17 20:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7Xg2dNJDqruxV3kv>177.87.121.473469034V!  -7) ossec13001ihExim Auth failed2025-11-17 20:10:32 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:42484: 535 Incorrect authentication data (set_id=info)121.73.163.25021862241  e9' ossec9710iZDovecot Auth failed on disconnected session.Nov 17 20:10:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822-  e3% ossec9710iXDovecot Auth failed on disconnected session.Nov 17 20:10:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<96EKc9JDguZ3xBIC>119.196.18.21835841] -C) ossec13001iTExim Auth failed2025-11-17 20:10:12 dovecot_login authenticator failed for (User) [177.74.174.120]:55419: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)177.74.174.1203469034k  -c' ossec13001iHExim Auth failed2025-11-17 20:09:59 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:43550: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)128.185.231.61269750S  -5% ossec13001iHExim Auth failed2025-11-17 20:10:00 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:49010: 535 Incorrect authentication data (set_id=contato)59.27.93.1381835841*  e+' ossec9710iFDovecot Auth failed on disconnected session.Nov 17 20:09:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001v  -w) ossec13001i*Exim Auth failed2025-11-17 20:09:29 dovecot_login authenticator failed for ([218.80.238.162]) [218.80.238.162]:39247: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)218.80.238.1621814991i  -c' ossec13001i0Exim Auth failed2025-11-17 20:09:35 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:44064: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)62.201.212.5499237 W' ossec9708i.Dovecot Aborted Login with empty userNov 17 20:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 E % /  - qg~E55  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:12:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<0RUketJDIugI1et7>8.213.235.1231605651e4  -[# ossec13001iExim Auth failed2025-11-17 20:12:31 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:46586: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)84.54.33.8327504053  -' ossec13001iExim Auth failed2025-11-17 20:12:24 dovecot_login authenticator failed for (9.134.166.220.broad.dy.sc.dynamic.163data.com.cn) [220.166.134.9]:44308: 535 Incorrect authentication data (set_id=abuse@inovasite.com.br)220.166.134.91814991'2  e'% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:12:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001j1  -_) ossec13001iExim Auth failed2025-11-17 20:11:25 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:36157: 535 Incorrect authentication data (set_id=financeiro)136.53.199.1606252001,0  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:12:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387/ Sm) ossec11000iLogin failed on the cpanel service.[2025-11-17 20:11:06 -0300] info [cpaneld] 185.241.208.80 - louvoreterno "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user louvoreterno (has_cpuser_file failed)185.241.208.80798544.  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+-  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:11:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822,  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V+  -=# ossec13001iExim Auth failed2025-11-17 20:11:22 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:37650: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)84.54.33.832750405$*  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:11:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<6Vp/dtJDEIXSchJs>210.114.18.1081835841r)  -o+ ossec13001iExim Auth failed2025-11-17 20:11:12 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:35908: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)196.190.220.168337996c(  -W# ossec13001iExim Auth failed2025-11-17 20:10:57 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:33218: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)84.54.33.832750405p'  -m) ossec13001itExim Auth failed2025-11-17 20:10:43 dovecot_plain authenticator failed for ([185.241.208.80]) [185.241.208.80]:51757: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)185.241.208.80798544 ) c)6D  eA) ossec9710iXDovecot Auth failed on disconnected session.Nov 17 20:14:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697505C  e=+ ossec9710iHDovecot Auth failed on disconnected session.Nov 17 20:14:15 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=191.240.104.184, lip=200.150.196.245, TLS, session=191.240.104.1843469034vB  -w) ossec13001i6Exim Auth failed2025-11-17 20:13:57 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:60908: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)111.59.206.2241814991(A  e+# ossec9710i0Dovecot Auth failed on disconnected session.Nov 17 20:13:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001h@  -_% ossec13001iExim Auth failed2025-11-17 20:13:20 dovecot_login authenticator failed for (5.189.59.238-FTTB.planeta.tc) [5.189.59.238]:55042: 535 Incorrect authentication data (set_id=isabellylisboa)5.189.59.2382017370n?  -k% ossec13001iExim Auth failed2025-11-17 20:13:20 dovecot_login authenticator failed for ([23.30.11.253]) [23.30.11.253]:50764: 535 Incorrect authentication data (set_id=comercial.user.sales@inovasite.com)23.30.11.2536252001>  -3) ossec13001iExim Auth failed2025-11-17 20:13:19 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:43014: 535 Incorrect authentication data (set_id=sec.geral)179.48.229.1173469034'=  e#) ossec9710i8Dovecot Auth failed on disconnected session.Nov 17 20:13:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730< W' ossec9708iDovecot Aborted Login with empty userNov 17 20:13:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`;  -Q# ossec13001iExim Auth failed2025-11-17 20:13:32 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:45332: 535 Incorrect authentication data (set_id=jonasvargas@louvoreterno.com.br)84.54.33.832750405y:  -}) ossec13001iExim Auth failed2025-11-17 20:13:00 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:60634: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)155.212.17.1742017370c9  -S' ossec13001iExim Auth failed2025-11-17 20:12:46 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:54626: 535 Incorrect authentication data (set_id=abuse)111.70.23.24616682848 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+7  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:12:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<1QPOetJDvv8vZSTO>47.101.36.2061814991n6  -g) ossec13001iExim Auth failed2025-11-17 20:12:21 dovecot_login authenticator failed for ([62.140.252.119]) [62.140.252.119]:59278: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)62.140.252.1192017370 ,6  ovD ,[S  -G# ossec13001iExim Auth failed2025-11-17 20:15:42 dovecot_login authenticator failed for ([127.0.0.1]) [99.8.98.242]:54752: 535 Incorrect authentication data (set_id=info@siaoimoveis.com)99.8.98.24262520015R UM' ossec11001iDeferred login on the cpanel service[2025-11-17 20:15:37 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034.Q  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:15:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841P W' ossec9708iDovecot Aborted Login with empty userNov 17 20:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5OoZhtJD6N+xV3kv>177.87.121.4734690342O  e=% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:15:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001dN  -W% ossec13001iExim Auth failed2025-11-17 20:16:04 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:33342: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)144.24.107.11269750`M  -Q# ossec13001iLExim Auth failed2025-11-17 20:14:19 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:38444: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)61.37.150.61835841YL  -=) ossec13001iHExim Auth failed2025-11-17 20:14:15 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:39872: 535 Incorrect authentication data (set_id=adriana)111.93.177.2281269750'K  e%' ossec9710iHDovecot Auth failed on disconnected session.Nov 17 20:14:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991J  W' ossec9708ixDovecot Aborted Login with empty userNov 17 20:15:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&I  e!+ ossec9710ihDovecot Auth failed on disconnected session.Nov 17 20:14:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.2071307582H  e;' ossec9710iXDovecot Auth failed on disconnected session.Nov 17 20:14:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730G  k' ossec9709iXMultiple Dovecot Aborted Logins with empty userNov 17 20:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6jiIgtJDqMKxV3kv>177.87.121.473469034`F  -O% ossec13001iTExim Auth failed2025-11-17 20:14:27 dovecot_login authenticator failed for ([72.250.31.61]) [72.250.31.61]:42546: 535 Incorrect authentication data (set_id=comercial.user.sales)72.250.31.616252001bE  -W! ossec13001iZExim Auth failed2025-11-17 20:14:34 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:39608: 535 Incorrect authentication data (set_id=eleicoes)61.2.44.541269750  ub  -y% ossec13001iExim Auth failed2025-11-17 20:17:00 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:59502: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)139.60.85.946252001aa  -S% ossec13001iExim Auth failed2025-11-17 20:16:43 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:40645: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)94.207.29.57290557(`  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:16:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084\_  -C) ossec13001iExim Auth failed2025-11-17 20:16:32 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:58388: 535 Incorrect authentication data (set_id=financeiro)125.154.62.22918358411^  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:16:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001e]  -S+ ossec13001iExim Auth failed2025-11-17 20:16:29 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63549: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651Y\  -=) ossec13001iExim Auth failed2025-11-17 20:16:21 dovecot_login authenticator failed for ([175.156.80.166]) [175.156.80.166]:43374: 535 Incorrect authentication data (set_id=contato)175.156.80.1661880251s[  -q) ossec13001iExim Auth failed2025-11-17 20:16:18 dovecot_login authenticator failed for ([46.163.174.216]) [46.163.174.216]:57926: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)46.163.174.2162017370+Z  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:16:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001]Y  -K# ossec13001iExim Auth failed2025-11-17 20:16:02 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:40376: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)84.54.33.832750405oX  -k) ossec13001iExim Auth failed2025-11-17 20:16:02 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:53874: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)109.233.21.1092721030W  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:15:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044_V  -K' ossec13001iExim Auth failed2025-11-17 20:15:44 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:57965: 535 Incorrect authentication data (set_id=ieqcampocomprido)41.224.62.2062464461mU  -e) ossec13001iExim Auth failed2025-11-17 20:15:28 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:46262: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)182.95.177.11812697502T  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:15:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730 c / {}cq W' ossec9708iKDovecot Aborted Login with empty userNov 17 20:18:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034zp  -}+ ossec13001i4Exim Auth failed2025-11-17 20:18:12 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:51814: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)123.129.196.1181814991.o U?' ossec11001iDeferred login on the cpanel service[2025-11-17 20:17:38 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess9146545787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034n  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 17 20:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}m  -) ossec13001iExim Auth failed2025-11-17 20:17:18 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:32992: 535 Incorrect authentication data (set_id=eleicoes)122.180.249.321269750/l  e1+ ossec9710i.Dovecot Auth failed on disconnected session.Nov 17 20:18:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<0p4ej9JDaNpns7yS>103.179.188.1461562822k  W' ossec9708i*Dovecot Aborted Login with empty userNov 17 20:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_j  -O# ossec13001iExim Auth failed2025-11-17 20:17:42 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:50184: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)84.54.33.832750405ei  -U+ ossec13001iExim Auth failed2025-11-17 20:17:06 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:57946: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795bh -K+ ossec13001iExim Auth failed2025-11-17 20:16:31 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51780: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034*g  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:16:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251.f U?' ossec11001iDeferred login on the cpanel service[2025-11-17 20:16:38 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess9146545787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034Re  -3% ossec13001iExim Auth failed2025-11-17 20:16:33 dovecot_login authenticator failed for ([58.34.174.90]) [58.34.174.90]:55117: 535 Incorrect authentication data (set_id=cpfnc2)58.34.174.901814991d W' ossec9708iDovecot Aborted Login with empty userNov 17 20:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]c -C) ossec13001iExim Auth failed2025-11-17 20:16:21 dovecot_login authenticator failed for (User) [177.74.174.120]:57971: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)177.74.174.1203469034 C bm:]C W' ossec9708iDovecot Aborted Login with empty userNov 17 20:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4mlvlNJDdN+xV3kv>177.87.121.473469034Y  -?' ossec13001isExim Auth failed2025-11-17 20:19:14 dovecot_login authenticator failed for ([123.163.52.74]) [123.163.52.74]:42266: 535 Incorrect authentication data (set_id=financeiro)123.163.52.741814991/~  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:20:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044q}  -m) ossec13001iExim Auth failed2025-11-17 20:19:48 dovecot_login authenticator failed for ([211.141.56.184]) [211.141.56.185]:56204: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)211.141.56.18518149912|  e9+ ossec9710icDovecot Auth failed on disconnected session.Nov 17 20:18:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<2I9CktJDNMjBl4nP>193.151.137.2071307586{ e?) ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 20:18:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044^z  -I' ossec13001iIExim Auth failed2025-11-17 20:18:32 dovecot_login authenticator failed for ([43.240.222.64]) [43.240.222.64]:56579: 535 Incorrect authentication data (set_id=administrativo1)43.240.222.6418149910y  e3+ ossec9710i?Dovecot Auth failed on disconnected session.Nov 17 20:18:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001wx  -{' ossec13001iQExim Auth failed2025-11-17 20:18:40 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:59931: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)178.232.65.993144096w  So% ossec11000iCLogin failed on the cpanel service.[2025-11-17 20:18:26 -0300] info [cpaneld] 154.50.23.72 - deproico "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password154.50.23.721831722_v  -O# ossec13001iaExim Auth failed2025-11-17 20:18:55 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:44902: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)39.74.74.441814991.u  e3' ossec9710iIDovecot Auth failed on disconnected session.Nov 17 20:18:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001nt  -k% ossec13001iCExim Auth failed2025-11-17 20:18:26 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:34622: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)218.22.0.2001814991+s  e)+ ossec9710ikDovecot Auth failed on disconnected session.Nov 17 20:19:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001\r  -E' ossec13001iQExim Auth failed2025-11-17 20:18:40 dovecot_login authenticator failed for ([111.26.100.98]) [111.26.100.99]:54304: 535 Incorrect authentication data (set_id=ferramentaria)111.26.100.991814991   ' C b=XmJZ`mj  -_+ ossec13001iExim Auth failed2025-11-17 20:20:38 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12006: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)195.142.106.177298795[  -C' ossec13001iExim Auth failed2025-11-17 20:20:18 dovecot_login authenticator failed for ([121.147.74.67]) [121.147.74.67]:33110: 535 Incorrect authentication data (set_id=sandromiguel)121.147.74.671835841o  -g+ ossec13001iExim Auth failed2025-11-17 20:20:58 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:52910: 535 Incorrect authentication data (set_id=aureovieira)213.100.204.1802661886v  -y' ossec13001iExim Auth failed2025-11-17 20:20:56 dovecot_login authenticator failed for (177-172-15-62.user.vivozap.com.br) [177.172.15.62]:24714: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)177.172.15.623469034l  -e' ossec13001iExim Auth failed2025-11-17 20:20:53 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:41152: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)121.73.162.152186224  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g  -[' ossec13001iExim Auth failed2025-11-17 20:20:00 dovecot_login authenticator failed for ([111.57.17.171]) [111.57.17.171]:53462: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)111.57.17.1711814991a  -M) ossec13001iExim Auth failed2025-11-17 20:20:00 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:39302: 535 Incorrect authentication data (set_id=contato)178.232.51.1353144096!  e' ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 20:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=47.101.36.2061814991]  -E) ossec13001imExim Auth failed2025-11-17 20:19:07 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:41009: 535 Incorrect authentication data (set_id=aureovieira)188.170.40.2312017370`  -I+ ossec13001iExim Auth failed2025-11-17 20:20:01 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:57815: 535 Incorrect authentication data (set_id=alex.vendas)180.168.100.2301814991_  -G+ ossec13001iExim Auth failed2025-11-17 20:19:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51482: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034t  -u' ossec13001iExim Auth failed2025-11-17 20:19:30 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:34876: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)96.56.228.1496252001   3G' ossec11301isNew FTP connection.Nov 17 20:19:14 hosting pure-ftpd: (?@198.235.24.95) [INFO] New connection from 198.235.24.95198.235.24.956252001&  e'# ossec9710iqDovecot Auth failed on disconnected session.Nov 17 20:19:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483,  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:19:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z H p > 4 f \ R *    vbXNDl:0&|TJ@"r6h,^PFxndZ <2(~tj`LVB8$.zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& i4 i  i i i i i i i i i} i i i i i iV iG i? i` iV ib iR iP iN iP iE iE iA i5 i1 i i5 i  i- i! i i i' i i i i i i i i i i i i i i i i i i i i i i iS iM iM i io ig ie iE i9 i! i iE i) i i i iG i9 i i i i  i i i i i i i i i i i i i i i i i i i} iu ig i iE i9 i3 i3 i- i i  i i i i i i i i i i i i i i i i i i i i i~ i i i} i i i i i{ is is iq im iks ic| iav i_{ iQx iQr iKq iIz iIu iCw iCt i?y i4p i.l i*k ij io i n im ii ib ia if i` ie i.8 i,7 i4 i/ i3 i2 i1 i0 i. i6 i5 i- i, i+ i$ i* i) i( i# i' i& i" i! i% i i i i| ir if id iH iF iD iB iB iB i@ i: i: i: i6 i4 ih ig id i_ i] ic i\ i[ iZ i^ iN iY iX iT iW iV iS iR iQ iP iU iO ixJ ihI iZE iXH iXG iXD iTF iLM iHL iHK iHC i8= i6B i0A i< i; i@ i? i> i: i69 i9 i8 i4 i7 i3 i6 i5 i2 i0 i. i- i, i1 i+ i* i) i/ i( ix$ it' ip# in& ij% ih" ih! iZ iX iT iH iH iF i4 i0 i0 i. i, i* i i i i i  w {COj  -e' ossec13001i Exim Auth failed2025-11-17 20:21:47 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:38493: 535 Incorrect authentication data (set_id=contato@lorussoimoveis.com.br)65.20.143.15999237+  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+wyOm9JDsKmxV3kv>177.87.121.4734690340  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822p  -o% ossec13001iExim Auth failed2025-11-17 20:21:09 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:37521: 535 Incorrect authentication data (set_id=contato)23.30.11.25362520014  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430846  eC' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<0C17nNJDbMgvWfaQ>47.89.246.1446252001g  -[' ossec13001iExim Auth failed2025-11-17 20:21:09 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:51562: 535 Incorrect authentication data (set_id=contato)89.179.78.2472017370S  -5% ossec13001iExim Auth failed2025-11-17 20:22:05 dovecot_login authenticator failed for ([91.230.10.63]) [91.230.10.63]:51966: 535 Incorrect authentication data (set_id=contato)91.230.10.632017370(  e)% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358410  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044W  -=% ossec13001iExim Auth failed2025-11-17 20:21:24 dovecot_login authenticator failed for ([78.36.41.213]) [78.36.41.213]:49094: 535 Incorrect authentication data (set_id=aureovieira)78.36.41.2132017370  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:21:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2Q7RmdJD6puxV3kv>177.87.121.4734690341  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:20:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044  } D * I0:2  ,  -) ossec13001iExim Auth failed2025-11-17 20:25:00 dovecot_plain authenticator failed for (ectmymkbh2qzgeuiam620) [190.173.90.151]:55864: 535 Incorrect authentication data (set_id=webmaillogout.cgiassessoria@cantoramaralima.com.br)190.173.90.1513865483S+  -5% ossec13001iExim Auth failed2025-11-17 20:24:49 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:39263: 535 Incorrect authentication data (set_id=rodrigo)61.97.17.2081835841* W' ossec9708iDovecot Aborted Login with empty userNov 17 20:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)  e# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:23:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750a(  -Q% ossec13001i}Exim Auth failed2025-11-17 20:23:41 dovecot_login authenticator failed for 221-120-4-38.emome-ip.hinet.net [221.120.4.38]:38617: 535 Incorrect authentication data (set_id=xavier)221.120.4.381668284'  k' ossec9709iuMultiple Dovecot Aborted Logins with empty userNov 17 20:23:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6KHCotJDMuCxV3kv>177.87.121.473469034r&  -m+ ossec13001igExim Auth failed2025-11-17 20:23:19 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:42637: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)180.188.143.1661819730%  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7N2BpNJD4IGxV3kv>177.87.121.473469034]$  -G) ossec13001iEExim Auth failed2025-11-17 20:22:45 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:56986: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549# W' ossec9708i9Dovecot Aborted Login with empty userNov 17 20:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+dQln9JDQMixV3kv>177.87.121.4734690345"  e=+ ossec9710i3Dovecot Auth failed on disconnected session.Nov 17 20:22:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.18062520012!  e=% ossec9710i3Dovecot Auth failed on disconnected session.Nov 17 20:22:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382#  e) ossec9710i-Dovecot Auth failed on disconnected session.Nov 17 20:22:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044"  e% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:21:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060 e7   e8 &,.Ie`<  -M' ossec13001iExim Auth failed2025-11-17 20:25:11 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:51675: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.721819730a;  -O) ossec13001i Exim Auth failed2025-11-17 20:26:05 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:46436: 535 Incorrect authentication data (set_id=andre.nascimento)185.101.16.250272103z:  -' ossec13001iExim Auth failed2025-11-17 20:25:57 dovecot_login authenticator failed for ([61.95.192.158]) [61.95.192.158]:44454: 535 Incorrect authentication data (set_id=andre.nascimento.sales@calcautomacao.com.br)61.95.192.1581269750v9  -u+ ossec13001iExim Auth failed2025-11-17 20:25:52 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:53188: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)211.169.212.2061835841k8  -_+ ossec13001iExim Auth failed2025-11-17 20:25:13 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59637: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651Z7  -?) ossec13001iExim Auth failed2025-11-17 20:25:36 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:58925: 535 Incorrect authentication data (set_id=salamuni)58.228.105.19218358416 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'5  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:25:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483)4  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:25:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<9wXeqNJDWOuqQMFo>170.64.193.10420774563  3;! ossec11301iNew FTP connection.Nov 17 20:25:15 hosting pure-ftpd: (?@84.239.7.2) [INFO] New connection from 84.239.7.284.239.7.26252001g2  -]% ossec13001iExim Auth failed2025-11-17 20:24:08 dovecot_login authenticator failed for ([90.164.107.3]) [90.164.107.3]:40220: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)90.164.107.32510769,1  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:25:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<1hsJqNJDzKRw2eny>112.217.233.2421835841d0  -W% ossec13001iExim Auth failed2025-11-17 20:24:47 dovecot_login authenticator failed for ([78.197.6.173]) [78.197.6.173]:54069: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)78.197.6.17330173820/  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:24:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001V.  -9' ossec13001iExim Auth failed2025-11-17 20:24:23 dovecot_login authenticator failed for ([36.135.107.57]) [36.135.107.57]:33492: 535 Incorrect authentication data (set_id=eduardo)36.135.107.571814991k-  -e% ossec13001iExim Auth failed2025-11-17 20:24:19 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:36292: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)121.44.0.1442077456     #K  e' ossec9710igDovecot Auth failed on disconnected session.Nov 17 20:27:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<3rANsdJD5NE+PIOJ>62.60.131.137130758J W' ossec9708ieDovecot Aborted Login with empty userNov 17 20:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3gANsdJDHt2xV3kv>177.87.121.473469034'I  e#) ossec9710iEDovecot Auth failed on disconnected session.Nov 17 20:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001aH  -M) ossec13001i9Exim Auth failed2025-11-17 20:26:48 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:46462: 535 Incorrect authentication data (set_id=info.user.sales)103.147.248.231269750-G  e1' ossec9710i!Dovecot Auth failed on disconnected session.Nov 17 20:26:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867iF  ;S% ossec13008iMail Recipient rejected2025-11-17 20:26:21 H=(195.3.134.135) [179.0.178.53]:55663 F= rejected RCPT : Nenhuma pessoa no endereço.179.0.178.533469034YE  -=) ossec13001iEExim Auth failed2025-11-17 20:27:01 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:46729: 535 Incorrect authentication data (set_id=contato)103.174.145.351269750D  k' ossec9709i)Multiple Dovecot Aborted Logins with empty userNov 17 20:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034yC  -}) ossec13001iExim Auth failed2025-11-17 20:26:16 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:40808: 535 Incorrect authentication data (set_id=info.user.sales@lixadoracuritiba.com.br)173.245.250.166252001bB  -S% ossec13001iExim Auth failed2025-11-17 20:26:15 dovecot_login authenticator failed for ([210.12.14.58]) [210.12.14.58]:56154: 535 Incorrect authentication data (set_id=andre.nascimento.sales)210.12.14.581814991lA  -e' ossec13001iExim Auth failed2025-11-17 20:26:11 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:33169: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)161.8.241.1712077456@  W' ossec9708iGDovecot Aborted Login with empty userNov 17 20:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034?  -) ossec13001i9Exim Auth failed2025-11-17 20:26:49 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:42025: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)24.112.109.2486252001R>  -3% ossec13001iExim Auth failed2025-11-17 20:26:23 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:51831: 535 Incorrect authentication data (set_id=xavier)45.118.49.181269750'=  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:26:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841 E  uV]0EgZ  ;O% ossec13008iMail Recipient rejected2025-11-17 20:28:42 H=(195.3.134.135) [179.0.178.53]:57334 F= rejected RCPT : Nenhuma pessoa no endereço.179.0.178.533469034)Y  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:28:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750uX  -s+ ossec13001iExim Auth failed2025-11-17 20:28:31 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:41234: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)180.104.103.1461814991%W  e%# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:28:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750V W' ossec9708iDovecot Aborted Login with empty userNov 17 20:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034XU  -;) ossec13001iExim Auth failed2025-11-17 20:28:30 dovecot_login authenticator failed for ([111.38.136.211]) [111.38.136.211]:48763: 535 Incorrect authentication data (set_id=envios)111.38.136.2111814991/T  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:29:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001(S  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:28:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<5ioSttJD+oAkMrBu>36.50.176.1101562822^R  -M# ossec13001iExim Auth failed2025-11-17 20:28:54 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:35095: 535 Incorrect authentication data (set_id=envios)111.70.32.51668284mQ  S=+ ossec11000iLogin failed on the cpanel service.[2025-11-17 20:28:40 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect124.198.131.1076252001$P  e!% ossec9710iSDovecot Auth failed on disconnected session.Nov 17 20:27:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991|O  -% ossec13001iMExim Auth failed2025-11-17 20:27:09 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:48068: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)74.62.20.17062520013N  e;) ossec9710iMDovecot Auth failed on disconnected session.Nov 17 20:27:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387M  - ) ossec13001iExim Auth failed2025-11-17 20:28:00 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:52897: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)67.172.244.2356252001rL  -o) ossec13001ioExim Auth failed2025-11-17 20:27:43 dovecot_login authenticator failed for ([187.11.252.160]) [187.11.252.160]:54442: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)187.11.252.1603469034   }G!)h  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:30:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044{g  -) ossec13001i'Exim Auth failed2025-11-17 20:30:47 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:58416: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)116.98.104.1381562822rf  -q+ ossec13001iExim Auth failed2025-11-17 20:30:39 dovecot_login authenticator failed for ([197.231.202.201]) [197.231.202.201]:47541: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)197.231.202.20151537qe  -m) ossec13001iExim Auth failed2025-11-17 20:30:33 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:45062: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)121.159.71.2491835841d W' ossec9708iDovecot Aborted Login with empty userNov 17 20:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$c  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:29:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758"b  e% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:29:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.19918610602a  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:30:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001`  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&_  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:29:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730^  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345]  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:29:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651l\  -e' ossec13001iExim Auth failed2025-11-17 20:28:22 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:44588: 535 Incorrect authentication data (set_id=contato)122.185.187.21269750p[  -q# ossec13001iExim Auth failed2025-11-17 20:28:10 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:60417: 535 Incorrect authentication data (set_id=envios@comercial.art.br)113.28.86.11819730  $  -w  e/) ossec9710iRDovecot Auth failed on disconnected session.Nov 17 20:31:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<5XfwvtJDbJWnR+bm>167.71.230.2301269750sv  -s' ossec13001iPExim Auth failed2025-11-17 20:31:26 dovecot_login authenticator failed for (esquadriasalupar.com.br) [61.50.119.110]:59580: 535 Incorrect authentication data (set_id=test@esquadriasalupar.com.br)61.50.119.1101814991\u  -C) ossec13001iNExim Auth failed2025-11-17 20:31:24 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:60767: 535 Incorrect authentication data (set_id=marialuiza)62.140.234.1142017370tt  -q+ ossec13001iPExim Auth failed2025-11-17 20:31:26 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:56722: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)154.146.240.1232542007/s  e9# ossec9710iEDovecot Auth failed on disconnected session.Nov 17 20:31:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730.r e1' ossec9710iEDovecot Auth failed on disconnected session.Nov 17 20:31:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730uq  -w' ossec13001iAExim Auth failed2025-11-17 20:31:13 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:36110: 535 Incorrect authentication data (set_id=junior.gomes)189.56.202.863469034np  -i' ossec13001i5Exim Auth failed2025-11-17 20:31:01 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:41308: 535 Incorrect authentication data (set_id=junior.gomes)49.249.76.2211269750^o  -K% ossec13001i1Exim Auth failed2025-11-17 20:30:56 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:59055: 535 Incorrect authentication data (set_id=marialuiza)210.1.66.15416940087n  eA+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:30:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084^m  -I' ossec13001i5Exim Auth failed2025-11-17 20:31:01 dovecot_login authenticator failed for (esquadriasalupar.com.br) [61.50.119.110]:54844: 535 Incorrect authentication data (set_id=nologin)61.50.119.11018149910l  e7' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 20:30:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991vk  -w) ossec13001i-Exim Auth failed2025-11-17 20:30:52 dovecot_login authenticator failed for 91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:47529: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)91.241.150.2462017370sj  -u% ossec13001i!Exim Auth failed2025-11-17 20:30:41 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:43498: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)92.189.80.732510769gi  -Y) ossec13001iExim Auth failed2025-11-17 20:30:38 dovecot_login authenticator failed for ([121.162.101.73]) [121.162.101.73]:35224: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)121.162.101.731835841 % F K X > YO,C'  e'% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:33:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<7sCCxdJDvqVbejg7>91.122.56.592017370U  -7' ossec13001iExim Auth failed2025-11-17 20:33:07 dovecot_login authenticator failed for ([36.135.100.48]) [36.135.100.48]:43522: 535 Incorrect authentication data (set_id=envios)36.135.100.481814991^  -K% ossec13001iExim Auth failed2025-11-17 20:32:20 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48088: 535 Incorrect authentication data (set_id=michael)85.19.195.123144096c  -S' ossec13001i}Exim Auth failed2025-11-17 20:32:13 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:15331: 535 Incorrect authentication data (set_id=michael@deproi.com.br)14.161.31.1721562822  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:32:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9UftwtJDapaxV3kv>177.87.121.473469034  -' ossec13001iExim Auth failed2025-11-17 20:32:32 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:55299: 535 Incorrect authentication data (set_id=envios@comercial.art.br)177.0.238.1903469034a~  -M) ossec13001iExim Auth failed2025-11-17 20:32:21 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:35614: 535 Incorrect authentication data (set_id=paulinho.vendas)121.73.169.1612186224} W' ossec9708iVDovecot Aborted Login with empty userNov 17 20:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9xxVv9JD7uSxV3kv>177.87.121.473469034o|  -k' ossec13001iGExim Auth failed2025-11-17 20:31:19 dovecot_login authenticator failed for ([182.78.79.134]) [182.78.79.134]:47692: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)182.78.79.1341269750w{  -y) ossec13001i?Exim Auth failed2025-11-17 20:31:10 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:53555: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)158.181.132.861527747[z  -C' ossec13001i`Exim Auth failed2025-11-17 20:31:42 dovecot_login authenticator failed for ([222.99.52.202]) [222.99.52.202]:37589: 535 Incorrect authentication data (set_id=junior.gomes)222.99.52.2021835841[y  -C' ossec13001iVExim Auth failed2025-11-17 20:31:32 dovecot_login authenticator failed for ([175.10.38.108]) [175.10.38.108]:42564: 535 Incorrect authentication data (set_id=fabio.vendas)175.10.38.1081814991xx  -y+ ossec13001ibExim Auth failed2025-11-17 20:31:44 dovecot_login authenticator failed for ([121.131.220.133]) [121.131.220.133]:38548: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)121.131.220.1331835841   kwE*  e-% ossec9710iBDovecot Auth failed on disconnected session.Nov 17 20:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841*  e)) ossec9710i@Dovecot Auth failed on disconnected session.Nov 17 20:35:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044.  e/+ ossec9710i:Dovecot Auth failed on disconnected session.Nov 17 20:35:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822  W' ossec9708idDovecot Aborted Login with empty userNov 17 20:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Odpz9JDcpCxV3kv>177.87.121.473469034W  -?' ossec13001iHExim Auth failed2025-11-17 20:35:35 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:41338: 535 Incorrect authentication data (set_id=financeiro)65.20.237.19199237*  e'+ ossec9710iBDovecot Auth failed on disconnected session.Nov 17 20:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.15418149913  e9+ ossec9710ifDovecot Auth failed on disconnected session.Nov 17 20:36:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822q  -o' ossec13001i4Exim Auth failed2025-11-17 20:35:14 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:37730: 535 Incorrect authentication data (set_id=financeiro@kglsolucoes.com)57.129.90.2152921044 W' ossec9708i Dovecot Aborted Login with empty userNov 17 20:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 Sc+ ossec11000iLogin failed on the cpanel service.[2025-11-17 20:34:26 -0300] info [cpaneld] 217.160.125.236 - inovasite "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inovasite (has_cpuser_file failed)217.160.125.2362921044/  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:33:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991V  -9' ossec13001iExim Auth failed2025-11-17 20:33:44 dovecot_login authenticator failed for ([222.68.153.96]) [222.68.153.96]:34769: 535 Incorrect authentication data (set_id=contato)222.68.153.961814991 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  -k+ ossec13001iExim Auth failed2025-11-17 20:33:31 dovecot_login authenticator failed for ([218.144.149.177]) [218.144.149.177]:60184: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)218.144.149.1771835841 x RdXx\#  -I% ossec13001iExim Auth failed2025-11-17 20:37:31 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:50138: 535 Incorrect authentication data (set_id=leandro)37.57.69.227690791" Ss) ossec11000iLogin failed on the cpanel service.[2025-11-17 20:37:24 -0300] info [cpaneld] 119.28.107.251 - vidaenge "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password119.28.107.2511880251j!  -a' ossec13001iExim Auth failed2025-11-17 20:37:23 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:36408: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)118.188.18.251814991,  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:36:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -Q% ossec13001iExim Auth failed2025-11-17 20:36:30 dovecot_login authenticator failed for (46.48.22.251-FTTB.planeta.tc) [46.48.22.251]:45406: 535 Incorrect authentication data (set_id=rodrigo)46.48.22.25120173708  eG' ossec9710i|Dovecot Auth failed on disconnected session.Nov 17 20:36:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<3yDC0NJDBNSdQi/y>157.66.47.2421562822v  -y' ossec13001irExim Auth failed2025-11-17 20:36:18 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:58290: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)113.11.34.2211210997  k' ossec9709iFMultiple Dovecot Aborted Logins with empty userNov 17 20:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001iBExim Auth failed2025-11-17 20:35:28 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:37835: 535 Incorrect authentication data (set_id=contato)61.145.163.1641814991u  -s+ ossec13001i:Exim Auth failed2025-11-17 20:35:20 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:53270: 535 Incorrect authentication data (set_id=kgl@kglsolucoes.com)113.158.205.2251861060)  e+' ossec9710i:Dovecot Auth failed on disconnected session.Nov 17 20:35:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<8oDTzNJD+OA+PIOL>62.60.131.139130758.  e3' ossec9710i6Dovecot Auth failed on disconnected session.Nov 17 20:35:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<7CGdzNJDcOgnaoFh>39.106.129.971814991|  -' ossec13001i4Exim Auth failed2025-11-17 20:35:15 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:40818: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)95.87.248.223732800m  -e) ossec13001iDExim Auth failed2025-11-17 20:35:31 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:42006: 535 Incorrect authentication data (set_id=kgl)37.235.140.1632017370  w s pF*1  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:38:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750.0  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:38:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841&/  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:39:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001.  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343-  e=' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:37:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001:,  eG+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:37:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001 +  3G' ossec11301iNew FTP connection.Nov 17 20:37:50 hosting pure-ftpd: (?@87.236.176.88) [INFO] New connection from 87.236.176.8887.236.176.882635167v*  -y' ossec13001iExim Auth failed2025-11-17 20:37:40 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:58442: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)182.156.80.111269750I)  -) ossec13001iExim Auth failed2025-11-17 20:37:39 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:50668: 535 Incorrect authentication data (set_id=brizola)5.32.61.6290557( W' ossec9708iDovecot Aborted Login with empty userNov 17 20:37:34 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f'  -]% ossec13001iExim Auth failed2025-11-17 20:37:29 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:3417: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)41.220.3.101226074$&  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:37:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991&%  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:37:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358413$  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:37:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084 N Y,7DgN@  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y?  -C# ossec13001iExim Auth failed2025-11-17 20:41:53 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:57056: 535 Incorrect authentication data (set_id=fabio.vendas)59.7.79.1461835841o>  -k' ossec13001iExim Auth failed2025-11-17 20:41:41 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:58820: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)217.24.185.982017370Y=  -?' ossec13001iExim Auth failed2025-11-17 20:41:04 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:36571: 535 Incorrect authentication data (set_id=marialuiza)106.0.165.2191605651j<  -]+ ossec13001iExim Auth failed2025-11-17 20:40:50 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:63620: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)119.204.125.1241835841; W' ossec9708ipDovecot Aborted Login with empty userNov 17 20:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r:  -q' ossec13001ihExim Auth failed2025-11-17 20:40:24 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:59310: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)202.82.20.24118197309 W' ossec9708i6Dovecot Aborted Login with empty userNov 17 20:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)8  e-# ossec9710i.Dovecot Auth failed on disconnected session.Nov 17 20:39:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001&7  e%% ossec9710i,Dovecot Auth failed on disconnected session.Nov 17 20:39:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0zY/29JDpuhvAEul>111.0.75.165181499176  eC) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:38:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.2518149915  -' ossec13001iExim Auth failed2025-11-17 20:38:06 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:44338: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)157.7.200.15218610604  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:39:04 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903403  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:38:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867e2  -U) ossec13001iExim Auth failed2025-11-17 20:38:44 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:59874: 535 Incorrect authentication data (set_id=andressa.financeiro)103.163.44.1181269750 z j P) 4DPczeO  -W' ossec13001i&Exim Auth failed2025-11-17 20:43:33 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:55959: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)119.192.59.801835841iN  -]) ossec13001iExim Auth failed2025-11-17 20:43:24 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:53838: 535 Incorrect authentication data (set_id=contato)187.11.252.1603469034pM  -q# ossec13001iExim Auth failed2025-11-17 20:43:12 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:47051: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)59.7.79.1461835841lL  -g% ossec13001iExim Auth failed2025-11-17 20:43:10 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:37270: 535 Incorrect authentication data (set_id=contato@compensadosparana.com.br)208.69.161.76252001gK  -Y) ossec13001iBExim Auth failed2025-11-17 20:44:01 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:44182: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)121.73.168.1812186224fJ  -Y' ossec13001i@Exim Auth failed2025-11-17 20:43:59 dovecot_login authenticator failed for (h-91-126-245-87.wholesale.adamo.es) [91.126.245.87]:44952: 535 Incorrect authentication data (set_id=edna)91.126.245.872510769I  -% ossec13001i@Exim Auth failed2025-11-17 20:43:59 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:60241: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)139.60.85.946252001H W' ossec9708i$Dovecot Aborted Login with empty userNov 17 20:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#G  e!# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:42:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730F W' ossec9708iDovecot Aborted Login with empty userNov 17 20:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.E  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:42:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<4McN5tJDOJel0iHB>165.210.33.1932233387)D  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:42:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991eC -Q+ ossec13001iExim Auth failed2025-11-17 20:42:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52152: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034B  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:41:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'A  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:41:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750 P qxm>$ APm^  -e) ossec13001iExim Auth failed2025-11-17 20:46:29 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.186.93]:10975: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)113.160.186.931562822[]  -?+ ossec13001iExim Auth failed2025-11-17 20:46:12 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:56905: 535 Incorrect authentication data (set_id=rafael)180.188.143.1661819730\  - ) ossec13001iExim Auth failed2025-11-17 20:45:59 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:54409: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)67.241.128.1976252001[ W' ossec9708iDovecot Aborted Login with empty userNov 17 20:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+Z  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:45:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044Y  k' ossec9709ibMultiple Dovecot Aborted Logins with empty userNov 17 20:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<83rZ7dJDKumxV3kv>177.87.121.473469034dX  -Q+ ossec13001i\Exim Auth failed2025-11-17 20:44:28 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51187: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651uW  -u) ossec13001iPExim Auth failed2025-11-17 20:44:16 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:43988: 535 Incorrect authentication data (set_id=marcelo.pinheiro)123.193.152.641668284)V  e)' ossec9710iJDovecot Auth failed on disconnected session.Nov 17 20:44:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<6gJW7NJDEIMv+yzS>47.251.44.2106252001U  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)T  e-# ossec9710inDovecot Auth failed on disconnected session.Nov 17 20:44:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750XS  -=) ossec13001i\Exim Auth failed2025-11-17 20:44:27 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:54535: 535 Incorrect authentication data (set_id=eliezer)94.204.236.202290557'R  e%' ossec9710iTDovecot Auth failed on disconnected session.Nov 17 20:44:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<+lfv7NJD/jQkMrGr>36.50.177.1711562822+Q  e-' ossec9710iDDovecot Auth failed on disconnected session.Nov 17 20:44:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001bP  -O) ossec13001i8Exim Auth failed2025-11-17 20:43:51 dovecot_login authenticator failed for ([175.207.243.95]) [175.207.243.95]:39453: 535 Incorrect authentication data (set_id=marcelo.pinheiro)175.207.243.951835841   " "m  e% ossec9710icDovecot Auth failed on disconnected session.Nov 17 20:48:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001l W' ossec9708iSDovecot Aborted Login with empty userNov 17 20:48:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  W' ossec9708i3Dovecot Aborted Login with empty userNov 17 20:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ej  -Y% ossec13001i-Exim Auth failed2025-11-17 20:47:56 dovecot_login authenticator failed for c-73-21-168-70.hsd1.fl.comcast.net [73.21.168.70]:57312: 535 Incorrect authentication data (set_id=adriana)73.21.168.706252001gi  -[' ossec13001i'Exim Auth failed2025-11-17 20:47:50 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:34590: 535 Incorrect authentication data (set_id=daniela@acmesolar.com.br)182.78.93.1901269750gh  -[' ossec13001iExim Auth failed2025-11-17 20:47:39 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:38905: 535 Incorrect authentication data (set_id=rsimoesdiretoria)84.213.189.273144096\g  -I% ossec13001iExim Auth failed2025-11-17 20:47:11 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62862: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758tf  -w% ossec13001i5Exim Auth failed2025-11-17 20:48:03 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:52896: 535 Incorrect authentication data (set_id=alex.vendas)23.30.11.2536252001e  -% ossec13001i#Exim Auth failed2025-11-17 20:47:46 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:35125: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)139.60.85.946252001d  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034zc  -# ossec13001iExim Auth failed2025-11-17 20:47:28 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:35172: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)50.4.40.2476252001tb  -s) ossec13001iExim Auth failed2025-11-17 20:47:12 dovecot_login authenticator failed for ([178.178.222.58]) [178.178.222.58]:40778: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)178.178.222.582017370/a  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:46:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841V`  -9' ossec13001iExim Auth failed2025-11-17 20:46:45 dovecot_login authenticator failed for ([78.81.213.111]) [78.81.213.111]:34388: 535 Incorrect authentication data (set_id=contato)78.81.213.1112017370_ W' ossec9708iDovecot Aborted Login with empty userNov 17 20:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 &   . IY;'|  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:50:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430841{  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:50:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<6egSBNND+oSB4kCN>129.226.64.1411819730Pz  -1# ossec13001iExim Auth failed2025-11-17 20:50:08 dovecot_login authenticator failed for ([92.55.3.238]) [92.55.3.238]:26934: 535 Incorrect authentication data (set_id=contato)92.55.3.2382017370y W' ossec9708iDovecot Aborted Login with empty userNov 17 20:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x  - ) ossec13001iwExim Auth failed2025-11-17 20:49:09 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:34451: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)187.161.136.1839960633w  eA# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:49:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483v  e % ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:49:48 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=191.53.248.6, lip=200.150.196.245, TLS, session=<7Zek/9JDE8a/NfgG>191.53.248.63469034lu  -c) ossec13001iExim Auth failed2025-11-17 20:49:47 dovecot_login authenticator failed for ([217.115.87.186]) [217.115.87.186]:62031: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)217.115.87.1862017370at  -M) ossec13001iExim Auth failed2025-11-17 20:49:26 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:19917: 535 Incorrect authentication data (set_id=administrativo1)216.194.174.276252001Ss  -7# ossec13001iExim Auth failed2025-11-17 20:49:23 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:53065: 535 Incorrect authentication data (set_id=financeiro)218.76.73.41814991zr  -% ossec13001i}Exim Auth failed2025-11-17 20:49:16 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:55690: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)83.166.63.13453733nq  -g) ossec13001i{Exim Auth failed2025-11-17 20:49:14 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:58315: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)67.213.230.1226252001p  - ) ossec13001iExim Auth failed2025-11-17 20:49:58 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:64656: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)107.175.76.1466252001)o  e') ossec9710iODovecot Auth failed on disconnected session.Nov 17 20:48:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<+o3g+9JDrLAO4dKR>14.225.210.1451562822Vn  -9' ossec13001iAExim Auth failed2025-11-17 20:48:15 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:50667: 535 Incorrect authentication data (set_id=daniela)222.117.0.2531835841   2    X  -?% ossec13001iExim Auth failed2025-11-17 20:51:22 dovecot_login authenticator failed for ([87.117.32.22]) [87.117.32.22]:59394: 535 Incorrect authentication data (set_id=fabio.vendas)87.117.32.222017370,  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:51:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001i  -_' ossec13001iExim Auth failed2025-11-17 20:50:43 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:49392: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)182.95.223.461269750  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o  -g+ ossec13001iExim Auth failed2025-11-17 20:50:13 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:2000: 535 Incorrect authentication data (set_id=atualizacoes)128.106.196.1501880251`  -K) ossec13001iExim Auth failed2025-11-17 20:51:03 dovecot_login authenticator failed for ([183.56.179.201]) [183.56.179.201]:24430: 535 Incorrect authentication data (set_id=isabellylisboa)183.56.179.2011814991  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  -U' ossec13001iExim Auth failed2025-11-17 20:51:02 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:62619: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795_  -G+ ossec13001iExim Auth failed2025-11-17 20:50:23 dovecot_login authenticator failed for ([178.178.194.151]) [178.178.194.151]:35586: 535 Incorrect authentication data (set_id=financeiro)178.178.194.1512017370%  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:50:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.21062520012  e=% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:50:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841j  -a' ossec13001iExim Auth failed2025-11-17 20:50:12 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:54812: 535 Incorrect authentication data (set_id=sec.geral)179.189.85.663469034r  -o) ossec13001iExim Auth failed2025-11-17 20:50:11 dovecot_login authenticator failed for ([87.229.254.207]) [87.229.254.207]:49242: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)87.229.254.2072017370o~  -k' ossec13001iExim Auth failed2025-11-17 20:51:04 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:32914: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)119.192.59.801835841s}  -u% ossec13001iExim Auth failed2025-11-17 20:50:47 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:49224: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)36.135.62.831814991  l =P!v  -y' ossec13001i/Exim Auth failed2025-11-17 20:52:13 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:47170: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)47.18.200.2426252001^  -I' ossec13001iYExim Auth failed2025-11-17 20:52:56 dovecot_login authenticator failed for ([14.212.198.51]) [14.212.198.51]:39030: 535 Incorrect authentication data (set_id=flavio.oliveira)14.212.198.511814991  e% ossec9710iKDovecot Auth failed on disconnected session.Nov 17 20:52:42 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.18.49.14, lip=200.150.196.245, TLS, session=<6cghCtND7Et5EjEO>121.18.49.141814991{  -' ossec13001i?Exim Auth failed2025-11-17 20:52:29 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39474: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)98.220.97.1886252001'  e%' ossec9710i;Dovecot Auth failed on disconnected session.Nov 17 20:52:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520012  e=% ossec9710iIDovecot Auth failed on disconnected session.Nov 17 20:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651+  e+) ossec9710i)Dovecot Auth failed on disconnected session.Nov 17 20:52:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750i  -_' ossec13001i'Exim Auth failed2025-11-17 20:52:07 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:42348: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)182.95.224.621269750+  e)+ ossec9710i#Dovecot Auth failed on disconnected session.Nov 17 20:52:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841<  eM) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:51:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=182.75.197.174, lip=200.150.196.245, TLS, session=<3jscB9NDfIO2S8Wu>182.75.197.1741269750#  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:51:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750|  -) ossec13001i!Exim Auth failed2025-11-17 20:51:59 dovecot_login authenticator failed for (static.90.254.104.190.cps.com.ar) [190.104.254.91]:33827: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)190.104.254.913865483  -)) ossec13001iExim Auth failed2025-11-17 20:51:54 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:58265: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)177.22.122.1543469034 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9k7fBtND8tuxV3kv>177.87.121.473469034 %,   o<%e'  -S+ ossec13001iExim Auth failed2025-11-17 20:54:01 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54198: 535 Incorrect authentication data (set_id=contato)207.200.180.1746252001*&  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:53:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387/%  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:53:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822$  W' ossec9708iDovecot Aborted Login with empty userNov 17 20:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&#  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:53:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001*"  e)) ossec9710ioDovecot Auth failed on disconnected session.Nov 17 20:53:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841$!  e) ossec9710ioDovecot Auth failed on disconnected session.Nov 17 20:53:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841p  -k) ossec13001iIExim Auth failed2025-11-17 20:52:41 dovecot_login authenticator failed for ([121.162.101.73]) [121.162.101.73]:57848: 535 Incorrect authentication data (set_id=comercial@maringasoldas.com.br)121.162.101.731835841_  -K' ossec13001i7Exim Auth failed2025-11-17 20:52:22 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:55894: 535 Incorrect authentication data (set_id=marcelo.pinheiro)154.127.90.342440476.  e1+ ossec9710i3Dovecot Auth failed on disconnected session.Nov 17 20:52:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<0upgCdNDxI/Bl4nP>193.151.137.207130758}  -) ossec13001i[Exim Auth failed2025-11-17 20:52:57 dovecot_login authenticator failed for (abts-tn-dynamic-021.126.164.122.airtelbroadband.in) [122.164.126.21]:60837: 535 Incorrect authentication data (set_id=comercial)122.164.126.211269750 W' ossec9708iADovecot Aborted Login with empty userNov 17 20:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -Q% ossec13001i;Exim Auth failed2025-11-17 20:52:26 dovecot_login authenticator failed for 72-24-210-58.cpe.sparklight.net [72.24.210.58]:40343: 535 Incorrect authentication data (set_id=rafael)72.24.210.586252001k  -_+ ossec13001i/Exim Auth failed2025-11-17 20:52:13 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61944: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651 1 U*"1m5  -e) ossec13001iExim Auth failed2025-11-17 20:55:28 dovecot_login authenticator failed for ([121.73.167.131]) [121.73.167.131]:37670: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)121.73.167.13121862244  -% ossec13001iExim Auth failed2025-11-17 20:54:44 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:55338: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)83.221.15.762017370'3  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:54:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.56181973072  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:54:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651+1  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:54:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841m0 -c) ossec13001iExim Auth failed2025-11-17 20:54:39 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:43116: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)223.167.203.561814991/ W' ossec9708iDovecot Aborted Login with empty userNov 17 20:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m.  -e) ossec13001iExim Auth failed2025-11-17 20:54:30 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:51555: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)85.116.125.2392017370m-  -e) ossec13001iExim Auth failed2025-11-17 20:54:55 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:48861: 535 Incorrect authentication data (set_id=contato)75.183.102.1896252001l,  -c) ossec13001iExim Auth failed2025-11-17 20:53:42 dovecot_login authenticator failed for ([182.225.134.13]) [182.225.134.13]:53942: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)182.225.134.1318358410+  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:53:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001Y*  -C% ossec13001i}Exim Auth failed2025-11-17 20:53:33 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64248: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758)  k' ossec9709i}Multiple Dovecot Aborted Logins with empty userNov 17 20:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5SMPDtNDaKCxV3kv>177.87.121.473469034,(  e++ ossec9710igDovecot Auth failed on disconnected session.Nov 17 20:53:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822    vD  -u+ ossec13001i5Exim Auth failed2025-11-17 20:56:37 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52345: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)181.191.136.1413469034aC  -O) ossec13001i9Exim Auth failed2025-11-17 20:56:40 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:34074: 535 Incorrect authentication data (set_id=ieqcampocomprido)196.191.142.67337996aB  -Q% ossec13001i5Exim Auth failed2025-11-17 20:56:36 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:34483: 535 Incorrect authentication data (set_id=contato)5.128.123.342017370dA  -Y# ossec13001i%Exim Auth failed2025-11-17 20:56:21 dovecot_login authenticator failed for ([46.44.24.40]) [46.44.24.40]:51008: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)46.44.24.402017370@  W' ossec9708iODovecot Aborted Login with empty userNov 17 20:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)?  e)' ossec9710i=Dovecot Auth failed on disconnected session.Nov 17 20:56:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001W>  -9) ossec13001iExim Auth failed2025-11-17 20:56:07 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:48012: 535 Incorrect authentication data (set_id=rubens)160.251.121.701861060w=  -w+ ossec13001iExim Auth failed2025-11-17 20:55:49 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:55088: 535 Incorrect authentication data (set_id=rubens@singseguros.com.br)207.200.180.1746252001S<  -3' ossec13001iExim Auth failed2025-11-17 20:55:37 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:53948: 535 Incorrect authentication data (set_id=bqtz)5.142.196.1852017370+;  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:55:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=47.101.36.2061814991[:  -G' ossec13001iExim Auth failed2025-11-17 20:55:24 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:43053: 535 Incorrect authentication data (set_id=bqtz@iemif.com)65.20.205.228992379  -) ossec13001iExim Auth failed2025-11-17 20:56:06 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:50302: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)24.233.210.188625200118  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:56:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730l7  -e) ossec13001iExim Auth failed2025-11-17 20:55:45 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:60203: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)185.112.148.661307586 W' ossec9708iDovecot Aborted Login with empty userNov 17 20:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    H z p > 4 f * \ R    bXND:vl0&|rhJ@,6^"TxPF<2ndZ( BVL~tj`.$8zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& i8 ix7 iv6 iv5 ih4 i>3 i42 i01 i*0 iJ/ iD. i - i, i+ i* i) i"( i' i& i% i$ i# i" iv! i i~ i i i i i iH iB i4 il iX iP i^ iN iJ i^ i i i i i i i i i i i i i i i i i i i i i i iv i^ iU iK i~ i i i i< i" i6 i i iC i: i i i i i i i i i i i i i i i i i i i i i iy iu io ie ic i i io im ii i] i i1 i) i iO i9 i5 i9 i5 i% iO i= i i i i i i i i i i i i i i i i i i i i i i i i i i} i} io io ig i[ iY iK iI iI iA i? i; i; i7 i3 i/ i/ i) i' i# i! i ip ib ia i` i_ i^ i] i\ i[ iZ iS iU ivT itY ihR idX iXW iVQ iTV i@P i0O i.N iM iL iC iK i I iH iG iF iE iD iJ iB i> i= i9 i< i; i: iA i@ i? i i i i i i i~ i i i} i{ i i i i| i i i i i iz ip iw iv iu iy it is i}r i{q iwx icm iSl iOo iAn i5f i3k i-j i'i i#e ih id i j ic ig ib ia i` i_ i^ i] i\ i[ iZ iU inT ibY i\X i\S iTR iPW iJV iDQ iBK i@J i@I i8P i&O i$H iN iM iL iC iG iF iE iD i@ i? i> iB iA i= i< ip;  q z Z.uDiS  -e# ossec13001ioExim Auth failed2025-11-17 20:57:34 dovecot_login authenticator failed for (static20.byfly.gomel.by) [93.84.78.69]:53909: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)93.84.78.69630336$R  e) ossec9710ieDovecot Auth failed on disconnected session.Nov 17 20:57:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387(Q  e'' ossec9710icDovecot Auth failed on disconnected session.Nov 17 20:57:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991(P  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:58:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001-O  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:57:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001N 3?# ossec11301ioNew FTP connection.Nov 17 20:57:33 hosting pure-ftpd: (?@20.64.104.2) [INFO] New connection from 20.64.104.220.64.104.26252001M W' ossec9708imDovecot Aborted Login with empty userNov 17 20:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(L  e%) ossec9710iiDovecot Auth failed on disconnected session.Nov 17 20:57:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.25418802511K  e7) ossec9710i]Dovecot Auth failed on disconnected session.Nov 17 20:57:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<4F47G9NDkLZ2wSaf>118.193.38.1591819730gJ  -[' ossec13001iExim Auth failed2025-11-17 20:57:50 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:60901: 535 Incorrect authentication data (set_id=novamanha)111.70.23.2231668284I  k' ossec9709i1Multiple Dovecot Aborted Logins with empty userNov 17 20:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bH  -O) ossec13001i)Exim Auth failed2025-11-17 20:56:25 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:52838: 535 Incorrect authentication data (set_id=ieqcampocomprido)122.186.243.781269750jG  -a' ossec13001iExim Auth failed2025-11-17 20:56:09 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:60112: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)222.76.248.541814991F  3;! ossec11301iONew FTP connection.Nov 17 20:57:02 hosting pure-ftpd: (?@84.239.7.2) [INFO] New connection from 84.239.7.284.239.7.26252001pE  -k) ossec13001i9Exim Auth failed2025-11-17 20:56:41 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:54806: 535 Incorrect authentication data (set_id=juridico)122.186.174.351269750 O Z  :KWZq<Oib  -g ossec13001iExim Auth failed2025-11-17 20:58:45 dovecot_login authenticator failed for ([5.3.64.66]) [5.3.64.66]:46531: 535 Incorrect authentication data (set_id=paulo.user.support@louvoreterno.com.br)5.3.64.6620173701a  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:58:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044e`  -U) ossec13001iExim Auth failed2025-11-17 20:58:48 dovecot_login authenticator failed for ([111.75.243.251]) [111.75.243.251]:38272: 535 Incorrect authentication data (set_id=bianca.user.support)111.75.243.2511814991y_  -}) ossec13001iExim Auth failed2025-11-17 20:58:25 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:50262: 535 Incorrect authentication data (set_id=bianca.user.support@globalmedica.com.br)113.140.95.2501814991p^  -o% ossec13001iExim Auth failed2025-11-17 20:58:21 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:35492: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)84.54.115.461512440k]  -a) ossec13001iExim Auth failed2025-11-17 20:58:11 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:54306: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)125.19.253.1541269750^\  -K% ossec13001iExim Auth failed2025-11-17 20:59:06 dovecot_login authenticator failed for ([101.13.8.246]) [101.13.8.246]:58326: 535 Incorrect authentication data (set_id=paulo.user.support)101.13.8.2461668284S[  -5% ossec13001iExim Auth failed2025-11-17 20:58:32 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:51552: 535 Incorrect authentication data (set_id=contato)77.41.156.642017370Z W' ossec9708iDovecot Aborted Login with empty userNov 17 20:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034aY  -K+ ossec13001iExim Auth failed2025-11-17 20:58:31 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:45072: 535 Incorrect authentication data (set_id=atualizacoes)141.148.165.2306252001(X  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:58:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430848W  eC+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:58:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.11416430842V  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:58:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730.U  e1) ossec9710iyDovecot Auth failed on disconnected session.Nov 17 20:57:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841:T  eI) ossec9710iuDovecot Auth failed on disconnected session.Nov 17 20:57:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750  U 2p W' ossec9708i"Dovecot Aborted Login with empty userNov 17 21:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vo  -;% ossec13001i6Exim Auth failed2025-11-17 21:00:53 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:54786: 535 Incorrect authentication data (set_id=financeiro)111.26.67.361814991,n  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:00:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001sm  -o+ ossec13001iExim Auth failed2025-11-17 21:00:22 dovecot_login authenticator failed for ([106.222.252.146]) [106.222.252.146]:59163: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)106.222.252.1461269750+l  e-' ossec9710iCDovecot Auth failed on disconnected session.Nov 17 21:01:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001#k  e% ossec9710i:Dovecot Auth failed on disconnected session.Nov 17 21:00:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060j  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<65xHJdNDmuyxV3kv>177.87.121.473469034ji  -c% ossec13001iExim Auth failed2025-11-17 21:00:01 dovecot_login authenticator failed for ([14.40.114.86]) [14.40.114.86]:44974: 535 Incorrect authentication data (set_id=dayanelima@louvoreterno.com.br)14.40.114.8618358411h  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:59:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.20729210441g  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:59:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001f  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 20:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'e  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:59:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.7138654830d  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 20:59:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822pc  UI# ossec11001iDeferred login on the cpanel service[2025-11-17 20:58:32 -0300] info [webmaild] 189.6.35.60 - diretoria@holdingsantahelena.agr.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing189.6.35.603469034 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=03  3469034D 3469034C 34690349 34690348 34690343 3469034/ 3469034* 3469034% 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034v 3469034s 3469034r 3469034i 3469034g 3469034a 3469034] 3469034Y 3469034R 3469034L 3469034E 3469034B 3469034? 3469034< 34690349 34690346 3469034' 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034z 3469034w 3469034u 3469034q 3469034c 3469034] 3469034U 3469034T 3469034K 3469034@ 3469034; 34690349 34690342 3469034) 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034{ 3469034p 3469034o 3469034k 3469034j 3469034f 3469034e 3469034b 3469034\ 3469034T 3469034S 3469034P 3469034M 3469034F 34690349 34690345 34690340 3469034. 3469034- 3469034' 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034{ 3469034v 3469034p 3469034j 3469034e 3469034^ 3469034\ 3469034V 3469034H 3469034F 34690345 34690342 3469034/ 3469034) 3469034& 3469034# 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034~ 3469034| 3469034x 3469034u 3469034r 3469034l 3469034i 3469034f 3469034e 3469034^ 3469034Y 3469034T 3469034N 3469034K 3469034H 3469034? 3469034; 3469034: 34690345 34690343 34690341 3469034. 3469034* 3469034(  i3)4~  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:02:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001!}  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:02:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<0SsfLdNDiuYvZSTO>47.101.36.2061814991j|  -_) ossec13001iExim Auth failed2025-11-17 21:02:57 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:53280: 535 Incorrect authentication data (set_id=supports)223.197.196.921819730c{  -O+ ossec13001iExim Auth failed2025-11-17 21:02:52 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:49027: 535 Incorrect authentication data (set_id=isabellylisboa)186.238.247.2383469034gz -U+ ossec13001iExim Auth failed2025-11-17 21:02:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51854: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034,y  e++ ossec9710ivDovecot Auth failed on disconnected session.Nov 17 21:01:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841x W' ossec9708i^Dovecot Aborted Login with empty userNov 17 21:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342w  e7+ ossec9710iUDovecot Auth failed on disconnected session.Nov 17 21:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001%v  e) ossec9710iKDovecot Auth failed on disconnected session.Nov 17 21:01:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<49ZqKdNDsL+YNbyQ>152.53.188.1442921044u  -) ossec13001i~Exim Auth failed2025-11-17 21:02:05 dovecot_login authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:51140: 535 Incorrect authentication data (set_id=supports@opsconsorcios.com.br)122.136.195.321814991&t  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:00:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=79.100.173.233, lip=200.150.196.245, TLS, session=79.100.173.233732800\s  -C) ossec13001iExim Auth failed2025-11-17 21:00:19 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:34260: 535 Incorrect authentication data (set_id=dayanelima)210.219.232.341835841#r  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:00:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758/q  e1+ ossec9710i<Dovecot Auth failed on disconnected session.Nov 17 21:00:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<3hl3KNNDMLSElIx5>132.148.140.1216252001 5 ` 4:#X5  e# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:04:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750! 3G' ossec11301iNew FTP connection.Nov 17 21:04:29 hosting pure-ftpd: (?@20.98.137.225) [INFO] New connection from 20.98.137.22520.98.137.2256252001Q  -5% ossec13001iExim Auth failed2025-11-17 21:04:17 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:45397: 535 Incorrect authentication data (set_id=adriana)65.20.251.5399237 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343  e?% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:03:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382a  -O' ossec13001iExim Auth failed2025-11-17 21:03:22 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:53646: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.721819730.  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:03:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001v  -w) ossec13001iExim Auth failed2025-11-17 21:04:02 dovecot_login authenticator failed for ([111.26.106.115]) [111.26.106.115]:40806: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)111.26.106.1151814991(  e+# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:03:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.9962520014  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:03:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:02:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822s  -u% ossec13001iExim Auth failed2025-11-17 21:02:40 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:53254: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)160.25.58.191643084  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 J  d4O6A\_EJw  -w+ ossec13001iExim Auth failed2025-11-17 21:06:41 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:39056: 535 Incorrect authentication data (set_id=produccion@lixadoracuritiba.com.br)121.160.166.1611835841 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:06:34 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y  -{+ ossec13001iHExim Auth failed2025-11-17 21:05:27 dovecot_login authenticator failed for ([109.202.173.227]) [109.202.173.227]:35234: 535 Incorrect authentication data (set_id=comercial.user.support@inovasite.com)109.202.173.2272017370a  -M) ossec13001iBExim Auth failed2025-11-17 21:05:21 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:56214: 535 Incorrect authentication data (set_id=paulinho.vendas)195.222.59.1573277605q  -q' ossec13001i4Exim Auth failed2025-11-17 21:05:06 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:53776: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)146.19.200.63660013  W' ossec9708ilDovecot Aborted Login with empty userNov 17 21:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3Z+9OtND4tGxV3kv>177.87.121.473469034a  -S% ossec13001iXExim Auth failed2025-11-17 21:05:43 dovecot_login authenticator failed for ([188.59.6.176]) [188.59.6.176]:56237: 535 Incorrect authentication data (set_id=comercial.user.support)188.59.6.176298795,  e++ ossec9710iPDovecot Auth failed on disconnected session.Nov 17 21:05:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<57LxONNDCudn76Vy>103.239.165.1141643084(  e+# ossec9710i^Dovecot Auth failed on disconnected session.Nov 17 21:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483  k' ossec9709iNMultiple Dovecot Aborted Logins with empty userNov 17 21:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e/% ossec9710iJDovecot Auth failed on disconnected session.Nov 17 21:05:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841(  e%) ossec9710i^Dovecot Auth failed on disconnected session.Nov 17 21:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001! 3G' ossec11301iNew FTP connection.Nov 17 21:04:16 hosting pure-ftpd: (?@40.124.171.82) [INFO] New connection from 40.124.171.8240.124.171.826252001/  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:04:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4GNgNdNDBKKxV3kv>177.87.121.473469034 > G a>)  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346(  eA) ossec9710i"Dovecot Auth failed on disconnected session.Nov 17 21:09:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<0EV8RdND0rCl0xnK>165.211.25.2022233387*'  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:09:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044&  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j%  -]+ ossec13001iExim Auth failed2025-11-17 21:08:37 dovecot_login authenticator failed for ([176.195.126.170]) [176.195.126.170]:57074: 535 Incorrect authentication data (set_id=aginfo@transol.com.br)176.195.126.1702017370e$  -U) ossec13001iExim Auth failed2025-11-17 21:07:27 dovecot_login authenticator failed for (pc170.zz.ha.cn) [61.168.104.170]:45405: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)61.168.104.17018149912#  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:07:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730" W' ossec9708iDovecot Aborted Login with empty userNov 17 21:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034:!  eG+ ossec9710ivDovecot Auth failed on disconnected session.Nov 17 21:06:13 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.187.229.218, lip=200.150.196.245, session=122.187.229.21812697506  eC' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:06:36 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=58.49.113.138, lip=200.150.196.245, session=58.49.113.13818149911  e9' ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 21:06:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867?  eQ+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:07:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.187.230.181, lip=200.150.196.245, TLS, session=122.187.230.1811269750Y  -?' ossec13001iExim Auth failed2025-11-17 21:06:54 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:54068: 535 Incorrect authentication data (set_id=produccion)103.107.36.181269750&  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:06:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841 B WY?M!F,Bf8  -W) ossec13001iExim Auth failed2025-11-17 21:10:40 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:37268: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)180.148.10.12412109977 W' ossec9708ixDovecot Aborted Login with empty userNov 17 21:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W6  -?' ossec13001ivExim Auth failed2025-11-17 21:10:29 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:48958: 535 Incorrect authentication data (set_id=financeiro)185.34.17.25099237(5  e%) ossec9710ivDovecot Auth failed on disconnected session.Nov 17 21:10:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456n4  -k' ossec13001ihExim Auth failed2025-11-17 21:10:16 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:42940: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)45.82.110.1506600133 W' ossec9708i>Dovecot Aborted Login with empty userNov 17 21:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z2  -}+ ossec13001i4Exim Auth failed2025-11-17 21:09:23 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:46360: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)169.211.232.1821835841'1  e)# ossec9710i0Dovecot Auth failed on disconnected session.Nov 17 21:09:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750*0  e+' ossec9710i*Dovecot Auth failed on disconnected session.Nov 17 21:09:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841a/  -M) ossec13001iJExim Auth failed2025-11-17 21:09:46 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:50408: 535 Incorrect authentication data (set_id=administrativo1)152.52.210.11812697502.  e7+ ossec9710iDDovecot Auth failed on disconnected session.Nov 17 21:09:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084$-  e!' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 21:09:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<4d5ORdNDDqM+PIOJ>62.60.131.137130758f,  -U+ ossec13001iExim Auth failed2025-11-17 21:09:02 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51539: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034n+  -e+ ossec13001iExim Auth failed2025-11-17 21:08:47 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:40376: 535 Incorrect authentication data (set_id=aginfo)177.223.133.1043469034-*  U?' ossec11001iDeferred login on the cpanel service[2025-11-17 21:08:44 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess9146545787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect187.67.211.473469034 2 [ 2>OiPpEL2F W' ossec9708iDovecot Aborted Login with empty userNov 17 21:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034uE  -y% ossec13001iExim Auth failed2025-11-17 21:12:27 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:39276: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)155.4.31.2152661886'D  e'% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:12:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991\C  -A+ ossec13001iExim Auth failed2025-11-17 21:13:04 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:58574: 535 Incorrect authentication data (set_id=contato)121.131.220.1521835841B  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bA  -Q' ossec13001iExim Auth failed2025-11-17 21:11:20 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:32922: 535 Incorrect authentication data (set_id=alex.vendas)77.206.93.1073017382k@  -_+ ossec13001iExim Auth failed2025-11-17 21:11:10 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:43102: 535 Incorrect authentication data (set_id=contato)213.100.204.1802661886p?  -u! ossec13001iExim Auth failed2025-11-17 21:11:08 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:33387: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)89.67.37.2798544%>  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:12:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.19918610604=  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:11:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651<  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e;  -S+ ossec13001iExim Auth failed2025-11-17 21:11:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53675: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651-:  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:11:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750,9  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:11:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001  l > V riuR9%T  e#% ossec9710ivDovecot Auth failed on disconnected session.Nov 17 21:14:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<4Ha9WdND2NJbejg7>91.122.56.592017370S  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034R  k' ossec9709ihMultiple Dovecot Aborted Logins with empty userNov 17 21:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341Q  e9' ossec9710iVDovecot Auth failed on disconnected session.Nov 17 21:14:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991]P  -E) ossec13001i@Exim Auth failed2025-11-17 21:13:51 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:42520: 535 Incorrect authentication data (set_id=aureovieira)123.209.78.1312077456ZO  -A' ossec13001i0Exim Auth failed2025-11-17 21:13:36 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:33734: 535 Incorrect authentication data (set_id=aureovieira)182.95.51.1661269750N W' ossec9708i.Dovecot Aborted Login with empty userNov 17 21:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kM  -_+ ossec13001iExim Auth failed2025-11-17 21:13:18 dovecot_login authenticator failed for ([201.183.225.156]) [201.183.225.156]:58650: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)201.183.225.1563658394`L -K' ossec13001iExim Auth failed2025-11-17 21:13:17 dovecot_login authenticator failed for (compensadosparana.com.br) [112.122.54.54]:48373: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991dK  -Q+ ossec13001iExim Auth failed2025-11-17 21:13:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52085: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034*J  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:12:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822,I  e3# ossec9710i Dovecot Auth failed on disconnected session.Nov 17 21:12:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730/H  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:12:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001-G e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:12:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<3NBQUtNDwswrmxBp>43.155.16.1051819730 } z csx}1c  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:17:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991b W' ossec9708iDovecot Aborted Login with empty userNov 17 21:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7LdJYNND4K+xV3kv>177.87.121.473469034qa  -m+ ossec13001iExim Auth failed2025-11-17 21:16:25 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:34953: 535 Incorrect authentication data (set_id=fernandabrum)213.130.207.177597427i`  -_' ossec13001iExim Auth failed2025-11-17 21:16:14 dovecot_login authenticator failed for (brilhometal.com.br) [61.50.119.110]:31430: 535 Incorrect authentication data (set_id=test@brilhometal.com.br)61.50.119.1101814991i_  -a% ossec13001iExim Auth failed2025-11-17 21:16:04 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:36430: 535 Incorrect authentication data (set_id=fernandabrum@prafebrum.com.br)61.72.59.1061835841Y^  -?' ossec13001iExim Auth failed2025-11-17 21:15:49 dovecot_login authenticator failed for (brilhometal.com.br) [61.50.119.110]:26928: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991] W' ossec9708iDovecot Aborted Login with empty userNov 17 21:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]\  -E) ossec13001iExim Auth failed2025-11-17 21:15:21 dovecot_login authenticator failed for ([111.194.233.62]) [111.194.233.62]:52832: 535 Incorrect authentication data (set_id=atendimento)111.194.233.621814991l[  -c) ossec13001iExim Auth failed2025-11-17 21:15:18 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:57296: 535 Incorrect authentication data (set_id=xavier)72.239.139.1626252001*Z  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:15:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841eY  -Y% ossec13001itExim Auth failed2025-11-17 21:14:44 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:54269: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)59.27.93.1381835841*X  e'+ ossec9710idDovecot Auth failed on disconnected session.Nov 17 21:14:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822-W  e/) ossec9710iXDovecot Auth failed on disconnected session.Nov 17 21:14:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730-V  e/) ossec9710iTDovecot Auth failed on disconnected session.Nov 17 21:14:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750rU  -m+ ossec13001iExim Auth failed2025-11-17 21:15:00 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:40582: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)125.139.124.1201835841  Hc@@=4q  W' ossec9708i;Dovecot Aborted Login with empty userNov 17 21:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.p  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:17:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822o  -' ossec13001i?Exim Auth failed2025-11-17 21:18:06 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:63321: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)34.84.162.1771861060n  -+ ossec13001i/Exim Auth failed2025-11-17 21:17:50 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:42587: 535 Incorrect authentication data (set_id=juliana@cartoriopinheirinho.com.br)178.232.116.1653144096|m  -' ossec13001iExim Auth failed2025-11-17 21:17:33 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:42680: 535 Incorrect authentication data (set_id=andre.nascimento.support@calcautomacao.com.br)182.95.52.1221269750l  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3KnbY9NDaMyxV3kv>177.87.121.473469034ak  -K+ ossec13001iExim Auth failed2025-11-17 21:17:30 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52253: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.14134690344j  e;+ ossec9710i Dovecot Auth failed on disconnected session.Nov 17 21:17:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822/i  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:17:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044{h  -) ossec13001i+Exim Auth failed2025-11-17 21:17:46 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:53118: 535 Incorrect authentication data (set_id=info.user.support@lixadoracuritiba.com.br)210.177.143.611819730,g  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:17:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730bf  -O) ossec13001i3Exim Auth failed2025-11-17 21:17:54 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:59650: 535 Incorrect authentication data (set_id=desenvolvimento2)103.140.18.1861269750/e  e5' ossec9710i+Dovecot Auth failed on disconnected session.Nov 17 21:17:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991d  - ) ossec13001i"Exim Auth failed2025-11-17 21:17:37 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:42875: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)185.137.75.2273017382 H%<  7 c s f6VX>a8Hl  -a+ ossec13001iExim Auth failed2025-11-17 21:19:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64385: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.2311605651%  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:19:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991Y~  -=) ossec13001iExim Auth failed2025-11-17 21:19:43 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:41141: 535 Incorrect authentication data (set_id=contato)218.156.93.2031835841} W' ossec9708iDovecot Aborted Login with empty userNov 17 21:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z|  -% ossec13001iExim Auth failed2025-11-17 21:19:19 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:49726: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)90.173.78.902510769\{  -A+ ossec13001icExim Auth failed2025-11-17 21:18:42 dovecot_login authenticator failed for ([211.104.166.110]) [211.104.166.110]:55700: 535 Incorrect authentication data (set_id=compras)211.104.166.1101835841,z  e/' ossec9710iaDovecot Auth failed on disconnected session.Nov 17 21:18:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867y W' ossec9708iYDovecot Aborted Login with empty userNov 17 21:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ox  -i) ossec13001iOExim Auth failed2025-11-17 21:18:21 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:44660: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)118.41.142.1641835841lw  -c) ossec13001iCExim Auth failed2025-11-17 21:18:10 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:49232: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)121.134.31.1931835841Pv  -1# ossec13001iAExim Auth failed2025-11-17 21:18:08 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:47266: 535 Incorrect authentication data (set_id=juliana)14.98.28.431269750Xu  -;) ossec13001ikExim Auth failed2025-11-17 21:18:50 dovecot_login authenticator failed for ([115.236.53.198]) [115.236.53.198]:48904: 535 Incorrect authentication data (set_id=xavier)115.236.53.1981814991%t  e) ossec9710iKDovecot Auth failed on disconnected session.Nov 17 21:18:17 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.224.169.221, lip=200.150.196.245, TLS, session=45.224.169.2213469034es  -W' ossec13001i/Exim Auth failed2025-11-17 21:17:50 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:56670: 535 Incorrect authentication data (set_id=andre.nascimento.support)111.93.80.1581269750Wr  -A! ossec13001i=Exim Auth failed2025-11-17 21:18:04 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:35704: 535 Incorrect authentication data (set_id=info.user.support)1.7.83.1311269750 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 2017370! 2017370! 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 y 2017370 t 2017370 ` 2017370 Y 2017370 7 2017370 + 2017370 # 2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370i 2017370_ 2017370 2017370 20173705 2017370- 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370t 2017370\ 2017370. 2017370# 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370: 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370y 2017370l 2017370Y 2017370@ 2017370< 20173707 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370w 2017370t 2017370r 2017370q 2017370a 2017370[ 20173708 2017370 2017370 2017370 2017370d 2017370` 2017370> 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370o 2017370Q 2017370H 2017370 2017370 2017370 2017370 2017370 2017370 2017370" 2017370 2017370 2017370 2017370 2017370 2017370 2017370Q 2017370 2017370 2017370 2017370 2017370 2017370 2017370Z 2017370O 2017370$ 2017370 2017370 2017370 2017370 2017370j 2017370\ 2017370Z 2017370E 20173707 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370n 2017370^ 20173705 2017370# 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370y 2017370c 2017370` 20173703 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370t 2017370p 2017370g 2017370a 2017370G 2017370B 2017370T 2017370% 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370z 2017370u 2017370b 2017370` 2017370> 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370[ 2017370@ 2017370: 20173706 2017370 2017370 2017370 2017370 2017370 2017370 u 2017370 S 2017370 P 2017370 J 2017370 E 2017370 ; 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 Z 2017370 S 2017370 2 2017370  2017370  2017370  2017370 2017370 2017370 2017370 2017370 2017370 B ^ } d(\#dh{{B5  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:21:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822|  -+ ossec13001i-Exim Auth failed2025-11-17 21:22:04 dovecot_login authenticator failed for 182-155-213-175.veetime.com [182.155.213.175]:42178: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)182.155.213.1751668284i  -_' ossec13001iExim Auth failed2025-11-17 21:20:50 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42300: 535 Incorrect authentication data (set_id=contato)74.218.95.1546252001x  -{) ossec13001iExim Auth failed2025-11-17 21:20:46 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:47480: 535 Incorrect authentication data (set_id=envios@comercial.art.br)201.173.250.423996063; As! ossec11302iFTP Authentication failed.Nov 17 21:20:32 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]2.58.84.6129210445 e=) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:20:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044 3;! ossec11301iNew FTP connection.Nov 17 21:20:27 hosting pure-ftpd: (?@2.58.84.61) [INFO] New connection from 2.58.84.612.58.84.612921044,  e1% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:20:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358418  eC+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:21:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -G) ossec13001iExim Auth failed2025-11-17 21:21:02 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:34284: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:20:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750  -)) ossec13001iExim Auth failed2025-11-17 21:20:38 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:44672: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)122.170.99.1951269750  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346  eC' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:19:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<0kAybNNDeJikXF7M>164.92.94.2046252001 0 \ T )gk m\0(  e)% ossec9710iiDovecot Auth failed on disconnected session.Nov 17 21:23:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991-  e-+ ossec9710iYDovecot Auth failed on disconnected session.Nov 17 21:22:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991\  -E' ossec13001i5Exim Auth failed2025-11-17 21:22:13 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:50168: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001 3;! ossec11301i1New FTP connection.Nov 17 21:22:08 hosting pure-ftpd: (?@2.58.84.61) [INFO] New connection from 2.58.84.612.58.84.612921044^  ;=% ossec13008iaMail Recipient rejected2025-11-17 21:22:57 H=(195.3.134.135) [179.0.178.53]:65453 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:65453 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034 W' ossec9708iIDovecot Aborted Login with empty userNov 17 21:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+gO6ddNDpOaxV3kv>177.87.121.473469034^  -G) ossec13001i=Exim Auth failed2025-11-17 21:22:20 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:39544: 535 Incorrect authentication data (set_id=junior.gomes)111.26.177.2161814991>  Is! ossec11331i7 Stealth FTP brute force attackNov 17 21:22:14 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]2.58.84.612921044Y  -=) ossec13001i#Exim Auth failed2025-11-17 21:21:55 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:38584: 535 Incorrect authentication data (set_id=alcindo)121.179.93.1471835841 W' ossec9708i Dovecot Aborted Login with empty userNov 17 21:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 3;! ossec11301iNew FTP connection.Nov 17 21:21:19 hosting pure-ftpd: (?@2.58.84.61) [INFO] New connection from 2.58.84.612.58.84.612921044U  -7' ossec13001iExim Auth failed2025-11-17 21:21:16 dovecot_login authenticator failed for ([118.121.234.5]) [118.121.234.5]:37876: 535 Incorrect authentication data (set_id=envios)118.121.234.51814991; As! ossec11302iFTP Authentication failed.Nov 17 21:21:09 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]2.58.84.612921044  -' ossec13001iExim Auth failed2025-11-17 21:21:40 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:34566: 535 Incorrect authentication data (set_id=alcindo@box911.com.br)182.78.111.341269750  S! ossec211321iPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 2.58.84.612.58.84.612921044_  s! ossec11321iActive Response. FTP brute force attack (Port 21 is protected)Nov 17 21:21:36 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]2.58.84.612921044%  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:21:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001  \'0#.  e!# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:24:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730--  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:24:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044%,  -S+ ossec13001iExim Auth failed2025-11-17 21:24:18 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:55342: 535 Incorrect authentication data (set_id=isabella@eloempresas.com)200.105.141.1723923057s+  -q) ossec13001iExim Auth failed2025-11-17 21:24:13 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:56763: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)58.228.105.19218358411*  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:24:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.1391307580)  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:23:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841((  e'' ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 21:23:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001'  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:24:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w%  -w+ ossec13001i]Exim Auth failed2025-11-17 21:22:52 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:33418: 535 Incorrect authentication data (set_id=marcelo.pinheiro)203.198.173.1371819730:$  As! ossec11302i=FTP Authentication failed.Nov 17 21:22:21 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]2.58.84.6129210440#  e5) ossec9710i=Dovecot Auth failed on disconnected session.Nov 17 21:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044'"  e#) ossec9710i7Dovecot Auth failed on disconnected session.Nov 17 21:22:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841l!  -i# ossec13001i5Exim Auth failed2025-11-17 21:22:13 dovecot_login authenticator failed for ([58.115.15.2]) [58.115.15.2]:50396: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)58.115.15.21668284 j    j(=  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:26:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001+<  e1# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:25:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<47uBgNNDWLKUcQQF>148.113.4.51269750p;  -k) ossec13001iExim Auth failed2025-11-17 21:25:30 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:43218: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)131.108.162.243469034&:  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:25:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750.9  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:25:58 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.68.178.196, lip=200.150.196.245, TLS, session=185.68.178.1963175395X8  -A# ossec13001iExim Auth failed2025-11-17 21:25:53 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:57083: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.7062519997 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s6  -q) ossec13001iExim Auth failed2025-11-17 21:25:25 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:56983: 535 Incorrect authentication data (set_id=administrativo1)200.141.211.583469034`5  -K) ossec13001iExim Auth failed2025-11-17 21:25:07 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:50386: 535 Incorrect authentication data (set_id=assessoria)109.207.33.253629025204  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:24:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387d3  -Q+ ossec13001iExim Auth failed2025-11-17 21:24:53 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51671: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034t2  -u' ossec13001iExim Auth failed2025-11-17 21:24:46 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:40855: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)41.224.62.2062464461\1  -G% ossec13001iExim Auth failed2025-11-17 21:24:36 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:39311: 535 Incorrect authentication data (set_id=isabella)84.211.19.1231440960  -+ ossec13001iExim Auth failed2025-11-17 21:24:36 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:36680: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)203.198.173.1371819730/ W' ossec9708iDovecot Aborted Login with empty userNov 17 21:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 i!(   1 8Ii\M  -C) ossec13001iExim Auth failed2025-11-17 21:28:00 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:33074: 535 Incorrect authentication data (set_id=formula316)183.171.53.2361733045kL  -a) ossec13001iExim Auth failed2025-11-17 21:27:50 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43390: 535 Incorrect authentication data (set_id=bianca)90.161.217.2282510769\K  -I% ossec13001iExim Auth failed2025-11-17 21:27:47 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:55475: 535 Incorrect authentication data (set_id=contato)83.166.50.15453733iJ  -a' ossec13001iExim Auth failed2025-11-17 21:27:42 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53948: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795I  - ) ossec13001iwExim Auth failed2025-11-17 21:27:35 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:38627: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)76.136.164.1576252001aH  -O) ossec13001iuExim Auth failed2025-11-17 21:27:33 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:34617: 535 Incorrect authentication data (set_id=marcelo.pinheiro)196.189.59.226337996G  e' ossec9710i9Dovecot Auth failed on disconnected session.Nov 17 21:26:31 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.221.50.183, lip=200.150.196.245, TLS, session=45.221.50.183953987F  k' ossec9709i9Multiple Dovecot Aborted Logins with empty userNov 17 21:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kE  -i# ossec13001i-Exim Auth failed2025-11-17 21:26:21 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:46629: 535 Incorrect authentication data (set_id=envios@comercial.art.br)89.67.37.52798544vD  -{' ossec13001i'Exim Auth failed2025-11-17 21:26:15 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:58726: 535 Incorrect authentication data (set_id=desenvolvimento2)93.85.230.107630336WC  -9) ossec13001iSExim Auth failed2025-11-17 21:26:59 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:1569: 535 Incorrect authentication data (set_id=envios)216.194.174.276252001B  W' ossec9708iWDovecot Aborted Login with empty userNov 17 21:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jA  -_) ossec13001iSExim Auth failed2025-11-17 21:26:58 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.16.237]:45561: 535 Incorrect authentication data (set_id=marcelo.pinheiro)222.252.16.2371562822(@  e'' ossec9710i-Dovecot Auth failed on disconnected session.Nov 17 21:26:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822u?  -u) ossec13001i'Exim Auth failed2025-11-17 21:26:15 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:43834: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)128.185.254.541269750[>  -C' ossec13001iExim Auth failed2025-11-17 21:25:29 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:56540: 535 Incorrect authentication data (set_id=assessoria)118.121.234.51814991 S ~-SV[  -9' ossec13001iExim Auth failed2025-11-17 21:29:53 dovecot_login authenticator failed for ([222.85.202.86]) [59.51.142.242]:48151: 535 Incorrect authentication data (set_id=contato)59.51.142.2421814991\Z  ;9% ossec13008iMail Recipient rejected2025-11-17 21:29:32 H=(195.3.134.135) [179.0.178.53]:54433 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:54433 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034Y  W' ossec9708i Dovecot Aborted Login with empty userNov 17 21:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]X  -G' ossec13001iExim Auth failed2025-11-17 21:29:43 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:49632: 535 Incorrect authentication data (set_id=administracion)222.76.248.541814991sW  -s' ossec13001iExim Auth failed2025-11-17 21:29:33 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:41446: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)193.46.192.202510769,V  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:28:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730U W' ossec9708iDovecot Aborted Login with empty userNov 17 21:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\T  -E' ossec13001iExim Auth failed2025-11-17 21:28:16 dovecot_login authenticator failed for ([150.129.138.198]) [112.96.228.60]:36486: 535 Incorrect authentication data (set_id=venesselume)112.96.228.601814991dS  -W% ossec13001iuExim Auth failed2025-11-17 21:27:33 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:42175: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)58.16.201.521814991qR  -m) ossec13001iExim Auth failed2025-11-17 21:27:56 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:47678: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)182.95.176.19412697500Q  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:27:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841oP  -g+ ossec13001iExim Auth failed2025-11-17 21:27:43 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:43966: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)125.139.124.12018358416O  eA) ossec9710iyDovecot Auth failed on disconnected session.Nov 17 21:27:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.251814991N W' ossec9708iuDovecot Aborted Login with empty userNov 17 21:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 N ] tuVBiOhNi W' ossec9708ieDovecot Aborted Login with empty userNov 17 21:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ch  -U% ossec13001iTExim Auth failed2025-11-17 21:31:15 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:39943: 535 Incorrect authentication data (set_id=bqtz)90.173.78.902510769g W' ossec9708i)Dovecot Aborted Login with empty userNov 17 21:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Uf  -7' ossec13001i%Exim Auth failed2025-11-17 21:30:29 dovecot_login authenticator failed for ([14.104.200.38]) [14.104.200.38]:45926: 535 Incorrect authentication data (set_id=gerson)14.104.200.381814991e  -+) ossec13001iExim Auth failed2025-11-17 21:30:10 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:42982: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)122.160.50.15512697504d  eC# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:30:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<5O+7kNND4OVCYSpH>66.97.42.713865483cc  -O+ ossec13001iHExim Auth failed2025-11-17 21:31:02 dovecot_login authenticator failed for ([117.175.235.243]) [117.175.235.243]:52672: 535 Incorrect authentication data (set_id=bqtz@iemif.com)117.175.235.2431814991{b  -' ossec13001iFExim Auth failed2025-11-17 21:31:01 dovecot_plain authenticator failed for (bcoazzi7xbnx59rv903ceh4s061gs55) [38.60.205.220]:62226: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)38.60.205.2206252001ea  -U+ ossec13001i=Exim Auth failed2025-11-17 21:30:53 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:61872: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795%`  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:30:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001_  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{^  -+ ossec13001iExim Auth failed2025-11-17 21:29:29 dovecot_login authenticator failed for ([222.185.255.229]) [222.185.255.227]:32903: 535 Incorrect authentication data (set_id=administracion@lixadoracuritiba.com.br)222.185.255.2271814991$]  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:29:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001,\  e3# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:29:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001 \*R ~tj`VLB8.$zpRH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    R H z > 4 p f \ *   lbvD:0X&N^|rhTJ@6,"dZPFxn <2(V~tj`$LB8.fzpR\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (  f\H>4*  vlbXND:0& id ij irb ia i` i|_ i|^ it] i6\ i6[ i(Z iDY i8X iFW i6V i4U iVT iS iR iQ iP iO i N iM iL iK iJ iI iH iG iF iE iD iC iB iA i@ ir? ih> i= i< i; i: iz9 ih8 i7 i6 i5 ip4 il3 iF2 i@1 i60 i2/ iN. iJ- iX, iV+ iF* i8) i( i' i(& i% i$ i # i" i! i i i i i i i i i i ix i i i i ix i~ i i i it it iR iV iP iF ih iZ i8 i i8 i  i i i< i2 i i i i i i i i i i i i i i i i i i ii ie iT i) i% i i iH iF i= i i  i i i i i i i i i i i i i i i i i i iy iw iu iu iu iW iS iS i9 i9 i- i- i' i' i i i i i il ik i i i i i» iµ iœ iŒ i‚ i i} im ic ia i[ iL iD~ i>x i*w i&v i&u i${ i"} i| iz i y i q io ip it is in im ir ii ic ih if ig il ie ik i i i i i i i i i i i i i i i i i i i i{ ii ia i] iY iI i= i= i= i7 i7 i5 i5 i1 i- i# i i i i i  i i i i i i i i i i i i i i i i i i i i i~ i} i| iku ic{ iaz iYy iOx iKt iCw iAv i?o i=r i;q i3f i/s i/n i+h i+e i"d im ig ic  *1x  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:33:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730aw  -K+ ossec13001iExim Auth failed2025-11-17 21:33:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51814: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034Vv  -;% ossec13001iExim Auth failed2025-11-17 21:33:57 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:41660: 535 Incorrect authentication data (set_id=assessoria)218.22.0.2001814991'u  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:33:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<4yE1ntND3tanR+bm>167.71.230.2301269750t W' ossec9708iDovecot Aborted Login with empty userNov 17 21:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3IQXndNDNOuxV3kv>177.87.121.473469034Ts  -3) ossec13001iExim Auth failed2025-11-17 21:32:41 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:49487: 535 Incorrect authentication data (set_id=ti)12.222.177.1466252001yr  -' ossec13001iExim Auth failed2025-11-17 21:32:32 dovecot_login authenticator failed for (h-91-126-245-87.wholesale.adamo.es) [91.126.245.87]:49338: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)91.126.245.872510769q  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340p  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:32:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001o  3C% ossec11301iNew FTP connection.Nov 17 21:32:59 hosting pure-ftpd: (?@20.163.3.234) [INFO] New connection from 20.163.3.23420.163.3.2346252001_n  -G+ ossec13001iExim Auth failed2025-11-17 21:32:49 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51793: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034m  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,l  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:33:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841Zk  -A' ossec13001iExim Auth failed2025-11-17 21:32:52 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:58690: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001'j  e%' ossec9710iiDovecot Auth failed on disconnected session.Nov 17 21:31:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 +  |L : +f  -[' ossec13001ihExim Auth failed2025-11-17 21:35:51 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:47688: 535 Incorrect authentication data (set_id=colonialrodas@ieq.com.br)91.75.106.225290557Z  -A' ossec13001iZExim Auth failed2025-11-17 21:35:36 dovecot_login authenticator failed for (ADMIN) [196.117.77.73]:56657: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)196.117.77.732542007)  e%+ ossec9710i8Dovecot Auth failed on disconnected session.Nov 17 21:35:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b  -M+ ossec13001i8Exim Auth failed2025-11-17 21:35:02 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52058: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.1413469034(  e%) ossec9710i Dovecot Auth failed on disconnected session.Nov 17 21:34:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<0wHnoNNDgN4O4dKR>14.225.210.1451562822,  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:34:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001.  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:34:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822)~  e+% ossec9710i<Dovecot Auth failed on disconnected session.Nov 17 21:35:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001'}  e%' ossec9710i2Dovecot Auth failed on disconnected session.Nov 17 21:34:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001p|  -m' ossec13001iExim Auth failed2025-11-17 21:33:31 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:43582: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)182.95.224.621269750{  3C% ossec11301iNew FTP connection.Nov 17 21:33:10 hosting pure-ftpd: (?@20.163.3.234) [INFO] New connection from 20.163.3.23420.163.3.23462520014z  e;+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:34:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084)y  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:33:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991  | R $ Ro>5  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:36:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730-  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:36:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387_  -I) ossec13001ixExim Auth failed2025-11-17 21:36:06 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:48162: 535 Incorrect authentication data (set_id=colonialrodas)152.52.236.12212697507  eE' ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 21:36:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651+  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:36:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=47.101.36.2061814991 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:36:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822  W' ossec9708itDovecot Aborted Login with empty userNov 17 21:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e)) ossec9710itDovecot Auth failed on disconnected session.Nov 17 21:36:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750&  e!) ossec9710iRDovecot Auth failed on disconnected session.Nov 17 21:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841  k' ossec9709iVMultiple Dovecot Aborted Logins with empty userNov 17 21:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'  e#) ossec9710iPDovecot Auth failed on disconnected session.Nov 17 21:35:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.5618197302  e=% ossec9710iFDovecot Auth failed on disconnected session.Nov 17 21:35:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=210.1.60.2431605651  ~ r +"  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:38:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358410!  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:38:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044K  -+# ossec13001iExim Auth failed2025-11-17 21:37:48 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:50731: 535 Incorrect authentication data (set_id=info)65.20.202.4992372  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:37:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044h  -_% ossec13001iExim Auth failed2025-11-17 21:37:35 dovecot_login authenticator failed for ([58.215.243.6]) [58.215.243.6]:39755: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)58.215.243.61814991d  -U' ossec13001iExim Auth failed2025-11-17 21:37:18 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:33724: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)209.173.10.756252001{  -% ossec13001iExim Auth failed2025-11-17 21:38:06 dovecot_login authenticator failed for (200-138-85-6.ctaje701.dsl.brasiltelecom.net.br) [200.138.85.6]:33475: 535 Incorrect authentication data (set_id=paulinho.vendas)200.138.85.63469034_ -G) ossec13001iExim Auth failed2025-11-17 21:38:00 dovecot_login authenticator failed for (User) [177.74.174.120]:58259: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)177.74.174.1203469034u  -u) ossec13001iExim Auth failed2025-11-17 21:37:45 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:57476: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)125.20.245.1821269750W  -9) ossec13001iExim Auth failed2025-11-17 21:37:34 dovecot_login authenticator failed for ([1.15.123.146]) [175.11.231.177]:45892: 535 Incorrect authentication data (set_id=doninha)175.11.231.1771814991 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n  -g) ossec13001iExim Auth failed2025-11-17 21:37:19 dovecot_login authenticator failed for ([120.253.17.168]) [120.253.17.168]:46009: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)120.253.17.1681814991"  e% ossec9710ixDovecot Auth failed on disconnected session.Nov 17 21:36:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=69.62.65.113, lip=200.150.196.245, session=69.62.65.113597427)  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:36:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044+  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:36:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001 - h V# W-&/  e!) ossec9710i2Dovecot Auth failed on disconnected session.Nov 17 21:39:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730-.  e3% ossec9710iNDovecot Auth failed on disconnected session.Nov 17 21:39:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841#-  e!# ossec9710iJDovecot Auth failed on disconnected session.Nov 17 21:39:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.7138654830,  e5) ossec9710iXDovecot Auth failed on disconnected session.Nov 17 21:39:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<4V2Ks9NDfqvSchJs>210.114.18.1081835841"+  e% ossec9710iVDovecot Auth failed on disconnected session.Nov 17 21:39:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060* W' ossec9708iFDovecot Aborted Login with empty userNov 17 21:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/)  e3) ossec9710i8Dovecot Auth failed on disconnected session.Nov 17 21:39:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001+(  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:38:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758_' -G) ossec13001iExim Auth failed2025-11-17 21:38:16 dovecot_login authenticator failed for (User) [177.74.174.120]:58259: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)177.74.174.1203469034&  W' ossec9708i(Dovecot Aborted Login with empty userNov 17 21:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,%  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:38:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<5qWRr9NDJrlw2eny>112.217.233.2421835841($  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:38:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251#  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 17 21:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  _ k 2 E&0=  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:40:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730n<  -g) ossec13001iExim Auth failed2025-11-17 21:40:49 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:46388: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)103.251.31.1541269750^;  -E+ ossec13001iExim Auth failed2025-11-17 21:40:33 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51501: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.1413469034: W' ossec9708iDovecot Aborted Login with empty userNov 17 21:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&9  e!) ossec9710izDovecot Auth failed on disconnected session.Nov 17 21:40:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.193223338728  e7+ ossec9710ihDovecot Auth failed on disconnected session.Nov 17 21:40:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<8G91tNNDFMZns7yS>103.179.188.1461562822k7  -c' ossec13001iExim Auth failed2025-11-17 21:41:02 dovecot_login authenticator failed for ([111.26.101.76]) [111.26.101.77]:38118: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)111.26.101.771814991,6  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:40:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001i5  -c' ossec13001iExim Auth failed2025-11-17 21:40:43 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:43130: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)65.20.233.1109923754  e=+ ossec9710ipDovecot Auth failed on disconnected session.Nov 17 21:40:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001p3  -o% ossec13001ilExim Auth failed2025-11-17 21:40:11 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4867: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)144.64.65.302264397(2  e'' ossec9710iFDovecot Auth failed on disconnected session.Nov 17 21:39:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<4e9zstNDfIZn9M4G>103.244.206.6164308471  eE' ossec9710i@Dovecot Auth failed on disconnected session.Nov 17 21:39:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.144625200160  eA) ossec9710i6Dovecot Auth failed on disconnected session.Nov 17 21:39:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750 U  . oUK W' ossec9708iDovecot Aborted Login with empty userNov 17 21:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.J  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:41:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001I  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340H  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:41:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084-G  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:41:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=83.239.84.130, lip=200.150.196.245, TLS, session=83.239.84.1302017370hF  -_% ossec13001iExim Auth failed2025-11-17 21:41:36 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:53072: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)36.50.167.811269750E  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2uqoudND7rGxV3kv>177.87.121.473469034cD  -W# ossec13001iExim Auth failed2025-11-17 21:41:20 dovecot_login authenticator failed for ([111.22.0.76]) [111.22.0.76]:55342: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)111.22.0.761814991UC  -7' ossec13001iExim Auth failed2025-11-17 21:41:54 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:32836: 535 Incorrect authentication data (set_id=rafael)182.95.115.701269750\B  -G% ossec13001iExim Auth failed2025-11-17 21:41:51 dovecot_login authenticator failed for (ip28.net52.ivn.ttksever.ru) [46.160.52.28]:49468: 535 Incorrect authentication data (set_id=info)46.160.52.282017370dA  -Q+ ossec13001iExim Auth failed2025-11-17 21:40:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59595: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651*@  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:40:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991n?  -g) ossec13001irExim Auth failed2025-11-17 21:40:17 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:48086: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)121.73.163.2322186224&>  e!) ossec9710ihDovecot Auth failed on disconnected session.Nov 17 21:40:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044 5 ` ; K gbg8I5YY  -=) ossec13001iDExim Auth failed2025-11-17 21:43:47 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:59646: 535 Incorrect authentication data (set_id=adriana)220.77.245.22718358413X  e9+ ossec9710i8Dovecot Auth failed on disconnected session.Nov 17 21:43:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<2dLWwNNDQJFns7yS>103.179.188.1461562822kW  -e% ossec13001iFExim Auth failed2025-11-17 21:43:49 dovecot_login authenticator failed for ([60.11.250.94]) [60.11.250.94]:58354: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)60.11.250.941814991+V  e-' ossec9710i6Dovecot Auth failed on disconnected session.Nov 17 21:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<6QjFwNNDbsUtPZWl>45.61.149.1656252001U W' ossec9708i4Dovecot Aborted Login with empty userNov 17 21:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]T  -E) ossec13001iVExim Auth failed2025-11-17 21:44:06 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:34468: 535 Incorrect authentication data (set_id=alex.vendas)167.250.118.533865483S  e ) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:42:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=123.193.152.64, lip=200.150.196.245, session=123.193.152.641668284aR  -M) ossec13001iExim Auth failed2025-11-17 21:42:35 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:35278: 535 Incorrect authentication data (set_id=contato)222.252.21.2401562822`Q  -M' ossec13001iExim Auth failed2025-11-17 21:42:21 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:52108: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730lP  -e' ossec13001iExim Auth failed2025-11-17 21:42:12 dovecot_login authenticator failed for ([182.95.57.158]) [182.95.57.158]:40468: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)182.95.57.1581269750!O  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:42:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=57.132.150.162, lip=200.150.196.245, TLS, session=57.132.150.1626252001+N  e/% ossec9710i Dovecot Auth failed on disconnected session.Nov 17 21:42:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.18.49.14, lip=200.150.196.245, TLS, session=<3871vNND3oF5EjEO>121.18.49.1418149913M  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:42:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.12162520016L  eE% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:42:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382 ) bI99>(Q)$h  e## ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<2DOSyNNDRuBCYSpH>66.97.42.713865483Sg  -5% ossec13001iExim Auth failed2025-11-17 21:45:33 dovecot_login authenticator failed for ([5.142.17.130]) [5.142.17.130]:45298: 535 Incorrect authentication data (set_id=adriana)5.142.17.1302017370hf  -c% ossec13001iExim Auth failed2025-11-17 21:45:37 dovecot_login authenticator failed for ([65.20.250.93]) [65.20.250.93]:36285: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)65.20.250.9399237&e  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:45:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170wd  -y) ossec13001iExim Auth failed2025-11-17 21:45:13 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:28076: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)216.194.174.276252001Yc  -?' ossec13001iExim Auth failed2025-11-17 21:45:51 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:39530: 535 Incorrect authentication data (set_id=financeiro)182.78.93.1901269750b  k' ossec9709irMultiple Dovecot Aborted Logins with empty userNov 17 21:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 a  -#) ossec13001iExim Auth failed2025-11-17 21:45:05 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:34724: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)178.140.95.2212017370`  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3tEqxtNDlKSxV3kv>177.87.121.4734690344_  e?' ossec9710i|Dovecot Auth failed on disconnected session.Nov 17 21:44:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084+^  e+) ossec9710i|Dovecot Auth failed on disconnected session.Nov 17 21:44:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001_]  -G+ ossec13001itExim Auth failed2025-11-17 21:44:36 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52022: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034y\  -{+ ossec13001i6Exim Auth failed2025-11-17 21:43:34 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:58922: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)154.146.240.1232542007.[  e/+ ossec9710i6Dovecot Auth failed on disconnected session.Nov 17 21:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001!Z  e' ossec9710i(Dovecot Auth failed on disconnected session.Nov 17 21:43:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=47.101.36.2061814991  qw  -k+ ossec13001i*Exim Auth failed2025-11-17 21:47:38 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:42949: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)121.131.220.1521835841bv  -Q' ossec13001i&Exim Auth failed2025-11-17 21:47:33 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:58423: 535 Incorrect authentication data (set_id=info)111.70.23.2401668284u  k' ossec9709i&Multiple Dovecot Aborted Logins with empty userNov 17 21:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034it  -_' ossec13001iExim Auth failed2025-11-17 21:46:50 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:34619: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)5.142.196.1852017370is  -_' ossec13001iExim Auth failed2025-11-17 21:46:40 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:51300: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)111.26.95.1201814991#r  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:46:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<4NfBytNDjuHBl4nP>193.151.137.207130758rq  -o) ossec13001i Exim Auth failed2025-11-17 21:47:05 dovecot_login authenticator failed for ([121.239.67.146]) [121.239.67.146]:50364: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)121.239.67.1461814991Yp  -=) ossec13001iExim Auth failed2025-11-17 21:46:52 dovecot_login authenticator failed for ([46.163.189.191]) [46.163.189.191]:40448: 535 Incorrect authentication data (set_id=contato)46.163.189.1912017370)o  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:46:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044n W' ossec9708iDovecot Aborted Login with empty userNov 17 21:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034cm  -W# ossec13001iExim Auth failed2025-11-17 21:46:26 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:56283: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)24.121.1.616252001l W' ossec9708iDovecot Aborted Login with empty userNov 17 21:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^k  -I' ossec13001iExim Auth failed2025-11-17 21:45:24 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:32908: 535 Incorrect authentication data (set_id=administrativo1)119.192.59.801835841 j  e# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:45:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<6136xtNDvteUcQQF>148.113.4.51269750-i  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:46:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867 *! 7 M Y j QbO_8E!*s  -s' ossec13001iµExim Auth failed2025-11-17 21:49:55 dovecot_login authenticator failed for ([45.155.146.33]) [45.155.146.33]:52240: 535 Incorrect authentication data (set_id=bianca.user.tech@globalmedica.com.br)45.155.146.332017370O  -/# ossec13001i‚Exim Auth failed2025-11-17 21:49:06 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:6236: 535 Incorrect authentication data (set_id=brizola)61.32.68.661835841 W' ossec9708iaDovecot Aborted Login with empty userNov 17 21:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343  e;) ossec9710i[Dovecot Auth failed on disconnected session.Nov 17 21:48:26 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=190.89.136.210, lip=200.150.196.245, TLS, session=<5JxQ0dNDtqG+WYjS>190.89.136.2103469034o  -g+ ossec13001iExim Auth failed2025-11-17 21:49:02 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:37391: 535 Incorrect authentication data (set_id=rafael)188.219.104.2103175395#  e' ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 21:49:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758l  -c) ossec13001imExim Auth failed2025-11-17 21:48:43 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:57134: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)103.248.30.2051269750  -+' ossec13001icExim Auth failed2025-11-17 21:48:33 dovecot_login authenticator failed for 158.45.169.34.bc.googleusercontent.com ([34.82.26.7]) [34.169.45.158]:40584: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)34.169.45.1586252001k  -_+ ossec13001iLExim Auth failed2025-11-17 21:48:12 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50963: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651~  W' ossec9708iDDovecot Aborted Login with empty userNov 17 21:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k}  -_+ ossec13001i"Exim Auth failed2025-11-17 21:47:29 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:33692: 535 Incorrect authentication data (set_id=financeiro)203.192.211.1561269750p|  -k+ ossec13001iExim Auth failed2025-11-17 21:47:15 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11979: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)195.142.106.177298795f{  -]# ossec13001i$Exim Auth failed2025-11-17 21:47:32 dovecot_login authenticator failed for 111-70-32-7.emome-ip.hinet.net [111.70.32.7]:44377: 535 Incorrect authentication data (set_id=isabellylisboa)111.70.32.71668284fz  -[' ossec13001iExim Auth failed2025-11-17 21:47:11 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:57526: 535 Incorrect authentication data (set_id=atualizacoes)91.219.196.17690791vy  -y' ossec13001i Exim Auth failed2025-11-17 21:47:07 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:60746: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)213.154.80.362245662ax  -O' ossec13001i>Exim Auth failed2025-11-17 21:47:58 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:42770: 535 Incorrect authentication data (set_id=info)179.184.33.863469034   tq: )  e)' ossec9710i7Dovecot Auth failed on disconnected session.Nov 17 21:52:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.19718358413  e;) ossec9710i%Dovecot Auth failed on disconnected session.Nov 17 21:51:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u  -u) ossec13001iExim Auth failed2025-11-17 21:50:30 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:54222: 535 Incorrect authentication data (set_id=paulo.user.tech@louvoreterno.com.br)115.241.228.341269750n  -i' ossec13001iExim Auth failed2025-11-17 21:50:13 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:52296: 535 Incorrect authentication data (set_id=bianca.user.tech)201.173.97.343996063~  -) ossec13001iExim Auth failed2025-11-17 21:50:09 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:56225: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)118.103.253.481820814  W' ossec9708iDovecot Aborted Login with empty userNov 17 21:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -7) ossec13001iExim Auth failed2025-11-17 21:50:39 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:49256: 535 Incorrect authentication data (set_id=info)220.72.159.2301835841/  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:50:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758g  -]' ossec13001iExim Auth failed2025-11-17 21:50:59 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:39755: 535 Incorrect authentication data (set_id=paulo.user.tech)85.29.246.199453733|  -' ossec13001iExim Auth failed2025-11-17 21:50:44 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:36820: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)123.194.136.31668284 W' ossec9708iœDovecot Aborted Login with empty userNov 17 21:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  e!' ossec9710iŒDovecot Auth failed on disconnected session.Nov 17 21:49:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758(  e+# ossec9710i»Dovecot Auth failed on disconnected session.Nov 17 21:50:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750   ,$  e/' ossec9710iéDovecot Auth failed on disconnected session.Nov 17 21:53:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001q#  -k+ ossec13001i}Exim Auth failed2025-11-17 21:53:17 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:37606: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)169.211.232.1821835841 "  -#' ossec13001iwExim Auth failed2025-11-17 21:53:11 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:33714: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)61.95.192.1581269750a!  -O' ossec13001ikExim Auth failed2025-11-17 21:52:58 dovecot_login authenticator failed for 133.232.64.26.static.zoot.jp [133.232.64.26]:59568: 535 Incorrect authentication data (set_id=contato)133.232.64.261861060l  -a+ ossec13001iYExim Auth failed2025-11-17 21:52:40 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:57630: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)186.238.247.2383469034v  -w) ossec13001iYExim Auth failed2025-11-17 21:52:40 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:38041: 535 Incorrect authentication data (set_id=bqtz)201.15.149.2543469034f  -U+ ossec13001iYExim Auth failed2025-11-17 21:52:40 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52226: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034 W' ossec9708iQDovecot Aborted Login with empty userNov 17 21:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8wcG4dNDWKaxV3kv>177.87.121.473469034`  -K) ossec13001iMExim Auth failed2025-11-17 21:52:27 dovecot_login authenticator failed for ([117.175.160.58]) [117.175.160.58]:38222: 535 Incorrect authentication data (set_id=bqtz@iemif.com)117.175.160.581814991  --' ossec13001iqExim Auth failed2025-11-17 21:53:03 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:58478: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)50.171.64.1706252001j  -a' ossec13001iExim Auth failed2025-11-17 21:51:34 dovecot_login authenticator failed for ([111.26.69.159]) [111.26.69.160]:35354: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)111.26.69.1601814991 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e)% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:51:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841x -y) ossec13001iExim Auth failed2025-11-17 21:51:14 dovecot_plain authenticator failed for ([203.159.90.126]) [203.159.90.126]:61944: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)203.159.90.1262750405w  -{' ossec13001i7Exim Auth failed2025-11-17 21:52:07 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:59690: 535 Incorrect authentication data (set_id=contato)182.95.174.181269750 % OpdR&*2  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:54:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822%1  e#% ossec9710iùDovecot Auth failed on disconnected session.Nov 17 21:54:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<9MoD59NDAqwvT1jH>47.79.88.1991861060(0  e%) ossec9710iõDovecot Auth failed on disconnected session.Nov 17 21:54:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456)/  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:55:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758a.  -O' ossec13001ißExim Auth failed2025-11-17 21:53:50 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:48758: 535 Incorrect authentication data (set_id=contato)213.41.173.773017382+-  e1# ossec9710iÍDovecot Auth failed on disconnected session.Nov 17 21:53:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001Y,  -=) ossec13001iÇExim Auth failed2025-11-17 21:53:26 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:55180: 535 Incorrect authentication data (set_id=loopert)190.117.96.1743932488[+  -?+ ossec13001iÇExim Auth failed2025-11-17 21:53:26 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:43112: 535 Incorrect authentication data (set_id=cpfnc2)197.219.228.24210369734*  e?' ossec9710iãDovecot Auth failed on disconnected session.Nov 17 21:53:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651)  k' ossec9709iÍMultiple Dovecot Aborted Logins with empty userNov 17 21:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341( e7' ossec9710iyDovecot Auth failed on disconnected session.Nov 17 21:53:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730'  W' ossec9708iëDovecot Aborted Login with empty userNov 17 21:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)&  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:53:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750W%  -;' ossec13001iyExim Auth failed2025-11-17 21:53:13 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:57144: 535 Incorrect authentication data (set_id=contato)125.23.140.541269750 { hds{A W' ossec9708iDovecot Aborted Login with empty userNov 17 21:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{@  -) ossec13001iExim Auth failed2025-11-17 21:55:19 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:54492: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)116.98.104.1381562822[?  -C' ossec13001i%Exim Auth failed2025-11-17 21:56:05 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:54578: 535 Incorrect authentication data (set_id=atualizacoes)180.92.235.701210997m>  -e) ossec13001iExim Auth failed2025-11-17 21:55:58 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:36990: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)190.213.54.2023573591=  - ) ossec13001iExim Auth failed2025-11-17 21:55:56 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:49918: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)200.199.32.1743469034,<  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:55:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<0LcJ7dNDIKJxoZB3>113.161.144.1191562822';  e'% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:55:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370:  -' ossec13001iExim Auth failed2025-11-17 21:55:44 dovecot_login authenticator failed for (nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:58476: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)152.52.246.941269750\9  -I% ossec13001iExim Auth failed2025-11-17 21:55:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58740: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758n8  -i' ossec13001i!Exim Auth failed2025-11-17 21:56:00 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:53554: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)36.135.100.481814991/7  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:55:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001k6  -c' ossec13001iExim Auth failed2025-11-17 21:54:51 dovecot_login authenticator failed for 149.51.222.87.dynamic.jazztel.es [87.222.51.149]:46592: 535 Incorrect authentication data (set_id=ferramentaria)87.222.51.14925107695 W' ossec9708iDovecot Aborted Login with empty userNov 17 21:54:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8box6NND3tqxV3kv>177.87.121.473469034q4  -o' ossec13001iExim Auth failed2025-11-17 21:54:40 dovecot_login authenticator failed for ([213.234.9.218]) [213.234.9.218]:52928: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)213.234.9.2182017370,3  e3# ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:54:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730    ffP  -U+ ossec13001i;Exim Auth failed2025-11-17 21:56:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52223: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034YO  -=) ossec13001i-Exim Auth failed2025-11-17 21:56:13 dovecot_login authenticator failed for ([175.207.233.24]) [175.207.233.24]:45385: 535 Incorrect authentication data (set_id=leandro)175.207.233.241835841$N  e!% ossec9710i+Dovecot Auth failed on disconnected session.Nov 17 21:56:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<3jzU7dND1pkIiXsk>8.137.123.361814991M W) ossec9708i;Dovecot Aborted Login with empty userNov 17 21:56:26 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.101, lip=200.150.207.122, TLS, session=<4e7y7tNDJ4otnIFl>45.156.129.1012264397L  W) ossec9708i9Dovecot Aborted Login with empty userNov 17 21:56:24 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.100, lip=200.150.207.122, session=45.156.129.1002264397^K  -G) ossec13001i/Exim Auth failed2025-11-17 21:56:15 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:60509: 535 Incorrect authentication data (set_id=junior.gomes)218.156.93.2031835841J  W' ossec9708i_Dovecot Aborted Login with empty userNov 17 21:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bI  -O) ossec13001iWExim Auth failed2025-11-17 21:56:53 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:42024: 535 Incorrect authentication data (set_id=secretarioadjunto)180.148.10.1241210997sH  -q) ossec13001iEExim Auth failed2025-11-17 21:56:37 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:40406: 535 Incorrect authentication data (set_id=comercial.user.tech@inovasite.com)121.189.226.811835841G  W) ossec9708iADovecot Aborted Login with empty userNov 17 21:56:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.102, lip=200.150.207.122, TLS, session=45.156.129.1022264397F  k' ossec9709iAMultiple Dovecot Aborted Logins with empty userNov 17 21:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341E  e7) ossec9710iSDovecot Auth failed on disconnected session.Nov 17 21:56:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750D  - + ossec13001iEExim Auth failed2025-11-17 21:56:36 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:40640: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)213.238.254.1562661886fC  -[% ossec13001iExim Auth failed2025-11-17 21:55:49 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:60796: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)203.252.10.31835841sB  -w% ossec13001iExim Auth failed2025-11-17 21:55:43 dovecot_login authenticator failed for (212.35.70.26.ua.batelco.jo) [212.35.70.26]:42021: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)212.35.70.26248816 ) J ' {Y_  -C% ossec13001iijExim Auth failed2025-11-17 21:58:27 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59741: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758/^  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:59:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841]]  -E) ossec13001iExim Auth failed2025-11-17 21:59:02 dovecot_login authenticator failed for ([94.181.191.152]) [94.181.191.152]:53406: 535 Incorrect authentication data (set_id=vanessalima)94.181.191.1522017370`\  -I+ ossec13001iġExim Auth failed2025-11-17 21:58:09 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:38955: 535 Incorrect authentication data (set_id=vanessalima)220.180.107.1931814991`[  -O' ossec13001iĝExim Auth failed2025-11-17 21:58:05 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64189: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795PZ  -1# ossec13001iěExim Auth failed2025-11-17 21:58:02 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:52496: 535 Incorrect authentication data (set_id=contato)46.8.246.272017370 Y  -!' ossec13001iđExim Auth failed2025-11-17 21:57:52 dovecot_login authenticator failed for (109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:50482: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)109.195.29.5720173703X  e=' ossec9710iċDovecot Auth failed on disconnected session.Nov 17 21:57:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149916W  e?+ ossec9710iĉDovecot Auth failed on disconnected session.Nov 17 21:57:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822V  -+' ossec13001iăExim Auth failed2025-11-17 21:57:39 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:35424: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)182.95.57.1101269750U W' ossec9708i}Dovecot Aborted Login with empty userNov 17 21:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  e) ossec9710iSDovecot Auth failed on disconnected session.Nov 17 21:56:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.208.188.27, lip=200.150.196.245, TLS, session=185.208.188.273175395[S  -A) ossec13001i+Exim Auth failed2025-11-17 21:56:09 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:54702: 535 Incorrect authentication data (set_id=sec.geral)196.28.226.1241036973XR  -=) ossec13001i)Exim Auth failed2025-11-17 21:56:07 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:52582: 535 Incorrect authentication data (set_id=contato)196.188.187.21337996wQ  -y) ossec13001iUExim Auth failed2025-11-17 21:56:51 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:48009: 535 Incorrect authentication data (set_id=comercial.user.tech)76.136.164.1576252001 t1 .bHdtln  -e' ossec13001iAExim Auth failed2025-11-17 22:00:49 dovecot_login authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:49854: 535 Incorrect authentication data (set_id=eduardo)85.30.248.2132017370`m  -Q# ossec13001i5Exim Auth failed2025-11-17 22:00:37 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:47901: 535 Incorrect authentication data (set_id=ferramentaria)92.62.74.411527747l W' ossec9708i1Dovecot Aborted Login with empty userNov 17 22:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 21:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:00:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,i  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 21:59:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991,h  e/' ossec9710iĵDovecot Auth failed on disconnected session.Nov 17 21:58:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867,g  e-) ossec9710iħDovecot Auth failed on disconnected session.Nov 17 21:58:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3JFK9dNDHMCB4rs4>129.226.187.561819730Yf  -?' ossec13001iExim Auth failed2025-11-17 21:58:42 dovecot_login authenticator failed for ([211.63.34.149]) [211.63.34.149]:56593: 535 Incorrect authentication data (set_id=financeiro)211.63.34.1491835841me  -g' ossec13001iijExim Auth failed2025-11-17 21:58:27 dovecot_login authenticator failed for ([36.154.237.94]) [36.154.237.94]:54912: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)36.154.237.941814991pd  -m' ossec13001iijExim Auth failed2025-11-17 21:58:26 dovecot_login authenticator failed for ([125.90.72.114]) [125.90.72.114]:52453: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)125.90.72.1141814991oc  -i) ossec13001iExim Auth failed2025-11-17 21:58:41 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:57107: 535 Incorrect authentication data (set_id=cpfnc2)203.174.182.3820774560b  e3+ ossec9710iĿDovecot Auth failed on disconnected session.Nov 17 21:58:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<9UGp9tNDBoRxoZB3>113.161.144.1191562822a W' ossec9708iĹDovecot Aborted Login with empty userNov 17 21:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034K`  -+ ossec13001iExim Auth failed2025-11-17 21:58:40 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:46024: 535 Incorrect authentication data178.178.194.1372017370 a qv~lIad}  -S) ossec13001iExim Auth failed2025-11-17 22:02:56 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:44893: 535 Incorrect authentication data (set_id=adriana)179.125.124.143469034|  k' ossec9709iũMultiple Dovecot Aborted Logins with empty userNov 17 22:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034"{  e' ossec9710iőDovecot Auth failed on disconnected session.Nov 17 22:02:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<20M7A9RDdIknaoFh>39.106.129.971814991z  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:03:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034yy  -{+ ossec13001iűExim Auth failed2025-11-17 22:02:41 dovecot_login authenticator failed for ([211.116.107.220]) [211.116.107.220]:33947: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)211.116.107.2201835841Rx  -1' ossec13001irExim Auth failed2025-11-17 22:01:37 dovecot_login authenticator failed for ([36.153.189.66]) [36.153.189.66]:54843: 535 Incorrect authentication data (set_id=adm)36.153.189.661814991w W' ossec9708inDovecot Aborted Login with empty userNov 17 22:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Zv  -C% ossec13001igExim Auth failed2025-11-17 22:01:26 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:52854: 535 Incorrect authentication data (set_id=isabellylisboa)203.252.10.41835841wu  -w+ ossec13001iUExim Auth failed2025-11-17 22:01:08 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:37196: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)185.183.103.1212635167)t  e%+ ossec9710iŌDovecot Auth failed on disconnected session.Nov 17 22:02:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.12162520013s  e=' ossec9710iłDovecot Auth failed on disconnected session.Nov 17 22:01:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001mr  -e) ossec13001i1Exim Auth failed2025-11-17 22:00:32 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:41405: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)216.194.174.276252001qq  -o' ossec13001i,Exim Auth failed2025-11-17 22:00:26 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:36101: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)70.174.168.426252001/p  e7% ossec9710iMDovecot Auth failed on disconnected session.Nov 17 22:01:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991o  -+% ossec13001iMExim Auth failed2025-11-17 22:01:00 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:50431: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)31.199.10.823175395 3 j /0%:E3\  -G% ossec13001i Exim Auth failed2025-11-17 22:04:08 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:57748: 535 Incorrect authentication data (set_id=andre.nascimento)36.135.62.871814991}  -) ossec13001i<Exim Auth failed2025-11-17 22:04:59 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:37511: 535 Incorrect authentication data (set_id=marcos@maringasoldas.com.br)190.104.254.913865483-  e3% ossec9710i0Dovecot Auth failed on disconnected session.Nov 17 22:04:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841q  -q% ossec13001iExim Auth failed2025-11-17 22:03:38 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:50266: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)157.15.67.201643084g  -[' ossec13001iExim Auth failed2025-11-17 22:03:20 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:55163: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)103.174.34.491269750  -+ ossec13001iExim Auth failed2025-11-17 22:03:57 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:41554: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)122.187.230.1541269750j  -c% ossec13001iExim Auth failed2025-11-17 22:03:57 dovecot_login authenticator failed for (syn-072-179-206-006.res.spectrum.com) [72.179.206.6]:35233: 535 Incorrect authentication data (set_id=salamuni)72.179.206.66252001_ -G) ossec13001iExim Auth failed2025-11-17 22:03:21 dovecot_login authenticator failed for (User) [177.74.174.120]:55990: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)177.74.174.1203469034*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:03:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697507  eA+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:03:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001 W' ossec9708iDovecot Aborted Login with empty userNov 17 22:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e'' ossec9710iūDovecot Auth failed on disconnected session.Nov 17 22:02:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.21062520015  e=+ ossec9710işDovecot Auth failed on disconnected session.Nov 17 22:02:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=103.239.165.1141643084.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:03:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044a~  -S# ossec13001iExim Auth failed2025-11-17 22:03:01 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:27497: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)14.54.22.111835841 K {K,  e3# ossec9710iƀDovecot Auth failed on disconnected session.Nov 17 22:06:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750&  e!) ossec9710iƶDovecot Auth failed on disconnected session.Nov 17 22:07:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841 W' ossec9708iƚDovecot Aborted Login with empty userNov 17 22:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -=' ossec13001iƤExim Auth failed2025-11-17 22:06:44 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:54163: 535 Incorrect authentication data (set_id=comercial)183.182.99.921655842d  ;E) ossec13008iƜMail Recipient rejected2025-11-17 22:06:34 H=(localhost) [54.165.171.241]:34414 F= rejected RCPT : Sender verify failed54.165.171.24162520012  e9) ossec9710iƐDovecot Auth failed on disconnected session.Nov 17 22:06:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730  k' ossec9709i^Multiple Dovecot Aborted Logins with empty userNov 17 22:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -a' ossec13001iXExim Auth failed2025-11-17 22:05:27 dovecot_login authenticator failed for ([65.32.144.232]) [65.32.144.232]:48426: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)65.32.144.2326252001[  -?+ ossec13001iJExim Auth failed2025-11-17 22:05:14 dovecot_login authenticator failed for ([163.179.123.188]) [163.179.123.188]:46822: 535 Incorrect authentication data (set_id=marcos)163.179.123.1881814991  W' ossec9708i|Dovecot Aborted Login with empty userNov 17 22:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[  -E% ossec13001itExim Auth failed2025-11-17 22:05:55 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:49080: 535 Incorrect authentication data (set_id=atualizacoes1)112.30.127.91814991$  e## ossec9710ilDovecot Auth failed on disconnected session.Nov 17 22:05:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.018197307  eE' ossec9710ijDovecot Auth failed on disconnected session.Nov 17 22:05:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822 W' ossec9708i"Dovecot Aborted Login with empty userNov 17 22:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -E+ ossec13001iExim Auth failed2025-11-17 22:04:28 dovecot_login authenticator failed for ([121.131.220.141]) [121.131.220.141]:56137: 535 Incorrect authentication data (set_id=sec.geral)121.131.220.1411835841 ** Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ *  R H > 4  0N&vDlbX:h^TJ@,"6|rndZPFx<( 2tj`VLB~$8.4*RzpH>f\ | r h ^ T J @ 6 , "    x n d  vlbXND:0& i^ i\ ih if i` i{ in ib ib iɁ i` i^ i i1 i( i iL iI i- i+ i& i~ i} i| i{ iz iy ix iw iv iȼu iȶt iȪs iȠr iq ifp iȖo iȌn i~m izl irk idj ivi iTh iHg i>f i.e i>d i8c i6b i2a i&` iP_ i^ i] i\ i[ iZ iY iX iW iV iU iT iS iR iQ iǼP iǼO iǮN iM iL iǾK iDzJ iǔI iǒH iNJG iNJF iǐE iNJD ixC ixB ivA iv@ iǢ? iǒ> iT= iR< iJ; iN: iH9 i68 if7 iD6 iB5 i@4 ib3 iT2 iF1 i40 i2/ i&. i- i, i2+ i$* i) i.( i&' i&& i % i*$ i# i" i! i i i iƘ iƒ iƀ iƶ iƚ iƤ iƜ iƐ i^ iX iJ i| it il ij i< i0 i" i i  i i i i i i i i i i i i iű iū iũ iş iő iŌ ił ir in ig iU iM iM iA i5 i1 i1 i, i i i i i i i i7 i7 i% i i i i i i i iʃ i{ iy iw iu iq ik ie iY iW iK iC iA i1 i' i i i i i i i i i i i i i i iɻ iɻ iɩ iɥ iɟ iɟ iɗ iɉ iɅ i iĿ iĹ iĵ iij iij iij iħ iġ iĝ iě iđ iċ iĉ iă i} i_ iW iU iS iS iE iE iA iA i; i; i9 i/ i- i+ i+ i) i% i! i i i i i i i2 iʋ i i i i i i i i i i iù iõ ië ié iã iß iÍ iÍ iÇ iÇ i i} iy iy iw iq ik iY iY iY iQ iM  V nT( )  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:08:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  W' ossec9708i.Dovecot Aborted Login with empty userNov 17 22:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6uoBHNRD8NKxV3kv>177.87.121.473469034r'  -o) ossec13001i&Exim Auth failed2025-11-17 22:08:53 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:36778: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)175.205.191.271835841q&  -m) ossec13001i&Exim Auth failed2025-11-17 22:08:53 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:33778: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)195.222.57.1903277605/%  e1+ ossec9710i Dovecot Auth failed on disconnected session.Nov 17 22:08:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841j$  -_) ossec13001i*Exim Auth failed2025-11-17 22:08:57 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:52948: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)111.171.125.941835841:#  eK' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:08:17 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.238.107.70, lip=200.150.196.245, TLS, session=45.238.107.703865483" W' ossec9708iDovecot Aborted Login with empty userNov 17 22:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d!  ;E) ossec13008iMail Recipient rejected2025-11-17 22:07:26 H=(localhost) [54.165.171.241]:23350 F= rejected RCPT : Sender verify failed54.165.171.24162520011  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:07:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841%  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:07:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.17115628220  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:07:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387&  e%% ossec9710iƘDovecot Auth failed on disconnected session.Nov 17 22:06:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0cXmEtRDuK9vAEul>111.0.75.1651814991j  -c% ossec13001iƒExim Auth failed2025-11-17 22:06:26 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:40180: 535 Incorrect authentication data (set_id=comercial@inovasite.com)93.91.153.263077311 + ![8  -C) ossec13001i6Exim Auth failed2025-11-17 22:09:09 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:41594: 535 Incorrect authentication data (set_id=formula316)62.182.118.13873280007  e;# ossec9710ifDovecot Auth failed on disconnected session.Nov 17 22:09:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483w6  -y) ossec13001iDExim Auth failed2025-11-17 22:09:22 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:54941: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)189.113.185.143469034X5  -;) ossec13001iBExim Auth failed2025-11-17 22:09:20 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:41638: 535 Incorrect authentication data (set_id=eduardo)152.52.246.1781269750q4  -s% ossec13001i@Exim Auth failed2025-11-17 22:09:18 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:56598: 535 Incorrect authentication data (set_id=info.user.tech@lixadoracuritiba.com.br)95.35.29.1922946403  -% ossec13001ibExim Auth failed2025-11-17 22:09:54 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:56224: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)83.221.15.762017370r2  -o) ossec13001iTExim Auth failed2025-11-17 22:09:38 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:54522: 535 Incorrect authentication data (set_id=info.user.tech)220.246.42.2271819730u1  -u) ossec13001iFExim Auth failed2025-11-17 22:09:25 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:53386: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)112.161.26.1251835841a0  -K+ ossec13001i4Exim Auth failed2025-11-17 22:09:08 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:58380: 535 Incorrect authentication data (set_id=fabio.vendas)103.194.243.1871269750_/  -I+ ossec13001i2Exim Auth failed2025-11-17 22:09:05 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:44378: 535 Incorrect authentication data (set_id=alex.vendas)196.189.124.229337996).  e') ossec9710i&Dovecot Auth failed on disconnected session.Nov 17 22:08:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750$-  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:08:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001),  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:08:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<6HObGNRDcrykXF7M>164.92.94.2046252001N+  -') ossec13001i2Exim Auth failed2025-11-17 22:09:05 dovecot_login authenticator failed for (OmJbw2) [213.209.157.84]:65355: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044*  - ) ossec13001i$Exim Auth failed2025-11-17 22:08:51 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:40900: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)67.172.244.2356252001 u  6 A 9AHnRuYH  -?' ossec13001iǒExim Auth failed2025-11-17 22:10:42 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:41932: 535 Incorrect authentication data (set_id=financeiro)182.95.51.1661269750.G  e/+ ossec9710iNJDovecot Auth failed on disconnected session.Nov 17 22:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991F W' ossec9708iNJDovecot Aborted Login with empty userNov 17 22:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dE  -W% ossec13001iǐExim Auth failed2025-11-17 22:10:39 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:59350: 535 Incorrect authentication data (set_id=andre.nascimento.tech)125.19.156.21269750dD  -Q+ ossec13001iNJExim Auth failed2025-11-17 22:10:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57589: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651VC  -;' ossec13001ixExim Auth failed2025-11-17 22:10:15 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:51377: 535 Incorrect authentication data (set_id=salamuni)94.207.19.166290557uB  -{% ossec13001ixExim Auth failed2025-11-17 22:10:15 dovecot_login authenticator failed for ([5.30.224.249]) [5.30.224.249]:59425: 535 Incorrect authentication data (set_id=andre.nascimento.tech@calcautomacao.com.br)5.30.224.249290557tA  -u) ossec13001ivExim Auth failed2025-11-17 22:10:13 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:53974: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)94.154.217.188690791R@ --) ossec13001ivExim Auth failed2025-11-17 22:10:13 dovecot_login authenticator failed for (GRXeJx1kp) [213.209.157.84]:50413: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044w?  -y) ossec13001iǢExim Auth failed2025-11-17 22:10:58 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:56273: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)111.171.125.9418358413>  e?% ossec9710iǒDovecot Auth failed on disconnected session.Nov 17 22:10:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001q=  -o) ossec13001iTExim Auth failed2025-11-17 22:09:39 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:57044: 535 Incorrect authentication data (set_id=bruno)195.142.25.183298795X<  -A# ossec13001iRExim Auth failed2025-11-17 22:09:37 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:35223: 535 Incorrect authentication data (set_id=administrativo1)1.193.163.21814991Q;  --) ossec13001iJExim Auth failed2025-11-17 22:09:29 dovecot_login authenticator failed for (qNvWQUtt0) [213.209.157.84]:49920: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044: W' ossec9708iNDovecot Aborted Login with empty userNov 17 22:09:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{9  -) ossec13001iHExim Auth failed2025-11-17 22:09:27 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:34970: 535 Incorrect authentication data (set_id=andre.nascimento.tech@calcautomacao.com.br)103.251.31.1661269750 tgZM@3& }pcVI</" y l _ R E 8 +    u h [ N A 4 '  ~ q d W J = 0 #  z m ` S F 9 ,    v i \ O B 5 (   reXK>1$ {naTG:- wj]PC6)sfYL?2% |obUH;.!xk^QD7*tgZM@3 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991{ 1814991z 1814991f 1814991b 1814991a 1814991P 1814991J 1814991. 1814991* 1814991$ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991z 1814991i 1814991g 1814991b 1814991a 1814991^ 1814991U 1814991K 1814991I 1814991< 18149913 1814991+ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991j 1814991d 1814991N 1814991F 1814991< 18149918 18149913 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991| 1814991{ 1814991y 1814991x 1814991v 1814991r 1814991k 1814991j 1814991[ 1814991T 1814991S 1814991G 1814991> 18149911 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991| 1814991r 1814991_ 1814991N 1814991E 1814991? 18149917 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991x 1814991j 1814991c 1814991\ 1814991G 1814991D 18149916 18149915 18149914 18149912 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991t 1814991] 1814991W 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991} 1814991c 1814991Q 1814991O 1814991C 18149917 1814991+ 1814991' 1814991# 1814991 1814991 1814991 1814991 1814991 1814991X K < _ U d 5I&>F-VezK+X  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:12:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084gW  -Y) ossec13001iExim Auth failed2025-11-17 22:12:28 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:51958: 535 Incorrect authentication data (set_id=alex.vendas)197.219.210.861036973mV  -g' ossec13001iExim Auth failed2025-11-17 22:12:14 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:50766: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)125.20.251.701269750SU -/) ossec13001iExim Auth failed2025-11-17 22:12:13 dovecot_login authenticator failed for (LBgx516Xbp) [213.209.157.84]:64345: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044T  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034tS  -u' ossec13001iExim Auth failed2025-11-17 22:11:45 dovecot_login authenticator failed for ([60.172.41.103]) [60.172.41.103]:59696: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)60.172.41.1031814991dR  ;E) ossec13008iMail Recipient rejected2025-11-17 22:11:34 H=(localhost) [54.165.171.241]:13945 F= rejected RCPT <94zk8IZxROIAm4o@palestrantexavier.com.br>: Sender verify failed54.165.171.2416252001Q  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034hP  -_% ossec13001iǼExim Auth failed2025-11-17 22:11:24 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:57412: 535 Incorrect authentication data (set_id=contato)34.41.211.486252001+O  e-' ossec9710iǼDovecot Auth failed on disconnected session.Nov 17 22:11:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001mN  -k# ossec13001iǮExim Auth failed2025-11-17 22:11:09 dovecot_login authenticator failed for 111-70-32-9.emome-ip.hinet.net [111.70.32.9]:39990: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)111.70.32.91668284M  -) ossec13001iExim Auth failed2025-11-17 22:12:00 dovecot_login authenticator failed for (201.173.97.119-clientes-izzi.mx) [201.173.97.119]:46200: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)201.173.97.1193996063YL  -C# ossec13001iExim Auth failed2025-11-17 22:11:29 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:37978: 535 Incorrect authentication data (set_id=andre.nascimento)1.180.62.411814991OK -') ossec13001iǾExim Auth failed2025-11-17 22:11:25 dovecot_login authenticator failed for (bLxKiC) [213.209.157.84]:59621: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044tJ  -u' ossec13001iDzExim Auth failed2025-11-17 22:11:14 dovecot_login authenticator failed for ([112.98.177.66]) [112.98.177.66]:51272: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)112.98.177.661814991uI  -u) ossec13001iǔExim Auth failed2025-11-17 22:10:44 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:44861: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)187.50.194.1823469034 (&> $    @M3W(+h  e)+ ossec9710iTDovecot Auth failed on disconnected session.Nov 17 22:13:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841Xg  -?% ossec13001iHExim Auth failed2025-11-17 22:13:44 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:52575: 535 Incorrect authentication data (set_id=fabio.vendas)211.196.31.21835841f W' ossec9708i>Dovecot Aborted Login with empty userNov 17 22:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oe  -k' ossec13001i.Exim Auth failed2025-11-17 22:13:18 dovecot_login authenticator failed for ([14.104.200.38]) [14.104.200.38]:36720: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)14.104.200.381814991Yd  -=) ossec13001i>Exim Auth failed2025-11-17 22:13:33 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:45834: 535 Incorrect authentication data (set_id=contato)125.20.245.1821269750lc  -g% ossec13001i8Exim Auth failed2025-11-17 22:13:28 dovecot_login authenticator failed for ([85.175.81.54]) [85.175.81.54]:55062: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)85.175.81.542017370Nb  -') ossec13001i6Exim Auth failed2025-11-17 22:13:25 dovecot_login authenticator failed for (YpGAOy) [213.209.157.84]:54851: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044/a e5% ossec9710i2Dovecot Auth failed on disconnected session.Nov 17 22:13:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001j`  -]+ ossec13001i&Exim Auth failed2025-11-17 22:13:09 dovecot_login authenticator failed for ([185.129.146.241]) [185.129.146.241]:55980: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)185.129.146.2412017370^_  -G) ossec13001iPExim Auth failed2025-11-17 22:13:52 dovecot_login authenticator failed for ([124.65.160.234]) [124.65.160.234]:45230: 535 Incorrect authentication data (set_id=fabio.vendas)124.65.160.2341814991-^  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:12:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841o]  -k' ossec13001iExim Auth failed2025-11-17 22:12:49 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:47408: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)211.97.119.871814991\  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:12:32 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 3 secs): user=<>, rip=194.164.107.4, lip=200.150.207.122, TLS, session=<2d6NKNRDFrjCpGsE>194.164.107.46252001[ W' ossec9708iDovecot Aborted Login with empty userNov 17 22:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dZ  ;E) ossec13008iMail Recipient rejected2025-11-17 22:12:27 H=(localhost) [54.165.171.241]:17900 F= rejected RCPT : Sender verify failed54.165.171.2416252001VY  -;% ossec13001iExim Auth failed2025-11-17 22:12:26 dovecot_login authenticator failed for ([27.24.141.95]) [27.24.141.95]:48900: 535 Incorrect authentication data (set_id=escritura1)27.24.141.951814991 *5 X 5  - 3w  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:16:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730/v  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:15:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<9zGENNRDHtCB4kCN>129.226.64.1411819730Su -/) ossec13001iȼExim Auth failed2025-11-17 22:15:39 dovecot_login authenticator failed for (ItJRZWv0TT) [213.209.157.84]:62300: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044t W' ossec9708iȶDovecot Aborted Login with empty userNov 17 22:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+s  e)+ ossec9710iȪDovecot Auth failed on disconnected session.Nov 17 22:15:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001r  3C% ossec11301iȠNew FTP connection.Nov 17 22:15:10 hosting pure-ftpd: (?@8.219.79.215) [INFO] New connection from 8.219.79.2158.219.79.2151880251lq  -e' ossec13001iExim Auth failed2025-11-17 22:16:06 dovecot_login authenticator failed for ([218.1.150.242]) [218.1.150.242]:34754: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)218.1.150.2421814991xp  -}' ossec13001ifExim Auth failed2025-11-17 22:14:13 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:42616: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)179.184.33.863469034o  W' ossec9708iȖDovecot Aborted Login with empty userNov 17 22:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.n  e/+ ossec9710iȌDovecot Auth failed on disconnected session.Nov 17 22:14:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<3yC3MNRDDtVns7yS>103.179.188.1461562822,m  e1% ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 22:14:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841l  k' ossec9709izMultiple Dovecot Aborted Logins with empty userNov 17 22:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Yk  -=) ossec13001irExim Auth failed2025-11-17 22:14:25 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:60261: 535 Incorrect authentication data (set_id=contato)187.12.112.1863469034qj  -k+ ossec13001idExim Auth failed2025-11-17 22:14:12 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:56957: 535 Incorrect authentication data (set_id=fabio.vendas)223.197.153.1351819730Ri --) ossec13001ivExim Auth failed2025-11-17 22:14:30 dovecot_login authenticator failed for (dxeKenXA1) [213.209.157.84]:55346: 535 Incorrect authentication data (set_id=bianca)213.209.157.842921044 4  {qt[/#  e) ossec9710i(Dovecot Auth failed on disconnected session.Nov 17 22:17:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<7KkLOtRDwrbSchJs>210.114.18.1081835841(  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:17:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001  W' ossec9708iLDovecot Aborted Login with empty userNov 17 22:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y  -}) ossec13001iIExim Auth failed2025-11-17 22:18:00 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:56191: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)201.160.64.1183996063  k' ossec9709i-Multiple Dovecot Aborted Logins with empty userNov 17 22:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  ;C) ossec13008i+Mail Recipient rejected2025-11-17 22:17:30 H=(localhost) [54.165.171.241]:8099 F= rejected RCPT : Sender verify failed54.165.171.2416252001*  e'+ ossec9710i&Dovecot Auth failed on disconnected session.Nov 17 22:17:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001~ W' ossec9708iDovecot Aborted Login with empty userNov 17 22:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.}  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:16:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044R| --) ossec13001iExim Auth failed2025-11-17 22:16:27 dovecot_login authenticator failed for (VLyQdWTcc) [213.209.157.84]:49750: 535 Incorrect authentication data (set_id=bianca)213.209.157.8429210446{  eC' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:16:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001+z  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:16:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<69DDNdRDWtGB4rs4>129.226.187.561819730`y  -M' ossec13001iExim Auth failed2025-11-17 22:16:56 dovecot_login authenticator failed for (94.19.168.104.pool.sknt.ru) [94.19.168.104]:59386: 535 Incorrect authentication data (set_id=xavier)94.19.168.1042017370dx  ;E) ossec13008iMail Recipient rejected2025-11-17 22:16:38 H=(localhost) [54.165.171.241]:31921 F= rejected RCPT : Sender verify failed54.165.171.2416252001   X> 4  e?' ossec9710i^Dovecot Auth failed on disconnected session.Nov 17 22:18:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651{  -) ossec13001i\Exim Auth failed2025-11-17 22:18:19 dovecot_login authenticator failed for (nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:45540: 535 Incorrect authentication data (set_id=andressa.financeiro)103.251.31.2101269750u  -s+ ossec13001iɅExim Auth failed2025-11-17 22:18:59 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:50168: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)202.179.189.19516430845  e=+ ossec9710inDovecot Auth failed on disconnected session.Nov 17 22:18:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001/  e3) ossec9710i`Dovecot Auth failed on disconnected session.Nov 17 22:18:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<2uZLPdRDsIOkXLll>164.92.185.1012921044 W' ossec9708ihDovecot Aborted Login with empty userNov 17 22:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341  e9' ossec9710ifDovecot Auth failed on disconnected session.Nov 17 22:18:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822"  e% ossec9710ibDovecot Auth failed on disconnected session.Nov 17 22:18:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.22818610601  e?! ossec9710ibDovecot Auth failed on disconnected session.Nov 17 22:18:26 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=41.74.7.89, lip=200.150.196.245, TLS, session=41.74.7.892395170"  e) ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 22:18:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044l  -a+ ossec13001i`Exim Auth failed2025-11-17 22:18:24 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:65482: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651u  -s+ ossec13001i^Exim Auth failed2025-11-17 22:18:21 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51250: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)197.219.228.2421036973P -)) ossec13001iExim Auth failed2025-11-17 22:17:15 dovecot_login authenticator failed for (qhOvTV6) [213.209.157.84]:60759: 535 Incorrect authentication data (set_id=bianca)213.209.157.8429210441  e9' ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 22:17:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<3hJ0OtRDerMrmxBp>43.155.16.1051819730  m y K jfLQ8 S!  -5% ossec13001iExim Auth failed2025-11-17 22:20:31 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:38096: 535 Incorrect authentication data (set_id=contato)12.26.236.106252001)  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:20:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822)  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:20:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w  -{' ossec13001iɩExim Auth failed2025-11-17 22:19:35 dovecot_login authenticator failed for (h178-192-72-56.seed.net.tw) [192.72.56.178]:40279: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)192.72.56.1781668284 W' ossec9708iɥDovecot Aborted Login with empty userNov 17 22:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'  e)# ossec9710iɟDovecot Auth failed on disconnected session.Nov 17 22:19:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<66UJQdRD1p1CYSpH>66.97.42.713865483U  -7' ossec13001iɻExim Auth failed2025-11-17 22:19:53 dovecot_login authenticator failed for ([58.35.120.169]) [58.35.120.169]:18785: 535 Incorrect authentication data (set_id=xavier)58.35.120.1691814991]  -G) ossec13001iɻExim Auth failed2025-11-17 22:19:53 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:39792: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549*  e)) ossec9710iɟDovecot Auth failed on disconnected session.Nov 17 22:19:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251p  -k) ossec13001iɗExim Auth failed2025-11-17 22:19:17 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62675: 535 Incorrect authentication data (set_id=fabio.vendas)50.149.161.13162520011  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:20:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001)  e-# ossec9710iɉDovecot Auth failed on disconnected session.Nov 17 22:19:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001-  e/) ossec9710iɁDovecot Auth failed on disconnected session.Nov 17 22:18:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750  l58//  e1+ ossec9710iKDovecot Auth failed on disconnected session.Nov 17 22:22:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001f.  -Y' ossec13001iCExim Auth failed2025-11-17 22:22:09 dovecot_login authenticator failed for ([39.129.87.182]) [39.129.87.182]:48214: 535 Incorrect authentication data (set_id=envios@comercial.art.br)39.129.87.18218149919-  eG) ossec9710iADovecot Auth failed on disconnected session.Nov 17 22:22:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697505, e=) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:21:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<9Xt2SNRD8pWkXLll>164.92.185.1012921044a+  -O' ossec13001iExim Auth failed2025-11-17 22:21:23 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:54846: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730c*  -O+ ossec13001iExim Auth failed2025-11-17 22:21:10 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:23558: 535 Incorrect authentication data (set_id=contato)128.199.118.2341880251-)  e/) ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 22:21:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.10818358413(  e?% ossec9710i'Dovecot Auth failed on disconnected session.Nov 17 22:21:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382' W' ossec9708iDovecot Aborted Login with empty userNov 17 22:21:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,&  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:20:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084%  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q$  -k+ ossec13001iExim Auth failed2025-11-17 22:20:15 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:60276: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)120.157.221.14920774562#  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:20:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822x"  -% ossec13001iExim Auth failed2025-11-17 22:20:48 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:52987: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)65.181.79.601819730   "X? .=  e5% ossec9710iʵDovecot Auth failed on disconnected session.Nov 17 22:24:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841<  W' ossec9708iʳDovecot Aborted Login with empty userNov 17 22:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<13StUdRD+pyxV3kv>177.87.121.4734690342;  e7+ ossec9710iʡDovecot Auth failed on disconnected session.Nov 17 22:23:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001:  k' ossec9709iʕMultiple Dovecot Aborted Logins with empty userNov 17 22:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903409  e5) ossec9710iʋDovecot Auth failed on disconnected session.Nov 17 22:23:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044.8  e1) ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 22:23:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730Y7  -=) ossec13001iyExim Auth failed2025-11-17 22:23:03 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:50306: 535 Incorrect authentication data (set_id=contato)121.73.163.2502186224*6  e)) ossec9710iwDovecot Auth failed on disconnected session.Nov 17 22:23:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841X5  -;) ossec13001iuExim Auth failed2025-11-17 22:23:00 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:36687: 535 Incorrect authentication data (set_id=envios)86.102.254.1982017370f4  -[% ossec13001ieExim Auth failed2025-11-17 22:22:44 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:35087: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)61.72.58.2421835841k3  -c' ossec13001iWExim Auth failed2025-11-17 22:22:30 dovecot_login authenticator failed for ([121.73.163.22]) [121.73.163.22]:47982: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)121.73.163.222186224a2  -K+ ossec13001iqExim Auth failed2025-11-17 22:22:56 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51991: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034&1  e!) ossec9710ikDovecot Auth failed on disconnected session.Nov 17 22:22:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<7a0sTdRDaIOl0iHB>165.210.33.19322333870 W' ossec9708iYDovecot Aborted Login with empty userNov 17 22:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 6252001f 6252001e 6252001c 6252001\ 6252001V 6252001Q 6252001L 6252001I 62520018 6252001/ 6252001- 6252001, 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001y 6252001u 6252001s 6252001b 6252001^ 6252001Z 6252001S 6252001O 6252001F 6252001A 6252001? 62520012 62520011 6252001# 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001  6252001 r 6252001 p 6252001 h 6252001 d 6252001 Y 6252001 Q 6252001 < 6252001 4 6252001 # 6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 ~ 6252001 e 6252001 \ 6252001 K 6252001 + 6252001 & 6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 z 6252001 v 6252001 o 6252001 k 6252001 ] 6252001 \ 6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 i 6252001 c 6252001 _ 6252001 U 6252001 L 6252001 E 6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001  6252001 } 6252001 z 6252001 d 6252001 X 6252001 L 6252001 G 6252001 E 6252001 ? 6252001 / 6252001  6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001l 6252001e 6252001` 6252001^ 6252001\ 6252001; 6252001( 6252001& 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001[ 6252001Y 6252001P 6252001E 62520018 62520011 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001x 6252001r 6252001_ 6252001W 6252001B 6252001: 6252001" 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001L 6252001K 6252001/ 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001z 6252001w 6252001p 6252001o 6252001K 6252001: 6252001' - } O [+sY-(J  e+# ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:25:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483I W' ossec9708i Dovecot Aborted Login with empty userNov 17 22:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034H W' ossec9708iDovecot Aborted Login with empty userNov 17 22:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%G  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:24:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.15.171.93, lip=200.150.196.245, TLS, session=<6eYYUtRDHp65D6td>185.15.171.9331753953F  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:24:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<8J1zUtRDiM1ns7yS>103.179.188.1461562822:E  eK' ossec9710iʹDovecot Auth failed on disconnected session.Nov 17 22:24:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.232.65.142, lip=200.150.196.245, TLS, session=45.232.65.1423469034,D  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:25:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<7oUUVdRDFKWd5hjP>157.230.24.2072921044pC  -i+ ossec13001iʩExim Auth failed2025-11-17 22:23:51 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:39403: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)220.189.196.1341814991*B  e)) ossec9710iʕDovecot Auth failed on disconnected session.Nov 17 22:23:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001+A  e/% ossec9710iʑDovecot Auth failed on disconnected session.Nov 17 22:23:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<1mWGT9RDJspzR+4E>115.71.238.418358413@  e;) ossec9710iʍDovecot Auth failed on disconnected session.Nov 17 22:23:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730j?  -a' ossec13001iʃExim Auth failed2025-11-17 22:23:15 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:57012: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)121.73.167.152186224+>  e++ ossec9710iʫDovecot Auth failed on disconnected session.Nov 17 22:23:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758  Q  +X W' ossec9708i˅Dovecot Aborted Login with empty userNov 17 22:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034SW  -5% ossec13001iwExim Auth failed2025-11-17 22:27:19 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:23741: 535 Incorrect authentication data (set_id=eliezer)203.252.10.31835841dV  -U' ossec13001iSExim Auth failed2025-11-17 22:26:42 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:42016: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)103.161.93.531269750U  k' ossec9709iIMultiple Dovecot Aborted Logins with empty userNov 17 22:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|T  - # ossec13001iCExim Auth failed2025-11-17 22:26:26 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:34003: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)187.8.64.943469034bS -K+ ossec13001i3Exim Auth failed2025-11-17 22:26:11 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51945: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034R  W' ossec9708igDovecot Aborted Login with empty userNov 17 22:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/Q  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:25:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001fP  -U+ ossec13001iExim Auth failed2025-11-17 22:25:17 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52099: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.14134690348O  eG' ossec9710i'Dovecot Auth failed on disconnected session.Nov 17 22:25:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084,N  e/' ossec9710i#Dovecot Auth failed on disconnected session.Nov 17 22:25:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001-M  e1' ossec9710i!Dovecot Auth failed on disconnected session.Nov 17 22:25:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867L  e# ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:25:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750*K  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:25:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991 0   $ :  0<1?Dc;0h  -' ossec13001iExim Auth failed2025-11-17 22:29:08 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:55544: 535 Incorrect authentication data (set_id=envios@comercial.art.br)110.227.252.21269750$g  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:30:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758]f  -E) ossec13001iExim Auth failed2025-11-17 22:29:26 dovecot_login authenticator failed for ([112.102.199.89]) [112.102.199.89]:54890: 535 Incorrect authentication data (set_id=presidencia)112.102.199.891814991we  -y) ossec13001iExim Auth failed2025-11-17 22:29:21 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:52450: 535 Incorrect authentication data (set_id=envios)92.255.196.1852017370nd  -g) ossec13001iExim Auth failed2025-11-17 22:29:19 dovecot_login authenticator failed for ([116.234.68.221]) [116.234.68.221]:63366: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)116.234.68.2211814991dc  ;E) ossec13008iMail Recipient rejected2025-11-17 22:29:08 H=(localhost) [54.165.171.241]:50436 F= rejected RCPT <5tk0BKniPZdeZjp@palestrantexavier.com.br>: Sender verify failed54.165.171.2416252001b  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Va  -9' ossec13001iExim Auth failed2025-11-17 22:29:30 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:45405: 535 Incorrect authentication data (set_id=rodrigo)5.142.196.1852017370` W' ossec9708iDovecot Aborted Login with empty userNov 17 22:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3DXDYdRDasSxV3kv>177.87.121.473469034j_  -c% ossec13001i˳Exim Auth failed2025-11-17 22:28:19 dovecot_login authenticator failed for ([111.26.62.45]) [111.26.62.46]:48014: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)111.26.62.461814991^ -;' ossec13001iExim Auth failed2025-11-17 22:28:56 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:63653: 535 Incorrect authentication data (set_id=orcamento@htmsolucoesindustriais.com.br)189.31.138.383469034f]  -U+ ossec13001iExim Auth failed2025-11-17 22:28:53 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51610: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034n\  -e+ ossec13001iExim Auth failed2025-11-17 22:28:49 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:47604: 535 Incorrect authentication data (set_id=misterthomas)185.183.103.1212635167[  -) ossec13001iExim Auth failed2025-11-17 22:28:43 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:43312: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)37.235.140.1632017370jZ  -c% ossec13001iExim Auth failed2025-11-17 22:28:37 dovecot_login authenticator failed for ([111.26.62.42]) [111.26.62.42]:57238: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)111.26.62.421814991pY  -k) ossec13001iˡExim Auth failed2025-11-17 22:28:00 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:34948: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)121.73.169.1672186224 : $  aG<JcqX0:rx  -o) ossec13001i̪Exim Auth failed2025-11-17 22:32:26 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:51839: 535 Incorrect authentication data (set_id=financeiro@quintalbrincante.com.br)193.169.28.2442017370$w  e+ ossec9710i̘Dovecot Auth failed on disconnected session.Nov 17 22:32:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1pZ0btRDourBl4nP>193.151.137.207130758v  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9xXecdRDYOexV3kv>177.87.121.473469034nu  -i' ossec13001iExim Auth failed2025-11-17 22:32:47 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:40538: 535 Incorrect authentication data (set_id=contato)125.20.251.661269750ct  -U% ossec13001i̺Exim Auth failed2025-11-17 22:32:42 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [182.72.143.2]:35080: 535 Incorrect authentication data (set_id=financeiro)182.72.143.21269750ns  -o% ossec13001įExim Auth failed2025-11-17 22:32:23 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:55689: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)65.20.250.6399237r  -+ ossec13001i̤Exim Auth failed2025-11-17 22:32:19 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34216: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.net)188.219.104.2103175395q W' ossec9708itDovecot Aborted Login with empty userNov 17 22:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<++h3bNRDmrWxV3kv>177.87.121.473469034p  ?5 ossec1008ĭProcess exiting (killed).Nov 17 22:31:49 hosting spamd[15082]: spamd: server killed by SIGTERM, shutting downio  -]) ossec13001i7Exim Auth failed2025-11-17 22:30:30 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:42824: 535 Incorrect authentication data (set_id=contato)177.61.176.1103469034$n  e## ossec9710i3Dovecot Auth failed on disconnected session.Nov 17 22:30:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750km  -a) ossec13001i'Exim Auth failed2025-11-17 22:30:14 dovecot_login authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:63484: 535 Incorrect authentication data (set_id=contato)219.76.188.1801819730l W' ossec9708i9Dovecot Aborted Login with empty userNov 17 22:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dj  -[# ossec13001iExim Auth failed2025-11-17 22:29:53 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:47653: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)5.32.22.218290557pi  -k) ossec13001iExim Auth failed2025-11-17 22:29:09 dovecot_login authenticator failed for ([112.102.48.129]) [112.102.48.129]:41436: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)112.102.48.1291814991   ' D  9 Y  -;+ ossec13001iExim Auth failed2025-11-17 22:34:11 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:59364: 535 Incorrect authentication data (set_id=bqtz)208.180.252.1836252001d  ;E) ossec13008iMail Recipient rejected2025-11-17 22:34:08 H=(localhost) [54.165.171.241]:14424 F= rejected RCPT : Sender verify failed54.165.171.2416252001-  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:34:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730,  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:33:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730c  -O+ ossec13001iExim Auth failed2025-11-17 22:33:54 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:39622: 535 Incorrect authentication data (set_id=bqtz@iemif.com)125.139.124.1201835841j  -]+ ossec13001iExim Auth failed2025-11-17 22:33:38 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:42095: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)190.143.133.1263595528y  -}) ossec13001iExim Auth failed2025-11-17 22:33:16 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:55554: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)116.171.27.24818149915  e?) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:33:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<4SxvctRDkr2l0xnK>165.211.25.2022233387_  -M% ossec13001iExim Auth failed2025-11-17 22:34:00 dovecot_login authenticator failed for ([95.79.57.221]) [95.79.57.221]:57566: 535 Incorrect authentication data (set_id=andressa.financeiro)95.79.57.2212017370h~  -_% ossec13001iExim Auth failed2025-11-17 22:34:06 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:40585: 535 Incorrect authentication data (set_id=memaagostinho)111.70.8.1431668284Y}  -?' ossec13001iExim Auth failed2025-11-17 22:33:58 dovecot_login authenticator failed for ([182.95.57.158]) [182.95.57.158]:50210: 535 Incorrect authentication data (set_id=marialuiza)182.95.57.1581269750i|  -c% ossec13001iExim Auth failed2025-11-17 22:33:50 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:56315: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)94.200.20.66290557{ W' ossec9708iDovecot Aborted Login with empty userNov 17 22:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<49Cfc9RDmoyxV3kv>177.87.121.473469034bz  -O) ossec13001i̸Exim Auth failed2025-11-17 22:32:39 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:46378: 535 Incorrect authentication data (set_id=desenvolvimento2)220.93.167.1441835841y  k' ossec9709ḭMultiple Dovecot Aborted Logins with empty userNov 17 22:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  ^1.*  e+' ossec9710i͡Dovecot Auth failed on disconnected session.Nov 17 22:36:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.11015628220  e5+ ossec9710i͕Dovecot Auth failed on disconnected session.Nov 17 22:36:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758f  -U+ ossec13001iͫExim Auth failed2025-11-17 22:36:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51797: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034%  e#% ossec9710i͹Dovecot Auth failed on disconnected session.Nov 17 22:36:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.5920173704  e?' ossec9710i͊Dovecot Auth failed on disconnected session.Nov 17 22:36:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651N  -/% ossec13001iͧExim Auth failed2025-11-17 22:36:38 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:56664: 535 Incorrect authentication data (set_id=edna)65.20.250.6399237-  e1' ossec9710i͓Dovecot Auth failed on disconnected session.Nov 17 22:36:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001)  e+% ossec9710inDovecot Auth failed on disconnected session.Nov 17 22:35:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841  k' ossec9709ieMultiple Dovecot Aborted Logins with empty userNov 17 22:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708i͂Dovecot Aborted Login with empty userNov 17 22:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -]+ ossec13001izExim Auth failed2025-11-17 22:35:53 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:58100: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)219.152.206.1551814991-  e5# ossec9710ivDovecot Auth failed on disconnected session.Nov 17 22:35:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730)  e)' ossec9710iADovecot Auth failed on disconnected session.Nov 17 22:34:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841 W' ossec9708i(Dovecot Aborted Login with empty userNov 17 22:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+Jg6d9RDKrGxV3kv>177.87.121.473469034   e7o#  -k' ossec13001iExim Auth failed2025-11-17 22:38:03 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:58180: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)37.28.177.1412017370)"  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:38:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044+!  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:37:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456*  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:37:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<9NUEg9RD3LRxoZB3>113.161.144.1191562822-  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:37:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197300  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:37:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001 W' ossec9708iDovecot Aborted Login with empty userNov 17 22:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034& e%% ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:37:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<9zEqgdRDhtvBHmEh>193.30.97.33272103\  -I% ossec13001iͫExim Auth failed2025-11-17 22:36:41 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51037: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758e  -W' ossec13001i͓Exim Auth failed2025-11-17 22:36:17 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:40810: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)182.95.224.621269750,  e-) ossec9710i͏Dovecot Auth failed on disconnected session.Nov 17 22:36:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750V  -9' ossec13001i͍Exim Auth failed2025-11-17 22:36:11 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:60882: 535 Incorrect authentication data (set_id=eliezer)14.37.206.1361835841 -# ossec13001iͩExim Auth failed2025-11-17 22:36:40 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:38571: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)187.93.2.863469034 W' ossec9708i͡Dovecot Aborted Login with empty userNov 17 22:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 5! oLolO52 W' ossec9708iΑDovecot Aborted Login with empty userNov 17 22:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341  W' ossec9708ikDovecot Aborted Login with empty userNov 17 22:39:54 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.79, lip=191.243.196.56, TLS, session=87.236.176.792635167&0  e%% ossec9710i_Dovecot Auth failed on disconnected session.Nov 17 22:39:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<4D2RidRDyOwIiXsk>8.137.123.361814991/ W' ossec9708iUDovecot Aborted Login with empty userNov 17 22:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d.  ;E) ossec13008i=Mail Recipient rejected2025-11-17 22:39:08 H=(localhost) [54.165.171.241]:32209 F= rejected RCPT : Sender verify failed54.165.171.2416252001e-  -U+ ossec13001iuExim Auth failed2025-11-17 22:40:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:49201: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795j,  -e# ossec13001i)Exim Auth failed2025-11-17 22:38:48 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61410: 535 Incorrect authentication data (set_id=assessoria)70.120.1.746252001Y+  -C% ossec13001iExim Auth failed2025-11-17 22:38:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53540: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758*  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-)  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:38:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867(  W' ossec9708i7Dovecot Aborted Login with empty userNov 17 22:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340'  e5) ossec9710i7Dovecot Auth failed on disconnected session.Nov 17 22:39:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730v&  -u+ ossec13001i!Exim Auth failed2025-11-17 22:38:39 dovecot_login authenticator failed for ([183.167.198.120]) [183.167.198.120]:48981: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)183.167.198.12018149916%  e?+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:38:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<77R6hdRDjO1ns7yS>103.179.188.1461562822[$  -C' ossec13001iExim Auth failed2025-11-17 22:38:23 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:48218: 535 Incorrect authentication data (set_id=fabio.vendas)58.57.154.1461814991 ^ $ ; @ z^3A  e=' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:42:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<3hJXlNRD8MhSnOdL>82.156.231.751814991@ W' ossec9708i Dovecot Aborted Login with empty userNov 17 22:42:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\?  -G% ossec13001iExim Auth failed2025-11-17 22:42:08 dovecot_login authenticator failed for ([123.121.0.32]) [123.121.0.32]:59940: 535 Incorrect authentication data (set_id=ieqcampocomprido)123.121.0.321814991g>  -[) ossec13001i+Exim Auth failed2025-11-17 22:43:06 dovecot_login authenticator failed for ([87.200.226.113]) [87.200.226.113]:56958: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)87.200.226.113290557,=  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:42:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991*<  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:41:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044;  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034:  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(9  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:41:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001w8  -y) ossec13001iExim Auth failed2025-11-17 22:41:52 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:49974: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)197.219.210.861036973e7  -W' ossec13001iExim Auth failed2025-11-17 22:41:51 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:50040: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)125.142.39.131835841O6  -/% ossec13001iΉExim Auth failed2025-11-17 22:40:23 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:61850: 535 Incorrect authentication data (set_id=maia)41.220.3.101226074j5  -_) ossec13001iExim Auth failed2025-11-17 22:40:13 dovecot_login authenticator failed for ([178.70.232.110]) [178.70.232.110]:51938: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)178.70.232.1102017370e4  -S+ ossec13001iΝExim Auth failed2025-11-17 22:40:43 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64923: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651.3  e/+ ossec9710iΗDovecot Auth failed on disconnected session.Nov 17 22:40:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z H p > f \ R  4 * vlbXND:0&rhJ^@6|T,"dZPF<n2x( Lj`Vt~B8.$pfz\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& ir i` iR ir ip in i> i, i" i i i i i i i i iў iі iѾ iѼ iѴ iѰ iѮ iц iј iє iш iњ iѮ i~ iv it ib i` iт i i= i9 i1 i1 i  i iA i& i" i i i i i i i i i  i i i i i~ i} iЩ| iе{ iЗz iнy iНx iw iнv iЭu iХt is iеr iгq iqp imo i_n iЍm ikl i_k iYj i{i iyh iug if ie iSd iSc iEb i=a i3` i!_ iU^ iS] i=\ i5[ iZ iY iX iW iV iU iT iϽS iϻR iϫQ iϛP iρO iρN iuM ioL ikK iϟJ i;I i[H iIG i;F iSE iGD iEC iCB iA i @ i? i+> i= i< i; i: i9 i8 i7 iΝ4 iΗ3 iΑ2 iΉ6 i5 iu- ik1 i_0 iU/ i=. i7( i7' i), i!& i+ i% i* i$ i) i# i" i! i i i i i i͹ iͫ iͫ iͩ iͧ i͡ i͡ i͕ i͓ i͓ i͏ i͍ i i iӸ iӲ iӰ iӨ iӂ i~ if iR iF iB i6 i4 i0 i, i* i( i$ i$ i  i i i i i i i i i i i iҼ iҺ iҸ iҲ iҤ iҚ iҒ iҎ iz ix it i͊ i͂ iz iv in ie iA i( i i i i i i i i i i i i i i i i̺ i̸ ḭ i̪ į i̤ i̘ ĭ it i9 i7 i3 i' i i i i i i i i i i i i i i i i i i i˳ iˡ i˅ iw ig iS iI iC i3 i' i# i! i i i i  i i i i i i iʹ iʵ iʳ iʫ iʩ iʡ iʕ iʕ iʑ f0"rvi4' ~qdWJ=0#  C 6 )    s f Y L ? 2 %  | b U H . !  x k ^ Q D 7 *    J=0 ? 2 %  |obUH;.{naTG:-  w j ] P+8l_Ry}pcVIYL?2% </E o!\OB5(~qdWuh[NA s f Y Lym`SF9, 1835841. 1835841. 1835841. 1880251 1880251r 1880251$ 1880251 1880251 1880251" 1835841+ 1835841+f 1835841+` 1835841+Y 1835841+O 1835841+K 1835841+1 1835841+& 1835841+% 1835841+ 1835841* 1835841* 1880251S 1880251 1880251) 1880251 1880251 1880251 1880251~ 1880251 18802517 1880251 1880251 1880251 1880251g 1880251 1835841+ 1861060,; 1861060 1861060I 1861060c 1861060 1861060, 1861060} 18610601 1861060 1861060{ 1861060 1861060 1861060! 1861060 1861060 ! 1861060 1861060" 1861060! 1861060!b 1861060!Y 1861060!J 1835841* 1835841*q 1861060+ 1861060* 1861060% 1861060%/ 1861060$I 1861060# 1861060" 1861060" 1861060" 1861060*s 1835841* 1861060) 1835841* 1880251R 1880251 1880251 1861060)l 1861060)+ 1861060( 1861060( 1861060(> 1861060( 1861060'L 1861060& 1835841* 1835841* 1880251g 1880251\ 1880251 1880251  1880251 = 1880251 1880251 1880251 1880251 1880251 1880251 A 1880251 1880251 1880251 1880251 1880251 1880251 1835841* 1835841* 1835841+ 1835841+ j 1835841/ 1835841/ 1861060/ 1835841/ 1835841/ 1835841/ 1835841/ 1835841/ 1835841/ 1835841/~ 1835841/s 1835841/q 1835841/k 1835841/S 1835841/4 1835841/! 1861060/ 1861060/ 1835841. 1835841. 1835841. 1835841. 1835841. 1835841. 1835841. 1880251!H 1880251 x 1880251 " 1880251 1880251 1880251 1880251 1880251= 1880251' 1880251 1880251 18802513 1880251 1835841. 1835841. 1835841. 1835841. 1835841.~ 1835841.o 1835841.a 1835841.^ 1835841.V 1835841.T 1835841.H 1835841.D 1835841.8 1835841.( 1835841.$ 1835841. 1835841. 1835841. 1835841. 1835841.  1835841. ; 1835841- 1835841- 1835841- 1835841- 1835841- 1861060- 1835841- 1835841- 1835841- 1861060- 1835841-u 1861060-m 1835841-j 1835841-i 1835841-\ 1835841-H 1835841-E 1835841-7 1835841-. 1835841-- 1835841-" 1835841- 1835841- 1835841, 1861060, 1835841, 1835841, 1835841, 1835841, 1835841, 1835841, 1835841,l 1835841,g 1835841,c 1835841,_ 1835841,G 1861060 1861060$ 1861060 1861060 18610608 1861060 1861060G 1861060 1861060 1861060 1861060 1861060 1861060+ 1861060o 1861060> 1861060 1861060 18610605 1861060 1861060 1861060 1861060 1861060 & 1861060  1861060 0 1861060 1861060 1861060Z 1861060w 1861060 1835841,@ 1835841,- 1835841,+ 1835841, 1835841, 1835841, 1835841, 1835841, 1835841, 1835841, 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+  jQn9xO  -}' ossec13001iρExim Auth failed2025-11-17 22:44:33 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:56396: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)123.194.136.31668284N  k' ossec9709iρMultiple Dovecot Aborted Logins with empty userNov 17 22:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344M  e?' ossec9710iuDovecot Auth failed on disconnected session.Nov 17 22:44:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.20462520011L  e;% ossec9710ioDovecot Auth failed on disconnected session.Nov 17 22:44:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991_K -G) ossec13001ikExim Auth failed2025-11-17 22:44:10 dovecot_login authenticator failed for (User) [177.74.174.120]:56799: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)177.74.174.1203469034J  W' ossec9708iϟDovecot Aborted Login with empty userNov 17 22:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341I  e;' ossec9710i;Dovecot Auth failed on disconnected session.Nov 17 22:43:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758_H -G) ossec13001i[Exim Auth failed2025-11-17 22:43:54 dovecot_login authenticator failed for (User) [177.74.174.120]:56799: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)177.74.174.1203469034(G  e#+ ossec9710iIDovecot Auth failed on disconnected session.Nov 17 22:43:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<4Y5tl9RD8qqElIx5>132.148.140.1216252001(F  e+# ossec9710i;Dovecot Auth failed on disconnected session.Nov 17 22:43:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001ZE  -E# ossec13001iSExim Auth failed2025-11-17 22:43:46 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:35762: 535 Incorrect authentication data (set_id=secretarioadjunto)24.121.1.616252001:D  eG+ ossec9710iGDovecot Auth failed on disconnected session.Nov 17 22:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001C W' ossec9708iEDovecot Aborted Login with empty userNov 17 22:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lB  -e' ossec13001iCExim Auth failed2025-11-17 22:43:31 dovecot_login authenticator failed for ([111.26.100.98]) [111.26.100.99]:53296: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)111.26.100.991814991   g^  -Y) ossec13001iUExim Auth failed2025-11-17 22:48:04 dovecot_login authenticator failed for ([92.124.148.205]) [92.124.148.205]:41434: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)92.124.148.2052017370$]  e' ossec9710iSDovecot Auth failed on disconnected session.Nov 17 22:48:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001Y\  -=) ossec13001i=Exim Auth failed2025-11-17 22:47:41 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:55860: 535 Incorrect authentication data (set_id=contato)121.73.163.1812186224[  k' ossec9709i5Multiple Dovecot Aborted Logins with empty userNov 17 22:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(Z  e+# ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:46:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750Y W' ossec9708iDovecot Aborted Login with empty userNov 17 22:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034XX  -=) ossec13001iExim Auth failed2025-11-17 22:46:29 dovecot_login authenticator failed for ([87.200.210.137]) [87.200.210.137]:50653: 535 Incorrect authentication data (set_id=contato)87.200.210.137290557-W  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:46:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750kV  -_+ ossec13001iExim Auth failed2025-11-17 22:46:05 dovecot_login authenticator failed for (166-135.adsl.static.espeed.com.bn) [119.160.135.166]:54258: 535 Incorrect authentication data (set_id=rafael)119.160.135.1661820814oU  -i) ossec13001iExim Auth failed2025-11-17 22:46:02 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:38745: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)189.109.154.543469034VT  -?% ossec13001iExim Auth failed2025-11-17 22:45:44 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:45860: 535 Incorrect authentication data (set_id=fabio.vendas)65.20.150.3699237S W' ossec9708iϽDovecot Aborted Login with empty userNov 17 22:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{R  -' ossec13001iϻExim Auth failed2025-11-17 22:45:31 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:48759: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)87.103.126.542264397lQ  -c) ossec13001iϫExim Auth failed2025-11-17 22:45:14 dovecot_login authenticator failed for ([219.128.55.182]) [219.128.55.182]:48526: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)219.128.55.1821814991"P  e' ossec9710iϛDovecot Auth failed on disconnected session.Nov 17 22:44:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991 e1X3t*D.|ob L ?  ] G $ w j P C 6 )   s f Y X K > 1  2 %  vi\OB5(re>1 dWJ=0# @&  { n a T : -   qK;!xk^QgZ7HMU~qdWJ=0# zm`SF9,~ zm`SF9, G.Dt*  r e ?|ob 2017370( 2017370( 2017370- 2017370!R 2017370( 2017370(S 2017370(L 2017370( 2017370' 2017370!X 2017370' 2017370!k 2017370' 2017370' 2017370' 2017370' 2017370' 2017370' 2017370! 2017370' 2017370'u 2017370'g 2017370'U 2017370'M 2017370'/ 2017370'. 2017370'" 2017370' 2017370& 2017370& 2017370& 2017370- 2017370& 2017370& 2017370& 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 C 2077456 T 2077456 2077456 2077456 2077456N 2077456 2077456{ 2077456` 2077456 2077456 2077456 2077456B 2077456 2077456g 2077456 2077456 2077456( 2077456 2077456 2077456 2077456 2077456@ 2029969 2017370+ 2017370+ 2017370* 2029969* 2017370* 2017370* 2017370* 2017370* 2017370! 2017370* 2017370! 2017370*H 2017370/ 2017370/v 2017370/m 2017370! 2017370/) 2017370/( 2017370/% 2017370/$ 2017370/ 2017370. 2017370. 2017370. 2017370. 2017370/_ 2017370/O 2017370/I 2017370/; 2017370! 2017370/z 2017370! 2017370. 2017370. 2017370.p 2017370.] 2017370! 2017370.N 2017370! 2017370.7 2017370. 2017370- 2017370- 2017370" 2017370- 2017370- 2017370- 2017370- 2017370- 2017370" 2017370- 2017370/ 2017370/ 2017370# 2017370#m 2017370#U 2017370#B 2017370# 2017370" 2017370" 2017370" 2017370" 2017370"w 2017370"u 2017370". 2017370& 2017370& 2017370& 2017370& 2017370& 2017370# 2017370# 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370%t 2017370%E 2017370%3 2017370%- 2017370# 2017370% 2017370% 2017370# 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370# 2017370$ 2017370$ 2017370$q 2017370+ 2017370*' 2017370+H 2017370$[ 2017370+\ 2017370) 2017370) 2017370, 2017370,z 2017370,v 2017370,\ 2017370,X 2017370,S 2017370,L 2017370$d 2017370, 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+t 2017370( 2017370&k 2017370&e 2017370&b 2017370&^ 2017370$i 2017370&- 2017370&, 2017370& 2017370% 2017370/ 2077456 20774566 2077456 2077456 2077456 2077456 2077456N 2077456J 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2017370) 2017370) 2017370)3 2017370), 2017370)( 2017370)# 2017370) 2017370- 2077456 2077456 2077456d 2077456! 2077456 2077456 2077456 2077456P 20774565 2017370) 8 n qAVf:&8jl  -a' ossec13001ikExim Auth failed2025-11-17 22:48:27 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:48640: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)75.108.42.2416252001ok  -g+ ossec13001i_Exim Auth failed2025-11-17 22:48:15 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:49076: 535 Incorrect authentication data (set_id=marialuiza)119.160.166.2371820814tj  -y% ossec13001iYExim Auth failed2025-11-17 22:48:08 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:45330: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)46.10.56.170732800%i  e!' ossec9710i{Dovecot Auth failed on disconnected session.Nov 17 22:48:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822(h  e'' ossec9710iyDovecot Auth failed on disconnected session.Nov 17 22:48:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.1446252001lg  -c) ossec13001iuExim Auth failed2025-11-17 22:48:36 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:34196: 535 Incorrect authentication data (set_id=alex.vendas)118.200.42.1121880251gf  -Y) ossec13001iExim Auth failed2025-11-17 22:47:09 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:50324: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)128.185.242.741269750,e  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:47:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841yd  -{+ ossec13001iSExim Auth failed2025-11-17 22:48:02 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:35086: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)120.157.221.1492077456c  W' ossec9708iSDovecot Aborted Login with empty userNov 17 22:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'b  e#) ossec9710iEDovecot Auth failed on disconnected session.Nov 17 22:47:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<1sKPptRD3Ll2wSaf>118.193.38.1591819730ga -U+ ossec13001i=Exim Auth failed2025-11-17 22:47:40 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51574: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.14134690347`  eE' ossec9710i3Dovecot Auth failed on disconnected session.Nov 17 22:47:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<2BNwpdRDzMGdQi/y>157.66.47.2421562822$_  e## ossec9710i!Dovecot Auth failed on disconnected session.Nov 17 22:47:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<8KdipNRD5qgrZDwA>43.100.60.01819730  c{  -U' ossec13001iеExim Auth failed2025-11-17 22:49:41 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:49689: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795kz  -_+ ossec13001iЗExim Auth failed2025-11-17 22:49:10 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57358: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651-y  e-+ ossec9710iнDovecot Auth failed on disconnected session.Nov 17 22:49:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841Yx  -=) ossec13001iНExim Auth failed2025-11-17 22:49:16 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:41242: 535 Incorrect authentication data (set_id=eduardo)103.147.248.441269750xw  -% ossec13001iExim Auth failed2025-11-17 22:49:52 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42502: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)81.16.164.762661886_v -G) ossec13001iнExim Auth failed2025-11-17 22:49:48 dovecot_login authenticator failed for (User) [177.74.174.120]:59347: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)177.74.174.1203469034u W' ossec9708iЭDovecot Aborted Login with empty userNov 17 22:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nt  -m# ossec13001iХExim Auth failed2025-11-17 22:49:25 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:46132: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)180.71.9.311835841Vs  -;% ossec13001iExim Auth failed2025-11-17 22:50:07 dovecot_login authenticator failed for ([58.37.100.53]) [58.37.100.53]:55686: 535 Incorrect authentication data (set_id=financeiro)58.37.100.531814991(r  e)% ossec9710iеDovecot Auth failed on disconnected session.Nov 17 22:49:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<3fdGrdRDmtZvAEul>111.0.75.1651814991Xq  -A# ossec13001iгExim Auth failed2025-11-17 22:49:38 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:38463: 535 Incorrect authentication data (set_id=administrativo1)1.193.163.21814991p W' ossec9708iqDovecot Aborted Login with empty userNov 17 22:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)o  e+% ossec9710imDovecot Auth failed on disconnected session.Nov 17 22:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841yn  -' ossec13001i_Exim Auth failed2025-11-17 22:48:15 dovecot_login authenticator failed for (109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:49224: 535 Incorrect authentication data (set_id=adriana)109.195.29.5720173700m  e9% ossec9710iЍDovecot Auth failed on disconnected session.Nov 17 22:49:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001 W ~ e>X?JT(QWv  -y' ossec13001iExim Auth failed2025-11-17 22:51:03 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:54601: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)69.126.144.306252001S  -5% ossec13001iExim Auth failed2025-11-17 22:50:50 dovecot_login authenticator failed for ([162.243.8.74]) [162.243.8.74]:47146: 535 Incorrect authentication data (set_id=contato)162.243.8.746252001(  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:50:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001r  -s% ossec13001iExim Auth failed2025-11-17 22:50:30 dovecot_login authenticator failed for (ip28.net52.ivn.ttksever.ru) [46.160.52.28]:54764: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)46.160.52.2820173701  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:50:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.167.193.127, lip=200.150.196.245, TLS, session=<3kCtrtRDjNS3p8F/>183.167.193.1271814991<  -) ossec13001iExim Auth failed2025-11-17 22:50:21 dovecot_login authenticator failed for (User) [177.74.174.120]:59347: 535 Incorrect authentication data177.74.174.1203469034  W' ossec9708iDovecot Aborted Login with empty userNov 17 22:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b  -O) ossec13001i Exim Auth failed2025-11-17 22:51:05 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:56446: 535 Incorrect authentication data (set_id=ieqcampocomprido)125.23.203.1141269750#  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:50:52 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=203.198.173.145, lip=200.150.196.245, TLS, session=<+49GsNRDC43Lxq2R>203.198.173.14518197304  eC# ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:50:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<4ccmsdRD+MpCYSpH>66.97.42.713865483j  -c% ossec13001iExim Auth failed2025-11-17 22:50:32 dovecot_login authenticator failed for (ws6-94.maryno.net) [188.244.6.94]:55306: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)188.244.6.942017370o  -k' ossec13001iExim Auth failed2025-11-17 22:51:01 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:43408: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)213.234.8.1142017370~  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340}  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:50:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387'|  e#) ossec9710iЩDovecot Auth failed on disconnected session.Nov 17 22:49:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750 S G -   ~S'  e#) ossec9710itDovecot Auth failed on disconnected session.Nov 17 22:52:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=217.26.178.106, lip=200.150.196.245, TLS, session=217.26.178.1063175395 W' ossec9708ibDovecot Aborted Login with empty userNov 17 22:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034>  eO+ ossec9710i`Dovecot Auth failed on disconnected session.Nov 17 22:52:30 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=186.209.247.155, lip=200.150.196.245, TLS, session=186.209.247.1553469034_  -G+ ossec13001iтExim Auth failed2025-11-17 22:53:05 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51742: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034-  e3% ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:51:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<0oPzstRDzrx3xBIC>119.196.18.21835841j  -_) ossec13001i=Exim Auth failed2025-11-17 22:51:57 dovecot_login authenticator failed for host-89-240-125-200.as13285.net [89.240.125.200]:38671: 535 Incorrect authentication data (set_id=aureovieira)89.240.125.2002635167*  e)) ossec9710i9Dovecot Auth failed on disconnected session.Nov 17 22:51:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841s  -s' ossec13001i1Exim Auth failed2025-11-17 22:51:44 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:57118: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)181.129.31.423686110u  -s+ ossec13001i1Exim Auth failed2025-11-17 22:51:44 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:60972: 535 Incorrect authentication data (set_id=isabellylisboa)128.185.228.1341269750  -) ossec13001i Exim Auth failed2025-11-17 22:51:27 dovecot_login authenticator failed for 221-120-57-173.emome-ip.hinet.net [221.120.57.173]:49110: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)221.120.57.1731668284u  -u) ossec13001iExim Auth failed2025-11-17 22:51:13 dovecot_login authenticator failed for (125.234.135.54.hcm.viettel.vn) [125.234.135.54]:58466: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)125.234.135.541562822*  e)) ossec9710iADovecot Auth failed on disconnected session.Nov 17 22:52:00 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=222.74.136.222, lip=200.150.196.245, session=222.74.136.2221814991 W' ossec9708i&Dovecot Aborted Login with empty userNov 17 22:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -;# ossec13001i"Exim Auth failed2025-11-17 22:51:28 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:46729: 535 Incorrect authentication data (set_id=atualizacoes)61.32.68.661835841\  -C) ossec13001iExim Auth failed2025-11-17 22:51:24 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:56520: 535 Incorrect authentication data (set_id=financeiro)125.20.245.1821269750 ~7> T  / O ~(  k' ossec9709iўMultiple Dovecot Aborted Logins with empty userNov 17 22:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0O0uu9RD/JmxV3kv>177.87.121.473469034i'  -_' ossec13001iіExim Auth failed2025-11-17 22:53:24 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:44236: 535 Incorrect authentication data (set_id=eliezer)123.194.136.316682840&  e5) ossec9710iѾDovecot Auth failed on disconnected session.Nov 17 22:54:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044%  W' ossec9708iѼDovecot Aborted Login with empty userNov 17 22:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+$  e)+ ossec9710iѴDovecot Auth failed on disconnected session.Nov 17 22:53:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001U#  -7' ossec13001iѰExim Auth failed2025-11-17 22:53:50 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:33524: 535 Incorrect authentication data (set_id=rafael)180.172.33.5218149913"  e=' ossec9710iѮDovecot Auth failed on disconnected session.Nov 17 22:53:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=47.89.246.14462520011!  e9' ossec9710iцDovecot Auth failed on disconnected session.Nov 17 22:53:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.47.136.50, lip=200.150.196.245, TLS, session=185.47.136.503175395\  -G% ossec13001iјExim Auth failed2025-11-17 22:53:26 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:35093: 535 Incorrect authentication data (set_id=marcelo.pinheiro)1.82.135.1541814991h  -_' ossec13001iєExim Auth failed2025-11-17 22:53:22 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3682: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)213.55.85.202337996  -' ossec13001iшExim Auth failed2025-11-17 22:53:10 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:50153: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)111.70.23.24116682840 e7% ossec9710iњDovecot Auth failed on disconnected session.Nov 17 22:53:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001f  -U+ ossec13001iѮExim Auth failed2025-11-17 22:53:48 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52074: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034u  -y' ossec13001i~Exim Auth failed2025-11-17 22:53:01 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:37984: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)5.185.176.195798544E  -' ossec13001ivExim Auth failed2025-11-17 22:52:52 dovecot_login authenticator failed for ([111.26.100.99]) [111.26.100.99]:36434: 535 Incorrect authentication data111.26.100.991814991 > x^/j>(6  e%) ossec9710irDovecot Auth failed on disconnected session.Nov 17 22:57:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3Bm5x9RDcrGB4rs4>129.226.187.5618197305  W' ossec9708ipDovecot Aborted Login with empty userNov 17 22:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.4  e1) ossec9710inDovecot Auth failed on disconnected session.Nov 17 22:57:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001k3  -a) ossec13001i>Exim Auth failed2025-11-17 22:56:13 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:55016: 535 Incorrect authentication data (set_id=contato)68.233.177.1886252001f2  -[% ossec13001i,Exim Auth failed2025-11-17 22:55:56 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:41154: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)61.72.58.24218358411  3C% ossec11301i"New FTP connection.Nov 17 22:55:45 hosting pure-ftpd: (?@54.235.25.93) [INFO] New connection from 54.235.25.9354.235.25.936252001+0  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:55:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822/ W' ossec9708iDovecot Aborted Login with empty userNov 17 22:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034..  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:55:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044m-  -e) ossec13001iExim Auth failed2025-11-17 22:55:15 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:59358: 535 Incorrect authentication data (set_id=contato)172.248.47.1146252001*,  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:54:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084l+  -c) ossec13001iExim Auth failed2025-11-17 22:55:02 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:56207: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)106.245.246.261835841)*  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:54:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841) W' ossec9708iDovecot Aborted Login with empty userNov 17 22:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  XsY#7D W' ossec9708iDovecot Aborted Login with empty userNov 17 22:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0l4JzdRDcqSxV3kv>177.87.121.473469034.C  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:58:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001hB  -]' ossec13001iҼExim Auth failed2025-11-17 22:58:18 dovecot_login authenticator failed for ([121.185.89.74]) [121.185.89.74]:58768: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)121.185.89.7418358412A  e9) ossec9710iҺDovecot Auth failed on disconnected session.Nov 17 22:58:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730@ W' ossec9708iҎDovecot Aborted Login with empty userNov 17 22:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a? -M' ossec13001izExim Auth failed2025-11-17 22:57:13 dovecot_login authenticator failed for (netoscotoadvogados.com.br) [61.50.119.110]:21194: 535 Incorrect authentication data (set_id=nologin)61.50.119.11018149915>  e=+ ossec9710ixDovecot Auth failed on disconnected session.Nov 17 22:57:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001"=  e% ossec9710itDovecot Auth failed on disconnected session.Nov 17 22:57:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060)<  e%+ ossec9710iҤDovecot Auth failed on disconnected session.Nov 17 22:57:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001l;  -e' ossec13001iҚExim Auth failed2025-11-17 22:57:46 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:45071: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)222.100.159.21835841":  e) ossec9710iҒDovecot Auth failed on disconnected session.Nov 17 22:57:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<4vOpydRD+LKYNbyQ>152.53.188.1442921044`9  -K) ossec13001irExim Auth failed2025-11-17 22:57:06 dovecot_login authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:60654: 535 Incorrect authentication data (set_id=bqtz)109.202.61.1552017370{8  -) ossec13001i`Exim Auth failed2025-11-17 22:56:46 dovecot_login authenticator failed for (79x136x194x132.dynamic.saratov.ertelecom.ru) [79.136.194.132]:56108: 535 Incorrect authentication data (set_id=bqtz@iemif.com)79.136.194.13220173707  k' ossec9709iRMultiple Dovecot Aborted Logins with empty userNov 17 22:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5mbpxdRDUuexV3kv>177.87.121.473469034 _ x_/ *Rn_ S  -!) ossec13001i,Exim Auth failed2025-11-17 23:00:12 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:52552: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)92.255.196.1852017370`R  -M' ossec13001i Exim Auth failed2025-11-17 22:59:58 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:60438: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730TQ  -;% ossec13001iExim Auth failed2025-11-17 22:59:42 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:34987: 535 Incorrect authentication data (set_id=marialuiza)65.20.204.8899237^P  -G) ossec13001iExim Auth failed2025-11-17 22:59:33 dovecot_login authenticator failed for ([194.164.95.228]) [194.164.95.228]:54978: 535 Incorrect authentication data (set_id=junior.gomes)194.164.95.2282635167O  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 22:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,N  e-) ossec9710i$Dovecot Auth failed on disconnected session.Nov 17 23:00:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387M  W' ossec9708i$Dovecot Aborted Login with empty userNov 17 23:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+L  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:59:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<5IV20NRDuImP9IUv>143.244.133.471269750'K  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:59:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001xJ  -% ossec13001iExim Auth failed2025-11-17 22:59:25 dovecot_login authenticator failed for 4.red-79-154-111.dynamicip.rima-tde.net [79.154.111.4]:50987: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)79.154.111.42510769tI  -q+ ossec13001iExim Auth failed2025-11-17 22:59:24 dovecot_login authenticator failed for ([128.185.252.110]) [128.185.252.110]:41604: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)128.185.252.1101269750fH  -]' ossec13001iExim Auth failed2025-11-17 22:58:42 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:35958: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)62.201.212.5499237+G  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 22:58:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.15418149915F  eA' ossec9710iҸDovecot Auth failed on disconnected session.Nov 17 22:58:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730dE  -Q+ ossec13001iҲExim Auth failed2025-11-17 22:58:10 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51869: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034 ) TwC B)b  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Za  -A' ossec13001iExim Auth failed2025-11-17 23:02:52 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:41066: 535 Incorrect authentication data (set_id=aureovieira)103.68.52.2101269750`  k' ossec9709iӸMultiple Dovecot Aborted Logins with empty userNov 17 23:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8t1a29RDcJuxV3kv>177.87.121.4734690340_  e3+ ossec9710iӲDovecot Auth failed on disconnected session.Nov 17 23:02:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001Y^  -=) ossec13001ifExim Auth failed2025-11-17 23:01:10 dovecot_login authenticator failed for ([223.70.149.210]) [223.70.149.210]:59331: 535 Incorrect authentication data (set_id=contato)223.70.149.2101814991/]  e1+ ossec9710iӂDovecot Auth failed on disconnected session.Nov 17 23:01:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822\ W' ossec9708i~Dovecot Aborted Login with empty userNov 17 23:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034([  e%) ossec9710iFDovecot Auth failed on disconnected session.Nov 17 23:00:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251vZ  -w) ossec13001i6Exim Auth failed2025-11-17 23:00:22 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:50165: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)119.164.159.861814991^Y  -I' ossec13001i4Exim Auth failed2025-11-17 23:00:20 dovecot_login authenticator failed for (98.168.158.61.ha.cnc) [61.158.168.98]:33074: 535 Incorrect authentication data (set_id=mariacarla)61.158.168.981814991&X  e'# ossec9710i0Dovecot Auth failed on disconnected session.Nov 17 23:00:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483'W  e#) ossec9710i*Dovecot Auth failed on disconnected session.Nov 17 23:00:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=94.198.208.124, lip=200.150.196.245, TLS, session=94.198.208.1243175395V  -) ossec13001i(Exim Auth failed2025-11-17 23:00:07 dovecot_login authenticator failed for 110-25-112-150.adsl.fetnet.net [110.25.112.150]:38289: 535 Incorrect authentication data (set_id=mariacarla@transoltransportes.com.br)110.25.112.1501668284^U  -G) ossec13001iRExim Auth failed2025-11-17 23:00:50 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:44909: 535 Incorrect authentication data (set_id=atualizacoes)118.45.101.1591835841T W' ossec9708iBDovecot Aborted Login with empty userNov 17 23:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  uf2bp  -M+ ossec13001izExim Auth failed2025-11-17 23:05:45 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:52979: 535 Incorrect authentication data (set_id=isabellylisboa)104.236.145.1286252001.o  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:04:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841&n  e!) ossec9710iNDovecot Auth failed on disconnected session.Nov 17 23:05:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387m W' ossec9708i0Dovecot Aborted Login with empty userNov 17 23:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)l  e-# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:04:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.9962520010k  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:03:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<0xp+39RD4J+ElIx5>132.148.140.1216252001j W' ossec9708iDovecot Aborted Login with empty userNov 17 23:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qi  -k+ ossec13001iExim Auth failed2025-11-17 23:03:19 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:41018: 535 Incorrect authentication data (set_id=financeiro)128.185.228.1341269750)h  e') ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:03:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044jg  -c% ossec13001iExim Auth failed2025-11-17 23:02:49 dovecot_login authenticator failed for ([85.175.81.54]) [85.175.81.54]:50752: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)85.175.81.542017370&f  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:02:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750ee  -W' ossec13001iExim Auth failed2025-11-17 23:02:39 dovecot_login authenticator failed for ([70.174.168.82]) [70.174.168.82]:49142: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)70.174.168.826252001*d  e)) ossec9710iӰDovecot Auth failed on disconnected session.Nov 17 23:02:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001+c  e-' ossec9710iӨDovecot Auth failed on disconnected session.Nov 17 23:02:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 T y ? ? sYbT0~  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841V}  -9' ossec13001iExim Auth failed2025-11-17 23:06:56 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:61790: 535 Incorrect authentication data (set_id=adriana)103.174.34.491269750s|  -s' ossec13001iԶExim Auth failed2025-11-17 23:06:45 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:45722: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)38.87.177.2526252001{ W' ossec9708iԨDovecot Aborted Login with empty userNov 17 23:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'z  e)# ossec9710iԤDovecot Auth failed on disconnected session.Nov 17 23:06:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483y  W' ossec9708iԋDovecot Aborted Login with empty userNov 17 23:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.x  e/+ ossec9710iԃDovecot Auth failed on disconnected session.Nov 17 23:05:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001/w  e3) ossec9710iԁDovecot Auth failed on disconnected session.Nov 17 23:05:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730v  k' ossec9709ilMultiple Dovecot Aborted Logins with empty userNov 17 23:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|u  -+ ossec13001i\Exim Auth failed2025-11-17 23:05:16 dovecot_login authenticator failed for ([211.116.107.222]) [211.116.107.222]:39713: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)211.116.107.22218358416t  eA) ossec9710iXDovecot Auth failed on disconnected session.Nov 17 23:05:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697500s  e3+ ossec9710iTDovecot Auth failed on disconnected session.Nov 17 23:05:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822r  e# ossec9710iԏDovecot Auth failed on disconnected session.Nov 17 23:06:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750.q  e3' ossec9710iԅDovecot Auth failed on disconnected session.Nov 17 23:05:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867  Z W' ossec9708iDovecot Aborted Login with empty userNov 17 23:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:07:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084  3C% ossec11301iNew FTP connection.Nov 17 23:07:28 hosting pure-ftpd: (?@8.219.79.215) [INFO] New connection from 8.219.79.2158.219.79.2151880251j  -_) ossec13001iExim Auth failed2025-11-17 23:07:18 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:52144: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)152.52.244.2021269750w  -}% ossec13001iExim Auth failed2025-11-17 23:07:10 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:57044: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)117.2.123.191562822  - ' ossec13001iExim Auth failed2025-11-17 23:07:57 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:43902: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)88.11.230.1602510769\  -C) ossec13001iExim Auth failed2025-11-17 23:07:53 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:42198: 535 Incorrect authentication data (set_id=formula316)190.213.54.2023573591Z  -A' ossec13001iExim Auth failed2025-11-17 23:07:31 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:41052: 535 Incorrect authentication data (set_id=venesselume)112.27.30.2531814991m  -i% ossec13001iExim Auth failed2025-11-17 23:07:26 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:55281: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)59.27.93.1381835841.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:08:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841u  -u+ ossec13001iExim Auth failed2025-11-17 23:07:49 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:49692: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)185.255.212.178732800]  -E) ossec13001iExim Auth failed2025-11-17 23:07:42 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:36574: 535 Incorrect authentication data (set_id=venesselume)182.95.176.1301269750  - ) ossec13001iExim Auth failed2025-11-17 23:07:34 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:43742: 535 Incorrect authentication data (set_id=formula316)122.160.51.1091269750*  e-% ossec9710iԜDovecot Auth failed on disconnected session.Nov 17 23:06:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841(  e%) ossec9710iԔDovecot Auth failed on disconnected session.Nov 17 23:06:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822  t D d_F%  e%# ossec9710iթDovecot Auth failed on disconnected session.Nov 17 23:10:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<2unE+NRD3p2UcQQF>148.113.4.51269750 W' ossec9708iՙDovecot Aborted Login with empty userNov 17 23:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+zf699RDvJmxV3kv>177.87.121.473469034 W' ossec9708i]Dovecot Aborted Login with empty userNov 17 23:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001i}Exim Auth failed2025-11-17 23:10:05 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:56601: 535 Incorrect authentication data (set_id=reservas@hoteljoinvillense.com.br)182.76.134.581269750#  e' ossec9710isDovecot Auth failed on disconnected session.Nov 17 23:09:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758  W' ossec9708i?Dovecot Aborted Login with empty userNov 17 23:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  e!' ossec9710i#Dovecot Auth failed on disconnected session.Nov 17 23:08:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<+Q/D8NRDNrM+PIOL>62.60.131.139130758Y  -=) ossec13001iExim Auth failed2025-11-17 23:08:30 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:37978: 535 Incorrect authentication data (set_id=compras)152.52.210.1181269750\  -C) ossec13001iExim Auth failed2025-11-17 23:08:24 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:46006: 535 Incorrect authentication data (set_id=assessoria)182.95.112.1021269750,  e-+ ossec9710i?Dovecot Auth failed on disconnected session.Nov 17 23:09:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758V  ;-% ossec13008i5Mail Recipient rejected2025-11-17 23:08:51 H=(195.3.134.135) [179.0.178.53]:57674 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57674 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034  k' ossec9709i!Multiple Dovecot Aborted Logins with empty userNov 17 23:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -A+ ossec13001iExim Auth failed2025-11-17 23:08:14 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:44540: 535 Incorrect authentication data (set_id=compras)178.178.194.1372017370+  e-' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 23:08:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001 W<  W1+  A]% ossec11302iiFTP Authentication failed.Nov 17 23:13:59 hosting pure-ftpd: (?@104.28.246.4) [WARNING] Authentication failed for user [OIxlhfZ8<]104.28.246.42264397b*  -S% ossec13001i[Exim Auth failed2025-11-17 23:13:47 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:59953: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)157.15.67.201643084b)  -Q' ossec13001iQExim Auth failed2025-11-17 23:13:37 dovecot_login authenticator failed for 110-25-93-205.adsl.fetnet.net [110.25.93.205]:42535: 535 Incorrect authentication data (set_id=contato)110.25.93.2051668284i(  -_' ossec13001i1Exim Auth failed2025-11-17 23:13:03 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:48796: 535 Incorrect authentication data (set_id=alex.vendas)189.218.82.143996063d'  -Q+ ossec13001i#Exim Auth failed2025-11-17 23:12:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62484: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651b&  -Q' ossec13001iExim Auth failed2025-11-17 23:12:34 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:63618: 535 Incorrect authentication data (set_id=andressa.financeiro)209.16.71.2546252001% W' ossec9708iDovecot Aborted Login with empty userNov 17 23:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m$  -e) ossec13001i Exim Auth failed2025-11-17 23:12:27 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:21932: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)218.28.168.1901814991|#  -+ ossec13001iExim Auth failed2025-11-17 23:12:20 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:34778: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)119.160.166.2371820814"  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)!  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:12:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991  -% ossec13001iExim Auth failed2025-11-17 23:11:58 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:34657: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)111.70.8.1431668284  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e-' ossec9710iՑDovecot Auth failed on disconnected session.Nov 17 23:10:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991]  -C+ ossec13001iՋExim Auth failed2025-11-17 23:10:18 dovecot_login authenticator failed for ([178.178.194.123]) [178.178.194.123]:55766: 535 Incorrect authentication data (set_id=reservas)178.178.194.1232017370_  -G+ ossec13001iՃExim Auth failed2025-11-17 23:10:10 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51870: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034  4 P 7B(`:  -I+ ossec13001i֩Exim Auth failed2025-11-17 23:15:04 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:58440: 535 Incorrect authentication data (set_id=alex.vendas)103.219.154.15627504059  W' ossec9708i֧Dovecot Aborted Login with empty userNov 17 23:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1AgRCNVD/JexV3kv>177.87.121.47346903428  e9) ossec9710i֥Dovecot Auth failed on disconnected session.Nov 17 23:15:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<6hnQB9VDHJV2wSaf>118.193.38.1591819730x7  -{) ossec13001i֟Exim Auth failed2025-11-17 23:14:53 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:55566: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)94.124.225.159201737016 e7' ossec9710i֏Dovecot Auth failed on disconnected session.Nov 17 23:14:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.10518197305  k' ossec9709i։Multiple Dovecot Aborted Logins with empty userNov 17 23:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344  -5+ ossec13001iUExim Auth failed2025-11-17 23:13:41 dovecot_login authenticator failed for (164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [222.222.124.164]:42536: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)222.222.124.1641814991q3  -k+ ossec13001iAExim Auth failed2025-11-17 23:13:21 dovecot_login authenticator failed for ([121.131.220.148]) [121.131.220.148]:45593: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)121.131.220.14818358412  -7' ossec13001i;Exim Auth failed2025-11-17 23:13:14 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:58776: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)125.23.140.541269750`1  -I+ ossec13001ikExim Auth failed2025-11-17 23:14:02 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:34658: 535 Incorrect authentication data (set_id=aureovieira)119.204.125.12418358410  3C% ossec11301icNew FTP connection.Nov 17 23:13:54 hosting pure-ftpd: (?@104.28.246.4) [INFO] New connection from 104.28.246.4104.28.246.42264397m/  -g' ossec13001iWExim Auth failed2025-11-17 23:13:42 dovecot_login authenticator failed for 111-70-23-251.emome-ip.hinet.net [111.70.23.251]:36841: 535 Incorrect authentication data (set_id=administrativo1)111.70.23.2511668284n.  -m# ossec13001iMExim Auth failed2025-11-17 23:13:32 dovecot_login authenticator failed for 111-70-32-2.emome-ip.hinet.net [111.70.32.2]:40281: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)111.70.32.21668284- W' ossec9708iMDovecot Aborted Login with empty userNov 17 23:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*,  e+) ossec9710i?Dovecot Auth failed on disconnected session.Nov 17 23:13:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170   .%I  e#% ossec9710i#Dovecot Auth failed on disconnected session.Nov 17 23:17:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841oH  -i) ossec13001iExim Auth failed2025-11-17 23:16:52 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:49452: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)125.19.248.1701269750G W' ossec9708iDovecot Aborted Login with empty userNov 17 23:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034tF  -s) ossec13001iֳExim Auth failed2025-11-17 23:15:14 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:7302: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)112.162.18.1501835841ME  --! ossec13001i֭Exim Auth failed2025-11-17 23:15:07 dovecot_login authenticator failed for ([78.36.7.89]) [78.36.7.89]:57329: 535 Incorrect authentication data (set_id=contato)78.36.7.8920173705D  e?) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:15:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387sC  -u% ossec13001iExim Auth failed2025-11-17 23:15:32 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:57384: 535 Incorrect authentication data (set_id=marcelo.pinheiro)85.152.57.602510769B W' ossec9708iDovecot Aborted Login with empty userNov 17 23:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\A  -I% ossec13001iֵExim Auth failed2025-11-17 23:15:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64494: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758_@  -G+ ossec13001iyExim Auth failed2025-11-17 23:14:15 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:34031: 535 Incorrect authentication data (set_id=financeiro)103.194.243.1871269750Y?  -C% ossec13001i֧Exim Auth failed2025-11-17 23:15:02 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64313: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758g>  -a# ossec13001i֝Exim Auth failed2025-11-17 23:14:52 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:60786: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)194.31.8.12614540]=  -G) ossec13001iփExim Auth failed2025-11-17 23:14:25 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:45380: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549)<  e+' ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 23:14:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.1391307585;  eA' ossec9710isDovecot Auth failed on disconnected session.Nov 17 23:14:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<47J+BNVDnsMI1et7>8.213.235.1231605651  gX  -_# ossec13001iaExim Auth failed2025-11-17 23:18:09 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:62926: 535 Incorrect authentication data (set_id=design@inovasite.com)60.8.73.1741814991&W  e#' ossec9710iaDovecot Auth failed on disconnected session.Nov 17 23:18:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841dV  -[# ossec13001iyExim Auth failed2025-11-17 23:18:32 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:32834: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)5.11.249.16298795-U  e5# ossec9710i9Dovecot Auth failed on disconnected session.Nov 17 23:17:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730mT  -e) ossec13001i1Exim Auth failed2025-11-17 23:17:21 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:51352: 535 Incorrect authentication data (set_id=xavier)170.233.29.1753865483eS -Y% ossec13001i%Exim Auth failed2025-11-17 23:17:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:52008: 535 Incorrect authentication data (set_id=info@cleservicosindustriais.com.br)62.60.131.40130758WR  -;' ossec13001iIExim Auth failed2025-11-17 23:17:44 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:52372: 535 Incorrect authentication data (set_id=anderson)211.223.41.901835841mQ  -e) ossec13001iGExim Auth failed2025-11-17 23:17:43 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:47860: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)152.52.210.1181269750|P  -) ossec13001i?Exim Auth failed2025-11-17 23:17:35 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:43946: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)182.75.215.2451269750O  k' ossec9709i=Multiple Dovecot Aborted Logins with empty userNov 17 23:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#N  e+ ossec9710i7Dovecot Auth failed on disconnected session.Nov 17 23:17:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758iM  -[+ ossec13001i_Exim Auth failed2025-11-17 23:18:07 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:52552: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)123.139.116.1841814991bL  -Q' ossec13001i_Exim Auth failed2025-11-17 23:18:06 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:50974: 535 Incorrect authentication data (set_id=contato)93.241.232.142921044K  W' ossec9708i[Dovecot Aborted Login with empty userNov 17 23:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3h/EEtVD0OixV3kv>177.87.121.473469034'J  e%' ossec9710iEDovecot Auth failed on disconnected session.Nov 17 23:17:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822 92  xi2)9lg  -c) ossec13001iExim Auth failed2025-11-17 23:20:01 dovecot_login authenticator failed for ([106.247.22.181]) [106.247.22.181]:53171: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)106.247.22.1811835841f  -' ossec13001iExim Auth failed2025-11-17 23:19:48 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:54805: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)131.221.133.634690343e  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822)d  e') ossec9710i׷Dovecot Auth failed on disconnected session.Nov 17 23:19:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750c W' ossec9708i׵Dovecot Aborted Login with empty userNov 17 23:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gb  -_% ossec13001i׍Exim Auth failed2025-11-17 23:18:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49551: 535 Incorrect authentication data (set_id=contact@cleservicosindustriais.com.br)62.60.131.40130758Ya  -;+ ossec13001iׅExim Auth failed2025-11-17 23:18:44 dovecot_login authenticator failed for ([121.131.220.141]) [121.131.220.141]:34945: 535 Incorrect authentication data (set_id=info)121.131.220.14118358414`  e?' ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 23:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651[_  -?+ ossec13001ikExim Auth failed2025-11-17 23:18:18 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:44956: 535 Incorrect authentication data (set_id=design)123.129.245.2491814991,^  e/' ossec9710i}Dovecot Auth failed on disconnected session.Nov 17 23:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001,]  e/' ossec9710iiDovecot Auth failed on disconnected session.Nov 17 23:18:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<7WSEE9VDttlSczCz>82.115.48.1791522867%\  e#% ossec9710ieDovecot Auth failed on disconnected session.Nov 17 23:18:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370[ W' ossec9708iyDovecot Aborted Login with empty userNov 17 23:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034XZ  -;) ossec13001igExim Auth failed2025-11-17 23:18:15 dovecot_login authenticator failed for ([92.124.148.205]) [92.124.148.205]:52356: 535 Incorrect authentication data (set_id=mecati)92.124.148.2052017370nY  -g) ossec13001igExim Auth failed2025-11-17 23:18:15 dovecot_login authenticator failed for ([124.115.206.10]) [124.115.206.10]:58420: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)124.115.206.101814991 z*4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ *  R H   > 4vlbXND&:0|Jrh^T@6,"xdZPF<2n (`VL~tjB8.$zp>f4\RH | r h ^ T J @ 6 , "    x n d Z Pz*  vlbXND:0& i iڶ i i i iں iڶ iڪ i in iڎ iچ iچ iڄ iڂ i~ ip iڠ iڞ iچ it iJ iF iF i` i\ i\ iL i  i i i, i, i i i i i iټ i i i٤ iٞ iٖ iٶ i٘ iٖ iْ iٌ i٪ i٪ ip ip il id iZ iP ix i) i' i i i i i i  i& i i i i i i i i i i i i iؕ i iط iش iؘ i؏ i i iؚ iئ iس iؑ iئ i؋ ia i i{ iy iu iq iq ik ii iy iq iC i1 i-~ i'} i!| i{ iz iy ix iw iv iu it is ir iq ip i׷o in im il i׽k ij i׽i ih ig if ie i׷d i׵c i׍b iׅa i}` i}^ iy[ iyV ik_ ii] igZ igY ie\ iaX iaW i_M i_L i[K iIR iGQ iEJ i?P i=O i9U i7N i1T i%S i#I iH iG iD iC iB iֵA iֳF i֭E i֩: i֧? i֧9 i֥8 i֟7 i֝> i0 i i i i i i i i i i i i i i i۶ i۲ i۲ i۰ iۮ iۤ iۖ iۖ i۔ iێ iۆ iۄ iۀ i~ i| iz iv iv iv in in ij id i: i( i i i i i i i i֏6 i։5 iփ= i}< iy@ is; ik1 ii+ ic0 i[* iW/ iU4 iQ) iM. iM- iA3 i?, i;2 i1( i#' i& i% i $ i# i" i! i i iթ iՙ iՑ iՋ iՃ i} is i] i? i? i5 i# i! i( i i i i  i i i i i i i i i i i i i i i iԶ iԨ iԤ iԜ iԔ iԏ iԋ iԅ iԃ iԁ iz il i\ iX iT iN  :   $v  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gu -U+ ossec13001iExim Auth failed2025-11-17 23:20:31 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52228: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034zt  -) ossec13001iExim Auth failed2025-11-17 23:20:24 dovecot_login authenticator failed for (132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:35876: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)60.223.251.1321814991as  -M) ossec13001iExim Auth failed2025-11-17 23:20:14 dovecot_login authenticator failed for ([112.25.253.122]) [112.25.253.122]:59626: 535 Incorrect authentication data (set_id=flavio.oliveira)112.25.253.1221814991r  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+q  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:20:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001Yp  -?' ossec13001iExim Auth failed2025-11-17 23:20:06 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:43849: 535 Incorrect authentication data (set_id=assessoria)45.194.26.1491168579-o  e/) ossec9710i׷Dovecot Auth failed on disconnected session.Nov 17 23:19:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044*n  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:19:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822fm  -]% ossec13001iExim Auth failed2025-11-17 23:19:57 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64822: 535 Incorrect authentication data (set_id=office@cleservicosindustriais.com.br)62.60.131.40130758ul  -{# ossec13001iExim Auth failed2025-11-17 23:19:52 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4667: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)144.64.64.82264397/k  e5' ossec9710i׽Dovecot Auth failed on disconnected session.Nov 17 23:19:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001\j  -G% ossec13001iExim Auth failed2025-11-17 23:19:59 dovecot_login authenticator failed for ([31.130.35.29]) [31.130.35.29]:46012: 535 Incorrect authentication data (set_id=marcelo.pinheiro)31.130.35.292017370ri  -q' ossec13001i׽Exim Auth failed2025-11-17 23:19:41 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:48130: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)209.173.10.756252001lh  -a+ ossec13001iExim Auth failed2025-11-17 23:20:04 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:58523: 535 Incorrect authentication data (set_id=contato)223.197.164.1881819730 H m^,N4Hh  -[) ossec13001ikExim Auth failed2025-11-17 23:22:34 dovecot_login authenticator failed for ([222.186.68.154]) [222.186.68.154]:36669: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)222.186.68.1541814991 W' ossec9708iiDovecot Aborted Login with empty userNov 17 23:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -?) ossec13001iyExim Auth failed2025-11-17 23:22:49 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:44253: 535 Incorrect authentication data (set_id=anderson)220.178.39.1061814991.  e/+ ossec9710iqDovecot Auth failed on disconnected session.Nov 17 23:22:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822  [w% ossec12004iCPossible Dovecot CVE-2019-11500 attemptNov 17 23:21:55 hosting dovecot: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=200.150.196.245, session=3.137.73.2216252001/  e3+ ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 23:21:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758~ W' ossec9708i-Dovecot Aborted Login with empty userNov 17 23:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,}  e++ ossec9710i'Dovecot Auth failed on disconnected session.Nov 17 23:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841k|  -_+ ossec13001i!Exim Auth failed2025-11-17 23:21:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53575: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651\{  -A+ ossec13001iExim Auth failed2025-11-17 23:20:36 dovecot_login authenticator failed for ([177.236.145.124]) [177.236.145.124]:54672: 535 Incorrect authentication data (set_id=compras)177.236.145.1243996063zz  -' ossec13001iExim Auth failed2025-11-17 23:20:27 dovecot_login authenticator failed for (dsl-tn-dynamic-129.221.22.125.airtelbroadband.in) [125.17.28.138]:49430: 535 Incorrect authentication data (set_id=assessoria)125.17.28.1381269750fy -[% ossec13001iExim Auth failed2025-11-17 23:20:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58548: 535 Incorrect authentication data (set_id=admin@cleservicosindustriais.com.br)62.60.131.40130758-x  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:20:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730*w  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:20:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044 ^ p p \- 5^|^;  eI+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:24:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001[  -A+ ossec13001iExim Auth failed2025-11-17 23:24:00 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:42664: 535 Incorrect authentication data (set_id=adriana)197.255.227.180921929^  -G) ossec13001iؚExim Auth failed2025-11-17 23:23:20 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:59578: 535 Incorrect authentication data (set_id=junior.gomes)113.140.95.2501814991S  -5% ossec13001iئExim Auth failed2025-11-17 23:23:32 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:56641: 535 Incorrect authentication data (set_id=contato)180.165.1.711814991S  -5% ossec13001iسExim Auth failed2025-11-17 23:23:46 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:59596: 535 Incorrect authentication data (set_id=leandro)111.26.63.831814991_  -G+ ossec13001iؑExim Auth failed2025-11-17 23:23:13 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51499: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034  k' ossec9709iئMultiple Dovecot Aborted Logins with empty userNov 17 23:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W) ossec9708i؋Dovecot Aborted Login with empty userNov 17 23:23:06 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.74, lip=200.150.196.245, session=109.105.210.742264397+  e/% ossec9710iaDovecot Auth failed on disconnected session.Nov 17 23:22:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<17I3ItVDqNdzR+4E>115.71.238.41835841'  e'% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:22:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991e -Y% ossec13001i{Exim Auth failed2025-11-17 23:22:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60011: 535 Incorrect authentication data (set_id=help@cleservicosindustriais.com.br)62.60.131.40130758|  -' ossec13001iyExim Auth failed2025-11-17 23:22:48 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:38834: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)42.200.70.13418197303 e9) ossec9710iuDovecot Auth failed on disconnected session.Nov 17 23:22:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044+  e+) ossec9710iqDovecot Auth failed on disconnected session.Nov 17 23:22:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456&  e+ ossec9710iqDovecot Auth failed on disconnected session.Nov 17 23:22:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001 + {D!+l"  -c) ossec13001iExim Auth failed2025-11-17 23:24:44 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:40012: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)122.184.127.861269750o!  -k' ossec13001iExim Auth failed2025-11-17 23:24:20 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:47312: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)51.75.142.1573017382  -+' ossec13001iExim Auth failed2025-11-17 23:24:43 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:58791: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)177.0.238.1903469034m  -e) ossec13001iExim Auth failed2025-11-17 23:24:39 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:60718: 535 Incorrect authentication data (set_id=administrativo1)110.25.105.2231668284.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.10129210443  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730 W' ossec9708iDovecot Aborted Login with empty userNov 17 23:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -% ossec13001iExim Auth failed2025-11-17 23:24:19 dovecot_login authenticator failed for 111-70-13-54.emome-ip.hinet.net [111.70.13.54]:36726: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)111.70.13.541668284;  eI+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:24:16 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.186.197.115, lip=200.150.196.245, TLS, session=138.186.197.1153469034r  -m+ ossec13001iؕExim Auth failed2025-11-17 23:23:16 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:55528: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)190.238.101.2093932488  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{  S[) ossec11000iطLogin failed on the cpanel service.[2025-11-17 23:23:50 -0300] info [webmaild] 104.207.42.131 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect104.207.42.1316252001v  -w) ossec13001iشExim Auth failed2025-11-17 23:23:47 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:48194: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)121.73.169.1612186224(  e+# ossec9710iؘDovecot Auth failed on disconnected session.Nov 17 23:23:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001p  -i+ ossec13001i؏Exim Auth failed2025-11-17 23:23:10 dovecot_login authenticator failed for ([123.235.187.158]) [123.235.187.158]:41297: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)123.235.187.1581814991 3 $ U cVeV2  -9' ossec13001idExim Auth failed2025-11-17 23:26:43 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:38985: 535 Incorrect authentication data (set_id=contato)191.36.152.2834690341  k' ossec9709iZMultiple Dovecot Aborted Logins with empty userNov 17 23:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d0  -Y# ossec13001iPExim Auth failed2025-11-17 23:26:22 dovecot_login authenticator failed for ([61.37.150.6]) [61.37.150.6]:47390: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)61.37.150.61835841/  W' ossec9708ixDovecot Aborted Login with empty userNov 17 23:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W.  -;) ossec13001i)Exim Auth failed2025-11-17 23:25:45 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:60400: 535 Incorrect authentication data (set_id=rafael)197.156.97.198337996[-  -C' ossec13001i'Exim Auth failed2025-11-17 23:25:42 dovecot_login authenticator failed for ([189.11.15.126]) [189.11.15.126]:53927: 535 Incorrect authentication data (set_id=junior.gomes)189.11.15.1263469034, W' ossec9708iDovecot Aborted Login with empty userNov 17 23:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034S+  -7# ossec13001iExim Auth failed2025-11-17 23:25:08 dovecot_login authenticator failed for ([59.6.75.186]) [59.6.75.186]:57022: 535 Incorrect authentication data (set_id=financeiro)59.6.75.1861835841 *  -' ossec13001iExim Auth failed2025-11-17 23:25:25 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:39584: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)92.255.190.692017370n)  -i' ossec13001iExim Auth failed2025-11-17 23:25:23 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:36532: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)120.157.6.1472077456#(  3K) ossec11301iNew FTP connection.Nov 17 23:25:19 hosting pure-ftpd: (?@54.159.252.252) [INFO] New connection from 54.159.252.25254.159.252.2526252001q'  -o) ossec13001i Exim Auth failed2025-11-17 23:25:12 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:44314: 535 Incorrect authentication data (set_id=isabellylisboa)88.248.250.143298795/&  e5' ossec9710i&Dovecot Auth failed on disconnected session.Nov 17 23:25:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991 %  -!) ossec13001iExim Auth failed2025-11-17 23:24:59 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:55153: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)116.48.149.1231819730f$  -Y' ossec13001iExim Auth failed2025-11-17 23:24:59 dovecot_login authenticator failed for (156.32.245.49.unknown.m1.com.sg) [49.245.32.156]:46393: 535 Incorrect authentication data (set_id=contato)49.245.32.1561880251_#  -G+ ossec13001iExim Auth failed2025-11-17 23:24:45 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:58588: 535 Incorrect authentication data (set_id=financeiro)220.180.107.1931814991 U q H f 2U'@  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:28:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730?  -+ ossec13001i٤Exim Auth failed2025-11-17 23:27:47 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:45804: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)213.130.207.1775974272>  e=% ossec9710iٞDovecot Auth failed on disconnected session.Nov 17 23:27:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001=  -') ossec13001iٖExim Auth failed2025-11-17 23:27:33 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60330: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)109.195.166.622017370V<  -;% ossec13001iٶExim Auth failed2025-11-17 23:28:05 dovecot_login authenticator failed for ([61.74.212.17]) [61.74.212.17]:3479: 535 Incorrect authentication data (set_id=vendas.luiz)61.74.212.1718358411;  e;% ossec9710i٘Dovecot Auth failed on disconnected session.Nov 17 23:27:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991: W' ossec9708iٖDovecot Aborted Login with empty userNov 17 23:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903449  e?' ossec9710iْDovecot Auth failed on disconnected session.Nov 17 23:27:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<8p5xNNVDDtJSnOdL>82.156.231.75181499108  e5) ossec9710iٌDovecot Auth failed on disconnected session.Nov 17 23:27:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750^7  -G) ossec13001i٪Exim Auth failed2025-11-17 23:27:53 dovecot_login authenticator failed for ([121.73.168.129]) [121.73.168.129]:50894: 535 Incorrect authentication data (set_id=atualizacoes)121.73.168.1292186224%6  e!' ossec9710i٪Dovecot Auth failed on disconnected session.Nov 17 23:27:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.97181499135  e=' ossec9710ipDovecot Auth failed on disconnected session.Nov 17 23:26:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<3GtlMtVDVuKkXF7M>164.92.94.2046252001'4  e%' ossec9710ipDovecot Auth failed on disconnected session.Nov 17 23:26:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<8VduMtVDLrsv+yzS>47.251.44.2106252001)3  e-# ossec9710ilDovecot Auth failed on disconnected session.Nov 17 23:26:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750  -  iPm2N  -% ossec13001i\Exim Auth failed2025-11-17 23:30:51 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:54560: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)34.41.211.486252001,M  e++ ossec9710iLDovecot Auth failed on disconnected session.Nov 17 23:30:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841*L  e)) ossec9710i Dovecot Auth failed on disconnected session.Nov 17 23:29:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697507K  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:29:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822_J  -I) ossec13001iExim Auth failed2025-11-17 23:29:10 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:51792: 535 Incorrect authentication data (set_id=isabellylisboa)180.148.10.1241210997I  W' ossec9708i,Dovecot Aborted Login with empty userNov 17 23:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9qG4PdVDJNOxV3kv>177.87.121.473469034*H  e)) ossec9710i,Dovecot Auth failed on disconnected session.Nov 17 23:30:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750*G  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:29:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<7R8CPNVD/tB3xBIC>119.196.18.21835841F  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'E  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:29:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822D W' ossec9708iDovecot Aborted Login with empty userNov 17 23:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\C  -C) ossec13001iExim Auth failed2025-11-17 23:28:30 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:46904: 535 Incorrect authentication data (set_id=financeiro)83.239.171.2262017370mB  -g' ossec13001iټExim Auth failed2025-11-17 23:28:10 dovecot_login authenticator failed for ([61.80.161.148]) [61.80.161.148]:45647: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)61.80.161.1481835841~A  - ' ossec13001iExim Auth failed2025-11-17 23:28:57 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:6068: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)200.33.171.653996063 W' : G - D 7NrzWcIWn]  -e+ ossec13001iچExim Auth failed2025-11-17 23:31:33 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:50202: 535 Incorrect authentication data (set_id=suporte)128.185.228.1341269750\ W' ossec9708iچDovecot Aborted Login with empty userNov 17 23:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p[  -k) ossec13001iڄExim Auth failed2025-11-17 23:31:30 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:48712: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)152.52.236.1581269750Z W+ ossec9708iڂDovecot Aborted Login with empty userNov 17 23:31:30 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034tY  -u' ossec13001i~Exim Auth failed2025-11-17 23:31:25 dovecot_login authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:38547: 535 Incorrect authentication data (set_id=administrativo1)77.22.182.2302921044XX  -?' ossec13001ipExim Auth failed2025-11-17 23:31:11 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:36170: 535 Incorrect authentication data (set_id=financeiro)31.135.26.217798544eW -Q+ ossec13001iڠExim Auth failed2025-11-17 23:31:58 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51449: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034bV  -U% ossec13001iڞExim Auth failed2025-11-17 23:31:57 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:53122: 535 Incorrect authentication data (set_id=alex.vendas)2.55.100.104294640#U  k+ ossec9709iچMultiple Dovecot Aborted Logins with empty userNov 17 23:31:32 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=177.155.199.1763469034eT  -W' ossec13001itExim Auth failed2025-11-17 23:31:14 dovecot_login authenticator failed for ([125.20.231.225]) [128.185.231.6]:50424: 535 Incorrect authentication data (set_id=suporte@inovasite.com)128.185.231.61269750S W' ossec9708iJDovecot Aborted Login with empty userNov 17 23:30:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oR  -i) ossec13001iFExim Auth failed2025-11-17 23:30:30 dovecot_login authenticator failed for ([78.138.130.143]) [78.138.130.143]:53858: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)78.138.130.1432017370iQ  -_' ossec13001iFExim Auth failed2025-11-17 23:30:29 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.59.150]:45546: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)14.241.59.1501562822ZP  -?) ossec13001i`Exim Auth failed2025-11-17 23:30:55 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:46694: 535 Incorrect authentication data (set_id=recepcao)121.179.93.1471835841wO  -y) ossec13001i\Exim Auth failed2025-11-17 23:30:51 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:52938: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)129.80.228.2316252001 xk^QD7*tgZM@3& }pcVI</"~qdWJ=0# zm`SF9, v i \ O B 5 ( yl_RE8+    r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!uh[NA4' ~qdWJ=0 6252001 6252001 6252001 6252001 6252001 6252001m 6252001l 6252001h 6252001] 6252001M 6252001G 6252001F 6252001E 6252001D 6252001^ 6252001[ 6252001V 6252001O 6252001M 6252001J 62520016 62520014 62520011 6252001) 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001[ 6252001H 62520019 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001t 6252001q 6252001p 6252001m 6252001; 6252001: 62520019 62520012 6252001' 6252001$ 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001v 6252001g 6252001e 6252001T 6252001I 6252001? 6252001= 62520013 62520012 6252001. 6252001& 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001T 6252001J 6252001E 6252001A 6252001: 62520018 62520014 62520013 62520010 6252001# 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001q 6252001k 6252001i 6252001^ 6252001& 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 62520019 6252001. 6252001, 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001{ 6252001x 6252001s 6252001a 6252001\ 6252001Z 6252001R 6252001P 6252001O 6252001> 6252001- 6252001, 6252001* 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001m 6252001d 6252001> 6252001 6252001 6252001 6252001 P T "tAPmk  -e) ossec13001iExim Auth failed2025-11-17 23:33:40 dovecot_login authenticator failed for ([181.64.123.166]) [181.64.123.166]:48416: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)181.64.123.1663932488/j e5% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:33:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001i  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)h  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:32:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001*g  e-% ossec9710iڶDovecot Auth failed on disconnected session.Nov 17 23:32:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841jf  -]+ ossec13001iExim Auth failed2025-11-17 23:32:57 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:36646: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)160.191.124.2011269750.e  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:32:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387d W' ossec9708iDovecot Aborted Login with empty userNov 17 23:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.c  e5% ossec9710iںDovecot Auth failed on disconnected session.Nov 17 23:32:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358413b  eA# ossec9710iڶDovecot Auth failed on disconnected session.Nov 17 23:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<6ZXoRdVDCIFCYSpH>66.97.42.7138654834a  e=) ossec9710iڪDovecot Auth failed on disconnected session.Nov 17 23:32:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044(`  e)% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:33:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991[_  -G% ossec13001inExim Auth failed2025-11-17 23:31:09 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:39413: 535 Incorrect authentication data (set_id=gerson)83.166.50.15453733.^  e1) ossec9710iڎDovecot Auth failed on disconnected session.Nov 17 23:31:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730 ' {t[z  -?+ ossec13001iۆExim Auth failed2025-11-17 23:35:50 dovecot_login authenticator failed for ([183.167.198.120]) [183.167.198.120]:46912: 535 Incorrect authentication data (set_id=gerson)183.167.198.1201814991y  -) ossec13001ivExim Auth failed2025-11-17 23:35:33 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:60098: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)187.237.47.2143996063.x  e1) ossec9710iێDovecot Auth failed on disconnected session.Nov 17 23:35:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001Sw -5% ossec13001iۀExim Auth failed2025-11-17 23:35:43 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:55905: 535 Incorrect authentication data (set_id=sociais)94.200.20.66290557(v  e#+ ossec9710izDovecot Auth failed on disconnected session.Nov 17 23:35:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841mu  -e) ossec13001ijExim Auth failed2025-11-17 23:35:21 dovecot_login authenticator failed for ([24.149.120.254]) [24.149.120.254]:39388: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)24.149.120.2546252001"t  e% ossec9710iۖDovecot Auth failed on disconnected session.Nov 17 23:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<01o2U9VDtKEI2Cjk>8.216.40.2281861060ms  -e) ossec13001i|Exim Auth failed2025-11-17 23:35:39 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:41262: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)221.167.21.1481835841nr  -i) ossec13001idExim Auth failed2025-11-17 23:35:15 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:43687: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)94.204.236.202290557q W' ossec9708i:Dovecot Aborted Login with empty userNov 17 23:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.p  e1) ossec9710i(Dovecot Auth failed on disconnected session.Nov 17 23:34:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044]o  -M# ossec13001iExim Auth failed2025-11-17 23:33:25 dovecot_login authenticator failed for ppp005055099226.access.hol.gr [5.55.99.226]:35136: 535 Incorrect authentication data (set_id=contato)5.55.99.226390903)n  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:33:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001m  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Ul  -=# ossec13001iExim Auth failed2025-11-17 23:33:58 dovecot_login authenticator failed for ([93.84.78.69]) [93.84.78.69]:44179: 535 Incorrect authentication data (set_id=atualizacoes1)93.84.78.69630336 q q  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2hG7VtVDUraxV3kv>177.87.121.473469034-  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:37:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=102.129.60.184, lip=200.150.196.245, TLS, session=<6qF/VdVDRd5mgTy4>102.129.60.184953987> Aq) ossec11302i۶FTP Authentication failed.Nov 17 23:36:36 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]203.16.241.2122077456  W' ossec9708i۲Dovecot Aborted Login with empty userNov 17 23:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:36:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822h -_% ossec13001iۤExim Auth failed2025-11-17 23:36:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58406: 535 Incorrect authentication data (set_id=support@cleservicosindustriais.com.br)62.60.131.40130758f  -Y' ossec13001iExim Auth failed2025-11-17 23:37:04 dovecot_login authenticator failed for ([121.73.163.92]) [121.73.163.92]:53376: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)121.73.163.922186224j  -e% ossec13001i۔Exim Auth failed2025-11-17 23:36:04 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60006: 535 Incorrect authentication data (set_id=postmaster@cleservicosindustriais.com.br)62.60.131.401307583  e9+ ossec9710iۄDovecot Auth failed on disconnected session.Nov 17 23:35:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001t  -s) ossec13001i~Exim Auth failed2025-11-17 23:35:42 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:35612: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)220.93.167.1441835841V  -7) ossec13001ivExim Auth failed2025-11-17 23:35:33 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.251.240]:51996: 535 Incorrect authentication data (set_id=gerson)14.241.251.2401562822~ W' ossec9708ivDovecot Aborted Login with empty userNov 17 23:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%}  e#% ossec9710inDovecot Auth failed on disconnected session.Nov 17 23:35:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<3szJUNVD8MuiAOAm>162.0.224.386252001m|  -e) ossec13001inExim Auth failed2025-11-17 23:35:26 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:58441: 535 Incorrect authentication data (set_id=xavier)104.155.27.1282802361({  e'' ossec9710iۖDovecot Auth failed on disconnected session.Nov 17 23:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 H*  \ ; Z }Ga+H_  -G+ ossec13001iExim Auth failed2025-11-17 23:38:07 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52239: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.14134690342  e;' ossec9710i<Dovecot Auth failed on disconnected session.Nov 17 23:38:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<7KobXdVDTpQrmxBp>43.155.16.1051819730b  q) ossec11321iActive Response. FTP brute force attack (Port 21 is protected)Nov 17 23:37:13 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]203.16.241.2122077456  S) ossec211321iPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 203.16.241.212203.16.241.21220774560  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:37:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001> Aq) ossec11302iFTP Authentication failed.Nov 17 23:37:07 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]203.16.241.2122077456 W' ossec9708iDovecot Aborted Login with empty userNov 17 23:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7aiGWNVDPsCxV3kv>177.87.121.473469034A  Iq) ossec11331i Stealth FTP brute force attackNov 17 23:37:32 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]203.16.241.2122077456=  gK) ossec11307iMultiple connection attempts from same sourceNov 17 23:37:20 hosting pure-ftpd: (?@203.16.241.212) [INFO] New connection from 203.16.241.212203.16.241.2122077456Y  -=) ossec13001iExim Auth failed2025-11-17 23:37:27 dovecot_login authenticator failed for ([120.157.130.79]) [120.157.130.79]:57974: 535 Incorrect authentication data (set_id=rodrigo)120.157.130.792077456] -E' ossec13001iExim Auth failed2025-11-17 23:37:22 dovecot_login authenticator failed for (toromartelinho.com.br) [61.50.119.110]:57802: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991  e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:37:21 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=177.190.79.74, lip=200.150.196.245, TLS, session=177.190.79.743469034$ 3K) ossec11301iNew FTP connection.Nov 17 23:37:09 hosting pure-ftpd: (?@203.16.241.212) [INFO] New connection from 203.16.241.212203.16.241.2122077456"  e) ossec9710i۲Dovecot Auth failed on disconnected session.Nov 17 23:36:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044$ 3K) ossec11301i۰New FTP connection.Nov 17 23:36:31 hosting pure-ftpd: (?@203.16.241.212) [INFO] New connection from 203.16.241.212203.16.241.2122077456*  e)) ossec9710iۮDovecot Auth failed on disconnected session.Nov 17 23:36:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841 0 :P-Q&0r(  -m+ ossec13001ifExim Auth failed2025-11-17 23:39:33 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:45133: 535 Incorrect authentication data (set_id=rodrigo)122.187.228.2281269750''  e#) ossec9710iVDovecot Auth failed on disconnected session.Nov 17 23:39:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044X&  -A# ossec13001i܄Exim Auth failed2025-11-17 23:40:04 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:62550: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999%  k' ossec9709i܄Multiple Dovecot Aborted Logins with empty userNov 17 23:40:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f$  -[% ossec13001iZExim Auth failed2025-11-17 23:39:22 dovecot_login authenticator failed for (est.giport.ru) [82.208.65.46]:3064: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)82.208.65.462017370V#  -9' ossec13001iZExim Auth failed2025-11-17 23:39:21 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:60312: 535 Incorrect authentication data (set_id=contato)70.174.168.956252001m"  -e) ossec13001iPExim Auth failed2025-11-17 23:39:11 dovecot_login authenticator failed for ([111.206.233.34]) [221.218.37.145]:56233: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)221.218.37.1451814991`!  -M' ossec13001i܄Exim Auth failed2025-11-17 23:40:03 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49301: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.721819730  W' ossec9708ifDovecot Aborted Login with empty userNov 17 23:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6uGxX9VDNIexV3kv>177.87.121.473469034k  -e% ossec13001iExim Auth failed2025-11-17 23:38:19 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:47594: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)103.90.27.831643084j  -_) ossec13001i8Exim Auth failed2025-11-17 23:38:48 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:59244: 535 Incorrect authentication data (set_id=xavier)50.149.161.1316252001h  -Y+ ossec13001i2Exim Auth failed2025-11-17 23:38:41 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:34556: 535 Incorrect authentication data (set_id=doninha)121.202.146.1441819730 W' ossec9708i*Dovecot Aborted Login with empty userNov 17 23:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i  -a% ossec13001i$Exim Auth failed2025-11-17 23:38:28 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:57440: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)36.135.62.871814991*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:38:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730  qW%,6 W' ossec9708iDovecot Aborted Login with empty userNov 17 23:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+4HaZtVDHr6xV3kv>177.87.121.47346903495 E ossec2501iUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127 4  [u% ossec12004iܱPossible Dovecot CVE-2019-11500 attemptNov 17 23:40:48 hosting dovecot: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=191.243.196.56, session=3.134.148.596252001*3  e'+ ossec9710iܪDovecot Auth failed on disconnected session.Nov 17 23:40:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<7T+yY9VDfOdrhr+5>107.134.191.1856252001.2  e1) ossec9710iܨDovecot Auth failed on disconnected session.Nov 17 23:40:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.14118197301 W' ossec9708iܠDovecot Aborted Login with empty userNov 17 23:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9Nk/Y9VDfqGxV3kv>177.87.121.473469034)0  e+% ossec9710i܊Dovecot Auth failed on disconnected session.Nov 17 23:40:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001-/  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:41:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<9yYOZdVDVtWd5hjP>157.230.24.2072921044h.  -_% ossec13001iܹExim Auth failed2025-11-17 23:40:56 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:44712: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)61.72.58.2421835841z-  -' ossec13001iܱExim Auth failed2025-11-17 23:40:48 dovecot_login authenticator failed for 111-70-23-236.emome-ip.hinet.net [111.70.23.236]:37630: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)111.70.23.2361668284~,  - ' ossec13001iܨExim Auth failed2025-11-17 23:40:40 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:58846: 535 Incorrect authentication data (set_id=envios@comercial.art.br)125.20.251.6612697502+  e=% ossec9710i܌Dovecot Auth failed on disconnected session.Nov 17 23:40:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382Y*  -=) ossec13001iExim Auth failed2025-11-17 23:41:05 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:54354: 535 Incorrect authentication data (set_id=contato)103.251.143.141269750.)  e1) ossec9710i~Dovecot Auth failed on disconnected session.Nov 17 23:39:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<3pUPYdVD1uSP9IUv>143.244.133.471269750  u C N ALvJ''D e'% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:42:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103$C  e) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:42:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<4OrZaNVDFI/SchJs>210.114.18.1081835841B  k' ossec9709i7Multiple Dovecot Aborted Logins with empty userNov 17 23:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(A  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:41:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001R@  -3% ossec13001iExim Auth failed2025-11-17 23:42:03 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:51953: 535 Incorrect authentication data (set_id=wesley)102.38.3.1772215636q? SI% ossec11000iLogin failed on the cpanel service.[2025-11-17 23:41:50 -0300] info [webmaild] 189.4.11.149 - xavier@projetocircense.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect189.4.11.1493469034[>  -?+ ossec13001iExim Auth failed2025-11-17 23:41:19 dovecot_login authenticator failed for ([118.220.149.121]) [118.220.149.121]:56912: 535 Incorrect authentication data (set_id=envios)118.220.149.1211835841*= U9% ossec11001iDeferred login on the cpanel service[2025-11-17 23:41:18 -0300] info [webmaild] 189.4.11.149 - xavier@projetocircense.com.br "GET /cpsess4936433639/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect189.4.11.1493469034q<  -k+ ossec13001iExim Auth failed2025-11-17 23:41:15 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:20852: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)122.225.203.1061814991.;  e3' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:41:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822*:  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:41:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<9wH0ZdVDAAWKxX03>138.197.125.556252001'9  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<1OrtZ9VDsNpCYSpH>66.97.42.7138654838  -) ossec13001iExim Auth failed2025-11-17 23:41:43 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:64407: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)24.196.148.1696252001(7  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:41:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251  z e 5R W' ossec9708iݑDovecot Aborted Login with empty userNov 17 23:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0euIcdVDupmxV3kv>177.87.121.473469034dQ  -U' ossec13001i݉Exim Auth failed2025-11-17 23:44:23 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:56978: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)103.68.19.1701269750)P  e)' ossec9710iyDovecot Auth failed on disconnected session.Nov 17 23:44:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084WO  -9) ossec13001igExim Auth failed2025-11-17 23:43:50 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:37176: 535 Incorrect authentication data (set_id=bruno)178.178.222.562017370N  e# ossec9710iYDovecot Auth failed on disconnected session.Nov 17 23:43:36 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=60.8.73.174, lip=200.150.196.245, TLS, session=<7z/wbNVD8NQ8CEmu>60.8.73.1741814991uM  -u) ossec13001iWExim Auth failed2025-11-17 23:43:33 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:38790: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)190.117.96.1743932488L W' ossec9708iUDovecot Aborted Login with empty userNov 17 23:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-K  e5# ossec9710iADovecot Auth failed on disconnected session.Nov 17 23:43:12 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=218.76.73.4, lip=200.150.196.245, TLS, session=218.76.73.41814991,J  e++ ossec9710i)Dovecot Auth failed on disconnected session.Nov 17 23:42:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001,I  e-) ossec9710i%Dovecot Auth failed on disconnected session.Nov 17 23:42:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387aH  -K+ ossec13001iExim Auth failed2025-11-17 23:42:34 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51776: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034G  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:42:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343F  e9+ ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 23:42:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628222E  e7+ ossec9710i/Dovecot Auth failed on disconnected session.Nov 17 23:42:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001  3 " 8  !7 Xa  -=' ossec13001iExim Auth failed2025-11-17 23:46:21 dovecot_login authenticator failed for ([111.26.61.237]) [111.26.61.238]:37124: 535 Incorrect authentication data (set_id=sec.geral)111.26.61.2381814991^`  -E+ ossec13001iExim Auth failed2025-11-17 23:46:00 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51799: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.1413469034_  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-^  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:45:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730]  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f\  -[' ossec13001iExim Auth failed2025-11-17 23:45:59 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:44658: 535 Incorrect authentication data (set_id=envios)95.158.39.201690791p[  -k) ossec13001iExim Auth failed2025-11-17 23:45:55 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:53093: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)218.156.93.2021835841mZ  -e) ossec13001iExim Auth failed2025-11-17 23:45:51 dovecot_login authenticator failed for ([178.45.116.182]) [178.45.116.182]:5060: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)178.45.116.1822017370}Y  -+ ossec13001iExim Auth failed2025-11-17 23:45:48 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:42408: 535 Incorrect authentication data (set_id=envios@comercial.art.br)182.239.109.2081819730-X  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867fW  -Y' ossec13001iݡExim Auth failed2025-11-17 23:44:48 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:41020: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)125.19.195.661269750gV  -]' ossec13001iݙExim Auth failed2025-11-17 23:44:40 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:55834: 535 Incorrect authentication data (set_id=doninha)78.188.102.28298795"U  e% ossec9710iݗDovecot Auth failed on disconnected session.Nov 17 23:44:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=69.62.65.113, lip=200.150.196.245, session=69.62.65.113597427WT  -;' ossec13001iݭExim Auth failed2025-11-17 23:45:01 dovecot_login authenticator failed for ([174.134.45.64]) [174.134.45.64]:33772: 535 Incorrect authentication data (set_id=eleicoes)174.134.45.646252001nS -e) ossec13001iݡExim Auth failed2025-11-17 23:44:48 dovecot_plain authenticator failed for (localhost.localdomain) [78.153.140.202]:52254: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)78.153.140.2022635167 > xF].6V**>hp  -[) ossec13001iAExim Auth failed2025-11-17 23:47:28 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:56576: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)112.168.71.1091835841|o  -% ossec13001i9Exim Auth failed2025-11-17 23:47:21 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:47441: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)90.164.107.32510769(n  e+# ossec9710igDovecot Auth failed on disconnected session.Nov 17 23:48:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483\m  -A+ ossec13001ieExim Auth failed2025-11-17 23:48:03 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:34358: 535 Incorrect authentication data (set_id=contato)122.224.154.1661814991Zl  -A' ossec13001iOExim Auth failed2025-11-17 23:47:41 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:41748: 535 Incorrect authentication data (set_id=aureovieira)213.230.65.531512440k W' ossec9708iEDovecot Aborted Login with empty userNov 17 23:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+j  e/% ossec9710i?Dovecot Auth failed on disconnected session.Nov 17 23:47:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841ei  -S+ ossec13001i?Exim Auth failed2025-11-17 23:47:26 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:58659: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651.h  e1) ossec9710i Dovecot Auth failed on disconnected session.Nov 17 23:46:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.10818358414g  e;+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:46:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<90cieNVD4stns7yS>103.179.188.1461562822{f  -) ossec13001iExim Auth failed2025-11-17 23:46:08 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:43422: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)185.137.75.2273017382*e  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:46:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991d W' ossec9708i Dovecot Aborted Login with empty userNov 17 23:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  e# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:46:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750bb  -M+ ossec13001iExim Auth failed2025-11-17 23:46:24 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:35028: 535 Incorrect authentication data (set_id=rene)179.185.161.1453469034 S X?.ESn~  -g) ossec13001i޳Exim Auth failed2025-11-17 23:49:23 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:35057: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)111.85.118.1471814991e}  -U+ ossec13001iއExim Auth failed2025-11-17 23:48:38 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:53122: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795U|  -7' ossec13001iqExim Auth failed2025-11-17 23:48:16 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:56940: 535 Incorrect authentication data (set_id=wesley)36.135.100.481814991a{  -M) ossec13001ioExim Auth failed2025-11-17 23:48:14 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:43725: 535 Incorrect authentication data (set_id=contato)46.212.117.1313144096(z  e%) ossec9710iޛDovecot Auth failed on disconnected session.Nov 17 23:48:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822#y  e) ossec9710iޕDovecot Auth failed on disconnected session.Nov 17 23:48:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750x  W' ossec9708iށDovecot Aborted Login with empty userNov 17 23:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/w  e3) ossec9710iiDovecot Auth failed on disconnected session.Nov 17 23:48:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<5t1PftVDCqKB4kCN>129.226.64.1411819730sv  -s' ossec13001iޟExim Auth failed2025-11-17 23:49:03 dovecot_login authenticator failed for ([1.237.155.150]) [1.237.155.150]:40208: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)1.237.155.1501835841u  k' ossec9709iޟMultiple Dovecot Aborted Logins with empty userNov 17 23:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wt  -}% ossec13001iYExim Auth failed2025-11-17 23:47:51 dovecot_login authenticator failed for 111-70-25-48.emome-ip.hinet.net [111.70.25.48]:54539: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)111.70.25.481668284$s  e) ossec9710iUDovecot Auth failed on disconnected session.Nov 17 23:47:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.19322333876r  eA) ossec9710iQDovecot Auth failed on disconnected session.Nov 17 23:47:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750zq  -' ossec13001iIExim Auth failed2025-11-17 23:47:36 dovecot_login authenticator failed for 111-70-19-154.emome-ip.hinet.net [111.70.19.154]:51599: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)111.70.19.1541668284 : ~ SX(E:_  -K) ossec13001iExim Auth failed2025-11-17 23:50:18 dovecot_login authenticator failed for dynamic-216-81.keskikaista.fi [185.131.216.81]:55188: 535 Incorrect authentication data (set_id=adm)185.131.216.81660013$  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:50:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758V  -7) ossec13001i Exim Auth failed2025-11-17 23:50:48 dovecot_login authenticator failed for ([167.99.148.119]) [167.99.148.119]:33046: 535 Incorrect authentication data (set_id=bqtz)167.99.148.1196252001k  -g# ossec13001iExim Auth failed2025-11-17 23:50:37 dovecot_login authenticator failed for net-2-40-196-85.cust.vodafonedsl.it [2.40.196.85]:45730: 535 Incorrect authentication data (set_id=bqtz@iemif.com)2.40.196.853175395 W' ossec9708iDovecot Aborted Login with empty userNov 17 23:50:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:50:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001w  -w+ ossec13001iExim Auth failed2025-11-17 23:49:57 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:44130: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)185.183.103.1212635167*  e/# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:49:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001 W' ossec9708i޽Dovecot Aborted Login with empty userNov 17 23:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -O# ossec13001i޻Exim Auth failed2025-11-17 23:49:30 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:12995: 535 Incorrect authentication data (set_id=contato)58.27.253.611685795  eA' ossec9710i޷Dovecot Auth failed on disconnected session.Nov 17 23:49:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084/  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:49:53 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.61.177.2, lip=200.150.196.245, TLS, session=111.61.177.21814991_  -G+ ossec13001iExim Auth failed2025-11-17 23:49:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51641: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034/  e1+ ossec9710i޿Dovecot Auth failed on disconnected session.Nov 17 23:49:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<6n5qg9VDoJdrhr+5>107.134.191.1856252001 9     e' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:54:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=37.255.234.87, lip=200.150.196.245, TLS, session=37.255.234.87130758Y  -C% ossec13001iߝExim Auth failed2025-11-17 23:53:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58915: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758T  -9# ossec13001iߛExim Auth failed2025-11-17 23:53:14 dovecot_login authenticator failed for ([46.44.24.40]) [46.44.24.40]:54835: 535 Incorrect authentication data (set_id=vendas.luiz)46.44.24.402017370>  eO+ ossec9710iߙDovecot Auth failed on disconnected session.Nov 17 23:53:12 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=186.209.251.170, lip=200.150.196.245, TLS, session=186.209.251.1703469034i  -]) ossec13001iߗExim Auth failed2025-11-17 23:53:11 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:57550: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)125.20.245.1821269750k  -a) ossec13001i߭Exim Auth failed2025-11-17 23:53:33 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:38489: 535 Incorrect authentication data (set_id=novamanha)190.104.254.913865483 W' ossec9708i߭Dovecot Aborted Login with empty userNov 17 23:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}  -' ossec13001i߃Exim Auth failed2025-11-17 23:52:50 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:35845: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)109.69.15.1322510769 W' ossec9708iqDovecot Aborted Login with empty userNov 17 23:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  e1) ossec9710ikDovecot Auth failed on disconnected session.Nov 17 23:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<2v+njdVDlkqvfiX3>175.126.37.2471835841a  -S% ossec13001iEExim Auth failed2025-11-17 23:51:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51448: 535 Incorrect authentication data (set_id=postamster@calcautomacao.com.br)62.60.131.40130758  W' ossec9708i5Dovecot Aborted Login with empty userNov 17 23:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:51:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750   3G' ossec11301iWNew FTP connection.Nov 17 23:52:06 hosting pure-ftpd: (?@194.164.107.6) [INFO] New connection from 194.164.107.6194.164.107.66252001  k' ossec9709iSMultiple Dovecot Aborted Logins with empty userNov 17 23:52:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p R H f \ > 4 *  vlbX&ND:0rh^T|"J@6,xdZPF<n2( B~tj`VL8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& i\ iL iL i: i. i" iJ i: i0 i i i i i i i i i i i i i i i i i i i i i i i i i i i i i~ i| it i` i8 i* iP iB iB i@ i2 i  i i i  i i$ i i i i i i i i i i i i i i i i i` iR ip ij ih ih i  i i i i" i i i i i i i i i i i i i i ia iM iK i i} i{ ig iC iA i i iA i1 i% i i i  i i i i i iߝ iߛ iߙ iߗ i߭ i߭ i߃ iq ik iE i5 iW iS i i i  i i i i i i i i i޿ i޽ i޻ i޷ i޳~ iޟv iޟu iޛz iޕy iއ} iށx iq| io{ iiw ign iem iYt iUs iQr iOl iIq iEk iAp i?j i?i i9o ie i h i d is1 ii: ii5 ie9 ic0 i_6 i]8 iV/ iR4 iP7 iP3 iP. iN2 i>' i8+ i8& i4* i(% i"- i) i( i, i$ i# i" i! i i i i i i i i i i i i in il if if i^ ic ig ib ia if i] i` i\ i[ iZ iY iX i_ i^ iݭT iݡW iݡS iݙV iݗU iݑR i݉Q iyP igO iYN iWM iUL iAK i7B i1F i/E i)J i%I iH iG iD iC i@ i9 i? i5 iA i8 i< i7 i6 i; i> i: i= i< i* i/ iܹ. iܱ4 iܱ- iܪ3 iܨ2 iܨ, iܠ1 i܌+ i܊0 i܄& i܄% i܄! i~) if( if iZ$ iZ# iV' iP" i< i8 i2 i* i$ i i i i i i i i i v S(o`vf)  -Y) ossec13001iCExim Auth failed2025-11-17 23:56:03 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:44672: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)80.227.138.214290557 ( -!' ossec13001iAExim Auth failed2025-11-17 23:56:00 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:62449: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)189.31.138.383469034+'  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:55:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758.&  e3' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:55:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730 % Sw) ossec11000iALogin failed on the cpanel service.[2025-11-17 23:56:01 -0300] info [cpaneld] 119.28.107.251 - lixadora "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadora (has_cpuser_file failed)119.28.107.2511880251,$  e++ ossec9710i1Dovecot Auth failed on disconnected session.Nov 17 23:55:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841# W' ossec9708i%Dovecot Aborted Login with empty userNov 17 23:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5zvfmNVDcKuxV3kv>177.87.121.473469034'"  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:55:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149911!  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:54:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.70.31.135, lip=200.150.196.245, TLS, session=111.70.31.1351668284-  e1' ossec9710i Dovecot Auth failed on disconnected session.Nov 17 23:55:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8QQbl9VDXpuxV3kv>177.87.121.473469034'  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:54:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730\  -I% ossec13001iExim Auth failed2025-11-17 23:54:55 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58419: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:54:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 t > ozdtl9  -e' ossec13001iExim Auth failed2025-11-17 23:58:55 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:37824: 535 Incorrect authentication data (set_id=novamanha)24.207.66.15462519998  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 17 23:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347  W' ossec9708iDovecot Aborted Login with empty userNov 17 23:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1TIMoNVDjNSxV3kv>177.87.121.473469034V6  -;% ossec13001iExim Auth failed2025-11-17 23:57:29 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:41122: 535 Incorrect authentication data (set_id=marialuiza)14.99.61.2481269750q5  -m) ossec13001iExim Auth failed2025-11-17 23:57:20 dovecot_login authenticator failed for ([183.106.59.245]) [183.106.59.245]:45985: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)183.106.59.2451835841/4  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:58:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.179152286733  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:57:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<1bUYodVDGMul0xnK>165.211.25.2022233387^2  -G) ossec13001iExim Auth failed2025-11-17 23:57:41 dovecot_login authenticator failed for ([220.180.204.31]) [220.180.204.31]:49914: 535 Incorrect authentication data (set_id=junior.gomes)220.180.204.311814991l1  -a+ ossec13001iExim Auth failed2025-11-17 23:57:09 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:49376: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.23116056510 W' ossec9708iaDovecot Aborted Login with empty userNov 17 23:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+RZ3nNVDVL6xV3kv>177.87.121.473469034\/  -E' ossec13001iMExim Auth failed2025-11-17 23:56:12 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:65492: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001n.  -i' ossec13001iKExim Auth failed2025-11-17 23:56:11 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:45472: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)103.220.16.511269750#-  3K) ossec11301iNew FTP connection.Nov 17 23:57:06 hosting pure-ftpd: (?@109.105.210.89) [INFO] New connection from 109.105.210.89109.105.210.892264397Y,  -?' ossec13001i}Exim Auth failed2025-11-17 23:57:01 dovecot_login authenticator failed for ([210.245.95.11]) [210.245.95.11]:47502: 535 Incorrect authentication data (set_id=marialuiza)210.245.95.111562822r+  -q' ossec13001i{Exim Auth failed2025-11-17 23:56:58 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52864: 535 Incorrect authentication data (set_id=brizola)70.91.135.1816252001k*  -c' ossec13001igExim Auth failed2025-11-17 23:56:38 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:35501: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)103.68.19.1701269750 C } c T (tC-F  e1' ossec9710ijDovecot Auth failed on disconnected session.Nov 18 00:00:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001)E  e') ossec9710ihDovecot Auth failed on disconnected session.Nov 18 00:00:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750dD  -Q+ ossec13001ihExim Auth failed2025-11-18 00:00:55 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52260: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034*C  e)) ossec9710i Dovecot Auth failed on disconnected session.Nov 17 23:59:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044+B  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:59:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001A W' ossec9708iDovecot Aborted Login with empty userNov 17 23:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1y4tp9VD3pOxV3kv>177.87.121.473469034$@  e!% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:59:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370(?  e'' ossec9710i"Dovecot Auth failed on disconnected session.Nov 17 23:59:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822 >  -!) ossec13001iExim Auth failed2025-11-17 23:58:41 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60346: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)109.195.166.622017370= W' ossec9708iDovecot Aborted Login with empty userNov 17 23:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034!<  e% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:58:24 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.197.9.42, lip=200.150.196.245, TLS, session=185.197.9.423175395&;  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:58:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358410:  e;# ossec9710iDovecot Auth failed on disconnected session.Nov 17 23:58:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730  U T aU  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:02:20 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.85, lip=200.150.207.122, TLS, session=87.236.176.852635167T W' ossec9708iDovecot Aborted Login with empty userNov 18 00:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nS  -i' ossec13001iExim Auth failed2025-11-18 00:01:27 dovecot_login authenticator failed for ([111.26.95.253]) [111.26.95.254]:51920: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)111.26.95.2541814991iR  -_' ossec13001iExim Auth failed2025-11-18 00:01:26 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:43486: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)45.250.249.121269750'Q  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:01:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841YP  -=) ossec13001iExim Auth failed2025-11-18 00:01:58 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:40634: 535 Incorrect authentication data (set_id=contato)189.113.185.143469034RO  -3% ossec13001iExim Auth failed2025-11-18 00:01:44 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:54692: 535 Incorrect authentication data (set_id=rafael)13.68.214.346252001nN  -i' ossec13001iExim Auth failed2025-11-18 00:01:39 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:46328: 535 Incorrect authentication data (set_id=vanessalima)24.207.66.1546251999\M  -C) ossec13001iExim Auth failed2025-11-18 00:01:52 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:36152: 535 Incorrect authentication data (set_id=assessoria)86.102.254.1982017370oL  -i) ossec13001iExim Auth failed2025-11-18 00:01:46 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:57004: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)121.73.169.1612186224}K  -' ossec13001iExim Auth failed2025-11-18 00:01:34 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:58736: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)177.207.248.534690340J  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:02:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<4rX1r9VD8LItPZWl>45.61.149.16562520017I  eA+ ossec9710i`Dovecot Auth failed on disconnected session.Nov 18 00:00:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822H  W' ossec9708iRDovecot Aborted Login with empty userNov 18 00:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034G  k' ossec9709ipMultiple Dovecot Aborted Logins with empty userNov 18 00:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  ltd  -q+ ossec13001iPExim Auth failed2025-11-18 00:04:48 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:35997: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)208.180.252.1836252001wc  -y) ossec13001iBExim Auth failed2025-11-18 00:04:33 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:47501: 535 Incorrect authentication data (set_id=andressa.financeiro)187.40.215.1623469034b W' ossec9708iBDovecot Aborted Login with empty userNov 18 00:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -/) ossec13001i@Exim Auth failed2025-11-18 00:04:31 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:55373: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)182.70.122.2451269750q`  -u% ossec13001i2Exim Auth failed2025-11-18 00:04:17 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:43579: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)65.20.204.8899237K_  -+ ossec13001i Exim Auth failed2025-11-18 00:03:59 dovecot_login authenticator failed for ([218.202.219.223]) [218.202.219.223]:36156: 535 Incorrect authentication data218.202.219.2231814991h^  -a# ossec13001iExim Auth failed2025-11-18 00:03:51 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:47614: 535 Incorrect authentication data (set_id=adriana)103.59.4.361269750&]  e!+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:03:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<9rVRttVDkMnBl4nP>193.151.137.207130758s\  -s' ossec13001i Exim Auth failed2025-11-18 00:03:40 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:32964: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)74.208.177.566252001[  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5z9+tdVDdpexV3kv>177.87.121.473469034Z  k' ossec9709i$Multiple Dovecot Aborted Logins with empty userNov 18 00:04:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034vY  -y' ossec13001iExim Auth failed2025-11-18 00:02:13 dovecot_login authenticator failed for (net47-227.perm.ertelecom.ru) [46.146.47.227]:50210: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)46.146.47.22720173701X  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<+BgwstVDxIE+PIOL>62.60.131.139130758W W' ossec9708iDovecot Aborted Login with empty userNov 18 00:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jV  -_+ ossec13001iExim Auth failed2025-11-18 00:02:24 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:50825: 535 Incorrect authentication data (set_id=lucas)213.130.207.177597427 MX : K 1  3Sab%=fMt  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Ss  -5% ossec13001iExim Auth failed2025-11-18 00:06:29 dovecot_login authenticator failed for ([121.8.209.94]) [121.8.209.94]:55858: 535 Incorrect authentication data (set_id=contato)121.8.209.941814991dr  -[% ossec13001iExim Auth failed2025-11-18 00:06:14 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:60471: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)65.20.158.1099237Wq  ;/% ossec13008iMail Recipient rejected2025-11-18 00:05:59 H=(195.3.134.135) [179.0.178.53]:61657 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:61657 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034|p  -' ossec13001iExim Auth failed2025-11-18 00:05:46 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:53466: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)46.30.161.197690791^o  -I' ossec13001iExim Auth failed2025-11-18 00:05:46 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:33624: 535 Incorrect authentication data (set_id=administrativo1)192.34.164.136252001{n  -' ossec13001iExim Auth failed2025-11-18 00:05:38 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:34316: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)119.92.76.2101694008nm  -m# ossec13001iExim Auth failed2025-11-18 00:05:35 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:42605: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)113.59.34.51814991\l  -A+ ossec13001iExim Auth failed2025-11-18 00:06:06 dovecot_login authenticator failed for ([189.59.210.1]) [186.215.245.175]:59177: 535 Incorrect authentication data (set_id=financeiro)186.215.245.1753469034Ok  -/# ossec13001iExim Auth failed2025-11-18 00:05:54 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:54734: 535 Incorrect authentication data (set_id=rubens)39.74.74.441814991'j  e%' ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 00:05:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001i W' ossec9708i|Dovecot Aborted Login with empty userNov 18 00:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kh  -a) ossec13001itExim Auth failed2025-11-18 00:05:24 dovecot_login authenticator failed for ([223.105.71.106]) [223.105.71.106]:50165: 535 Incorrect authentication data (set_id=rubens@singseguros.com.br)223.105.71.1061814991_g  -I+ ossec13001i`Exim Auth failed2025-11-18 00:05:02 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:47674: 535 Incorrect authentication data (set_id=vanessalima)196.189.124.2293379967f  eA+ ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 00:04:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001$e 3K) ossec11301i*New FTP connection.Nov 18 00:04:08 hosting pure-ftpd: (?@204.236.215.24) [INFO] New connection from 204.236.215.24204.236.215.246252001 ", , ; M m]  -G) ossec13001iExim Auth failed2025-11-18 00:08:06 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:50944: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549{  -# ossec13001iExim Auth failed2025-11-18 00:07:12 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:39714: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)92.40.62.722635167a  -K+ ossec13001iExim Auth failed2025-11-18 00:07:36 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:62643: 535 Incorrect authentication data (set_id=atualizacoes)211.169.212.2061835841i  -_' ossec13001iExim Auth failed2025-11-18 00:07:12 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:56558: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)222.104.76.941835841  - + ossec13001iExim Auth failed2025-11-18 00:07:14 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:48986: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)122.187.221.1301269750d  -Q+ ossec13001iExim Auth failed2025-11-18 00:07:57 dovecot_login authenticator failed for ([222.170.255.146]) [222.170.255.146]:43595: 535 Incorrect authentication data (set_id=flavio.oliveira)222.170.255.1461814991~ W' ossec9708iDovecot Aborted Login with empty userNov 18 00:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2+/Kw9VDxIuxV3kv>177.87.121.473469034Y}  -?' ossec13001iExim Auth failed2025-11-18 00:07:09 dovecot_login authenticator failed for ([60.186.172.37]) [60.186.172.37]:53947: 535 Incorrect authentication data (set_id=financeiro)60.186.172.371814991_|  -I) ossec13001iExim Auth failed2025-11-18 00:07:43 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:48620: 535 Incorrect authentication data (set_id=isabellylisboa)125.19.160.2061269750\{  -A+ ossec13001iExim Auth failed2025-11-18 00:07:28 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:41795: 535 Incorrect authentication data (set_id=leandro)183.167.193.1271814991jz  -_) ossec13001iExim Auth failed2025-11-18 00:07:16 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:55307: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)193.169.28.2442017370my  -e) ossec13001iExim Auth failed2025-11-18 00:07:14 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:30790: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)111.61.177.1871814991Yx  -?' ossec13001iExim Auth failed2025-11-18 00:06:13 dovecot_login authenticator failed for ([116.230.66.81]) [116.233.6.238]:51766: 535 Incorrect authentication data (set_id=financeiro)116.233.6.2381814991w  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:07:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034rv  -o) ossec13001iExim Auth failed2025-11-18 00:06:54 dovecot_login authenticator failed for ([36.112.104.162]) [36.112.104.162]:56956: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)36.112.104.1621814991Zu  -A' ossec13001iExim Auth failed2025-11-18 00:06:52 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:56031: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001  v \ g o p @M  W' ossec9708inDovecot Aborted Login with empty userNov 18 00:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001ilExim Auth failed2025-11-18 00:09:31 dovecot_login authenticator failed for ([182.225.134.13]) [182.225.134.13]:51633: 535 Incorrect authentication data (set_id=compras)182.225.134.131835841`  -O' ossec13001ifExim Auth failed2025-11-18 00:09:25 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53640: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795)  e%+ ossec9710ifDovecot Auth failed on disconnected session.Nov 18 00:09:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<8LZqytVD2JZ57bKF>121.237.178.1331814991f  -]% ossec13001i^Exim Auth failed2025-11-18 00:09:18 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:51068: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)41.72.202.86192950\ -C' ossec13001i\Exim Auth failed2025-11-18 00:09:15 dovecot_login authenticator failed for (vidaengenharia.com.br) [112.122.54.54]:1082: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991l  -c) ossec13001iLExim Auth failed2025-11-18 00:09:00 dovecot_login authenticator failed for ([58.121.175.167]) [58.121.175.167]:50294: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)58.121.175.1671835841  3G' ossec11301iLNew FTP connection.Nov 18 00:08:59 hosting pure-ftpd: (?@205.210.31.89) [INFO] New connection from 205.210.31.89205.210.31.896252001o  -g+ ossec13001i:Exim Auth failed2025-11-18 00:08:42 dovecot_login authenticator failed for ([111.225.207.166]) [111.225.207.166]:44898: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)111.225.207.1661814991,  e/' ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 00:08:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991{  -) ossec13001i"Exim Auth failed2025-11-18 00:08:18 dovecot_login authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:43686: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)60.223.245.1201814991t  -w% ossec13001iJExim Auth failed2025-11-18 00:08:58 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:37859: 535 Incorrect authentication data (set_id=rafael)80.14.56.1163017382q  -m) ossec13001i:Exim Auth failed2025-11-18 00:08:41 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:34155: 535 Incorrect authentication data (set_id=eduardo)61.245.141.2252077456 W' ossec9708i0Dovecot Aborted Login with empty userNov 18 00:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&  3O+ ossec11301iNew FTP connection.Nov 18 00:08:14 hosting pure-ftpd: (?@162.142.125.118) [INFO] New connection from 162.142.125.118162.142.125.1186252001\  -C) ossec13001iExim Auth failed2025-11-18 00:07:32 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:55462: 535 Incorrect authentication data (set_id=aureovieira)191.36.154.1753469034  { t NbY$]" -C) ossec13001iExim Auth failed2025-11-18 00:11:35 dovecot_login authenticator failed for (User) [177.74.174.120]:59644: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)177.74.174.1203469034! W' ossec9708iDovecot Aborted Login with empty userNov 18 00:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:11:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:11:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.17115628221  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:11:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991(  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:11:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001Y  -=) ossec13001iExim Auth failed2025-11-18 00:10:59 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:36436: 535 Incorrect authentication data (set_id=contato)116.171.27.2481814991h  -]' ossec13001iExim Auth failed2025-11-18 00:10:45 dovecot_login authenticator failed for ([118.39.230.40]) [118.39.230.40]:4259: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)118.39.230.401835841"  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:10:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<51Ikz9VD1OgnaoFh>39.106.129.971814991 W' ossec9708iDovecot Aborted Login with empty userNov 18 00:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i  -a' ossec13001iExim Auth failed2025-11-18 00:10:30 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:62955: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.42987950  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:10:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:10:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 1 , 51  eA' ossec9710isDovecot Auth failed on disconnected session.Nov 18 00:13:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651V0  -9' ossec13001icExim Auth failed2025-11-18 00:13:37 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:34182: 535 Incorrect authentication data (set_id=contato)114.98.235.341814991./  e1) ossec9710iVDovecot Auth failed on disconnected session.Nov 18 00:13:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<8V+y2NVDEteYNbyQ>152.53.188.1442921044/. e5% ossec9710iPDovecot Auth failed on disconnected session.Nov 18 00:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<4KZV2NVD/Jcv+wDY>47.251.0.2166252001-  W' ossec9708i"Dovecot Aborted Login with empty userNov 18 00:12:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034<,  -) ossec13001iExim Auth failed2025-11-18 00:12:08 dovecot_login authenticator failed for (User) [177.74.174.120]:59644: 535 Incorrect authentication data177.74.174.1203469034k+  -_+ ossec13001i8Exim Auth failed2025-11-18 00:12:55 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:57061: 535 Incorrect authentication data (set_id=bqtz)203.198.173.14518197300*  e7' ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 00:12:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<3inE1tVDto1SnOdL>82.156.231.751814991d)  -S) ossec13001iExim Auth failed2025-11-18 00:12:30 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:61544: 535 Incorrect authentication data (set_id=ferramentaria)122.144.14.2041210997q(  -o' ossec13001iExim Auth failed2025-11-18 00:12:14 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:35438: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)175.115.29.391835841'  k' ossec9709i>Multiple Dovecot Aborted Logins with empty userNov 18 00:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+MN019VDZJyxV3kv>177.87.121.473469034(&  e'' ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 00:12:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<6Grm1tVD6qSkXF7M>164.92.94.2046252001%  - ) ossec13001i(Exim Auth failed2025-11-18 00:12:40 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:36342: 535 Incorrect authentication data (set_id=bqtz@iemif.com)125.23.155.1101269750]$  -M! ossec13001iExim Auth failed2025-11-18 00:12:02 dovecot_login authenticator failed for 45-238-2-7.netmaisfibra.net.br [45.238.2.7]:44094: 535 Incorrect authentication data (set_id=contato)45.238.2.73469034j#  -a' ossec13001iExim Auth failed2025-11-18 00:11:36 dovecot_login authenticator failed for ([111.53.121.99]) [111.53.121.99]:43295: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)111.53.121.991814991  f z B(,?  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:14:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001> W' ossec9708iDovecot Aborted Login with empty userNov 18 00:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342=  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:14:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001x<  -# ossec13001iExim Auth failed2025-11-18 00:14:18 dovecot_login authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:37506: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)111.70.32.61668284v;  -u+ ossec13001iExim Auth failed2025-11-18 00:14:58 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:52389: 535 Incorrect authentication data (set_id=vendas.luiz)122.187.229.1191269750b:  -O) ossec13001iiExim Auth failed2025-11-18 00:13:44 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:53570: 535 Incorrect authentication data (set_id=info)121.202.143.881819730-9  e3% ossec9710ieDovecot Auth failed on disconnected session.Nov 18 00:13:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<7rGZ2dVD9tB3xBIC>119.196.18.218358418 W' ossec9708i]Dovecot Aborted Login with empty userNov 18 00:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8+pH2dVDGKmxV3kv>177.87.121.47346903447  e?' ossec9710iPDovecot Auth failed on disconnected session.Nov 18 00:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822h6  -_% ossec13001i_Exim Auth failed2025-11-18 00:13:33 dovecot_login authenticator failed for ([1.83.124.138]) [1.83.124.138]:10261: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)1.83.124.138181499145  eC# ossec9710iiDovecot Auth failed on disconnected session.Nov 18 00:13:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<6QPL2dVDvulCYSpH>66.97.42.713865483x4  -{) ossec13001iRExim Auth failed2025-11-18 00:13:22 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:47782: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)177.135.67.189346903443  {-# ossec9711iPMultiple Dovecot authentication failures on disconnect.Nov 18 00:13:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001*2 e-# ossec9710iNDovecot Auth failed on disconnected session.Nov 18 00:13:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001  nYb1M W' ossec9708iDovecot Aborted Login with empty userNov 18 00:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5ZUE5NVDSu2xV3kv>177.87.121.473469034+L  e)+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 00:16:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<6tiS49VDMLx9gnHM>125.130.113.2041835841-K  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:15:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<3WHP3tVDpMSl0iHB>165.210.33.1932233387sJ  -s' ossec13001iExim Auth failed2025-11-18 00:16:05 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:41707: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)161.8.241.17120774561I  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:15:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001\H  -K! ossec13001iExim Auth failed2025-11-18 00:15:46 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:54030: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)59.51.87.91814991#G  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:15:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060F  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/E  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:16:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841iD  -c' ossec13001iExim Auth failed2025-11-18 00:15:57 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:43020: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)65.20.250.16399237}C  -' ossec13001iExim Auth failed2025-11-18 00:15:55 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:59748: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.76.134.581269750"B  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:15:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<590E4dVDVoGYNbyQ>152.53.188.1442921044A  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d@  -U' ossec13001iExim Auth failed2025-11-18 00:15:27 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:2336: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)211.97.119.871814991 O9 ! 6 ; :ZpV'/O\]  -C) ossec13001iExim Auth failed2025-11-18 00:18:51 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:41076: 535 Incorrect authentication data (set_id=financeiro)121.73.163.1812186224g\  -_% ossec13001iExim Auth failed2025-11-18 00:18:50 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55441: 535 Incorrect authentication data (set_id=serivce@cleservicosindustriais.com.br)62.60.131.40130758p[  -k) ossec13001iExim Auth failed2025-11-18 00:18:38 dovecot_login authenticator failed for ([118.123.116.93]) [118.123.116.93]:35556: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)118.123.116.931814991Z  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+Y  e-' ossec9710icDovecot Auth failed on disconnected session.Nov 18 00:17:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084X W' ossec9708iMDovecot Aborted Login with empty userNov 18 00:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fW  -W) ossec13001i9Exim Auth failed2025-11-18 00:17:13 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:50028: 535 Incorrect authentication data (set_id=marialuiza)116.98.104.1381562822\V  -A+ ossec13001iExim Auth failed2025-11-18 00:16:17 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:35960: 535 Incorrect authentication data (set_id=contato)186.179.253.2423382998VU  -7) ossec13001iExim Auth failed2025-11-18 00:16:09 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:33400: 535 Incorrect authentication data (set_id=info)171.217.70.1511814991#T  e% ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 00:16:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001wS  -w+ ossec13001i Exim Auth failed2025-11-18 00:16:23 dovecot_login authenticator failed for (nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:45303: 535 Incorrect authentication data (set_id=atualizacoes)122.187.230.1161269750gR  -Y) ossec13001iExim Auth failed2025-11-18 00:16:21 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:57986: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)195.222.57.1903277605hQ  -a# ossec13001iExim Auth failed2025-11-18 00:16:12 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:63102: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)46.44.24.402017370(P  e)% ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 00:16:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991SO  -7# ossec13001iExim Auth failed2025-11-18 00:16:37 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:47260: 535 Incorrect authentication data (set_id=marialuiza)39.74.74.441814991lN  -c) ossec13001iExim Auth failed2025-11-18 00:16:33 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:51160: 535 Incorrect authentication data (set_id=aureovieira)110.175.41.2172077456  u [ / s@&+j  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:20:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750+i  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:21:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.26.31.62, lip=200.150.196.245, TLS, session=<0gPM8tVDeil5Gh8+>121.26.31.621814991h W' ossec9708iDovecot Aborted Login with empty userNov 18 00:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/g  e3) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 00:20:41 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=216.194.174.27, lip=200.150.196.245, TLS, session=216.194.174.276252001,f  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:20:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044(e  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:20:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001/d  e3) ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 00:21:04 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=220.178.39.106, lip=200.150.196.245, TLS, session=220.178.39.1061814991)c  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:19:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<55+O7dVDFqid5hjP>157.230.24.2072921044(b  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:19:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730a W' ossec9708iDovecot Aborted Login with empty userNov 18 00:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342`  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:19:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730._  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:18:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822^  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:19:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  y ~ [ 6Q.1H'x  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:22:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=178.216.29.143, lip=200.150.196.245, TLS, session=178.216.29.143798544w W' ossec9708iyDovecot Aborted Login with empty userNov 18 00:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342v  e7+ ossec9710iwDovecot Auth failed on disconnected session.Nov 18 00:22:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001u  e% ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 00:21:07 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.64.30.151, lip=200.150.196.245, TLS, session=36.64.30.1511643084et  -U) ossec13001i_Exim Auth failed2025-11-18 00:22:07 dovecot_login authenticator failed for ([36.105.166.200]) [36.105.166.200]:47416: 535 Incorrect authentication data (set_id=andressa.financeiro)36.105.166.2001814991ys  -}) ossec13001iOExim Auth failed2025-11-18 00:21:50 dovecot_login authenticator failed for ([218.238.15.224]) [218.238.15.224]:34096: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)218.238.15.2241835841r  e' ossec9710iCDovecot Auth failed on disconnected session.Nov 18 00:21:39 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=120.28.151.87, lip=200.150.196.245, TLS, session=120.28.151.871694008aq  -O' ossec13001i)Exim Auth failed2025-11-18 00:21:13 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:55030: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.721819730!p  e) ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 00:21:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.61.176.243, lip=200.150.196.245, TLS, session=111.61.176.2431814991o  k' ossec9709i[Multiple Dovecot Aborted Logins with empty userNov 18 00:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wn  -{' ossec13001i=Exim Auth failed2025-11-18 00:21:33 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:65491: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)41.219.149.782328926m  W' ossec9708i=Dovecot Aborted Login with empty userNov 18 00:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5lDf9dVDZoOxV3kv>177.87.121.4734690341l  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:20:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197305k  eC% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:20:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382 *^QDxUH;.!|ozm`SF9,'[N   H ; | o b Y L ? ] P C 6 )  * f j b 4}pcVI</" U . !  S s yl_RE8+uh 2 %  ~qdWJ=0# 7WJk m #d ) - H  F' |o L  `SF9, ~  ;  : } p c V I < / "   zm 2186224? 2233387 2077456 2077456 2077456P 2233387 2077456 2077456 2077456 2077456 20774561 2077456 2077456 2077456 2077456 2233387 2077456 2077456R 2233387 2077456 2077456 ~ 2077456 h 2077456 . 2077456 2186224 2077456% 2077456$ 2077456$ 2077456$V 2077456! 2077456! 2077456 2077456 2233387E 2077456&R 2186224B 2077456.> 2077456- 2077456-= 2077456- 2077456,< 2077456* 2077456*Y 2077456( 2077456' 2077456' 2077456&t 2233387 2233387s 22333879 2233387 2233387\ 2233387 2233387 2233387 2233387 2233387 2233387 2233387K 2233387 2233387s 2233387I 2233387 2233387D 2233387 2233387 2233387} 2233387 2233387 2233387 2233387 22333879 2233387 2233387 2186224 2077456.W 2186224u 2186224! 2077456. 2186224 2077456/o 2077456/l 2233387 7 2233387 2233387 2233387  2233387 . 2233387 2233387 2233387 Y 2233387 @ 2233387 2233387 U 2233387 5 2233387 2233387 2233387+ 2233387 2233387 2233387q 2233387 2233387 2233387 2233387J 2233387 2233387 2233387H 2233387) 2233387 2233387 2233387& 2233387 2215636$x 2215636n 2215636@ 2215636; 2186224) 2186224( 2186224( 2186224' 2186224& 2186224$ 2186224# 2186224# 2186224" 2186224" 2186224! 2186224 ( 2186224  2186224a 2186224| 2186224 2186224k  2186224 2186224X 2186224,p 2186224,o 2186224 2186224 2186224+} 2186224 2186224 2186224 2186224 2186224* 2186224* 2233387( 2233387 2233387 2233387E 2233387 22333870 2233387 2233387 e 2233387  2233387 2233387 2186224 2186224 2186224 2186224 2186224/# 2186224 2186224 2186224, 2186224 2186224,w 2186224 2186224 2186224 5 2186224 2186224\ w 2186224 2186224K 2186224 2186224 2186224! 2186224 T 2186224 H 2186224 2186224/, 2186224 2186224  2186224] 2186224 2233387P 2233387H 2186224-C - 2233387 `& 2186224- z 2233387' 2233387s 2233387I0[ 2233387 E 2233387 Aq 2233387M 22333870 2233387 ' 2233387  2186224 2186224 2186224 2233387 c ~mc  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  -w) ossec13001iExim Auth failed2025-11-18 00:23:12 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:50741: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)188.170.40.2312017370i  -]) ossec13001iExim Auth failed2025-11-18 00:23:09 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:33000: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)177.61.176.11034690342 e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:23:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044m  -i% ossec13001iExim Auth failed2025-11-18 00:23:41 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:42503: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)61.72.59.1061835841f  -U+ ossec13001iExim Auth failed2025-11-18 00:23:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51665: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034/ ;[' ossec13008iMail Recipient rejected2025-11-18 00:23:10 H=([127.0.1.1]) [104.243.245.4]:43600 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 587104.243.245.43996063Y  -=) ossec13001iExim Auth failed2025-11-18 00:24:01 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:38844: 535 Incorrect authentication data (set_id=contato)140.84.179.1283996063 W' ossec9708iDovecot Aborted Login with empty userNov 18 00:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(~  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:23:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251u}  -w' ossec13001iExim Auth failed2025-11-18 00:24:02 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:39760: 535 Incorrect authentication data (set_id=cpfnc2)177.0.238.1903469034h|  -Y+ ossec13001iExim Auth failed2025-11-18 00:23:48 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:54104: 535 Incorrect authentication data (set_id=contato)181.188.149.2433923057j{  -_) ossec13001iExim Auth failed2025-11-18 00:23:41 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:58378: 535 Incorrect authentication data (set_id=adriana)185.137.75.2273017382#z  e!# ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:23:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483.y  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:23:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730   ZA',0  e7' ossec9710iEDovecot Auth failed on disconnected session.Nov 18 00:25:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867w  -w+ ossec13001i7Exim Auth failed2025-11-18 00:25:42 dovecot_login authenticator failed for ([171.221.225.104]) [171.221.225.104]:25325: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)171.221.225.1041814991 W' ossec9708i-Dovecot Aborted Login with empty userNov 18 00:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:24:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520012  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:24:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822g  -[' ossec13001iExim Auth failed2025-11-18 00:25:07 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:51663: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)186.201.54.903469034}  -+ ossec13001iExim Auth failed2025-11-18 00:24:49 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:51282: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)113.158.205.2251861060&  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:24:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841/  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:24:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<5tV+ANZDnrUkMrBu>36.50.176.1101562822d  -Q+ ossec13001i Exim Auth failed2025-11-18 00:25:00 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55690: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651n -e) ossec13001i Exim Auth failed2025-11-18 00:25:00 dovecot_plain authenticator failed for (localhost.localdomain) [78.153.140.202]:59244: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)78.153.140.2022635167*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387p  -q# ossec13001iExim Auth failed2025-11-18 00:25:02 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:36088: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)64.49.97.156252001 Q  yQ$#  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:28:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758"  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:28:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r!  ;c' ossec13008ieMail Recipient rejected2025-11-18 00:26:28 H=([91.92.242.105]) [91.92.242.105]:52095 F= rejected RCPT : Nenhuma pessoa no endereço.91.92.242.1052750405/  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:27:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170  e# ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750   3G' ossec11301ikNew FTP connection.Nov 18 00:26:35 hosting pure-ftpd: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382 W' ossec9708iiDovecot Aborted Login with empty userNov 18 00:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  e/' ossec9710iEDovecot Auth failed on disconnected session.Nov 18 00:25:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084-  e/) ossec9710i1Dovecot Auth failed on disconnected session.Nov 18 00:25:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044i  -_' ossec13001i-Exim Auth failed2025-11-18 00:25:32 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:60226: 535 Incorrect authentication data (set_id=desenvolvimento2)103.148.92.571168579X  -?' ossec13001i'Exim Auth failed2025-11-18 00:25:27 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:55600: 535 Incorrect authentication data (set_id=formula316)37.210.246.54289688o  -g+ ossec13001iExim Auth failed2025-11-18 00:25:13 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:53174: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)211.169.212.2061835841,  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:25:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<5fKbAtZDZNtrhr+5>107.134.191.1856252001   -+ ossec13001iMExim Auth failed2025-11-18 00:26:04 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:54991: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)203.198.173.1451819730  E h 5X>@i1  -c# ossec13001i'Exim Auth failed2025-11-18 00:29:43 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:59962: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)77.34.2.1792017370$0  e## ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 00:29:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483p/  -m' ossec13001iExim Auth failed2025-11-18 00:29:23 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:60512: 535 Incorrect authentication data (set_id=administrativo1)71.235.27.13962520012.  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:29:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<7BKrEdZD3t92wSaf>118.193.38.1591819730*-  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:28:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841z,  -) ossec13001iExim Auth failed2025-11-18 00:28:37 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:47227: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)177.135.67.1893469034+ W' ossec9708iDovecot Aborted Login with empty userNov 18 00:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y*  -C% ossec13001iExim Auth failed2025-11-18 00:28:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55594: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758/) e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:28:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170Y(  -A' ossec13001iExim Auth failed2025-11-18 00:29:06 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:56579: 535 Incorrect authentication data (set_id=alex.vendas)94.205.250.782905577'  eC) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:27:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697503&  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:27:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822%  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,$  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:27:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170 f VvTqf@  -) ossec13001idExim Auth failed2025-11-18 00:30:43 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:41598: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)203.132.133.541269750_?  -G+ ossec13001iXExim Auth failed2025-11-18 00:30:31 dovecot_login authenticator failed for ([222.223.187.146]) [222.223.187.146]:49459: 535 Incorrect authentication data (set_id=assessoria)222.223.187.1461814991,>  e++ ossec9710iLDovecot Auth failed on disconnected session.Nov 18 00:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<43QiFdZDXu1w2eny>112.217.233.2421835841n=  -i' ossec13001iwExim Auth failed2025-11-18 00:31:02 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:41254: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)186.201.54.903469034\<  -I% ossec13001ioExim Auth failed2025-11-18 00:30:54 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55869: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758,;  e1% ossec9710igDovecot Auth failed on disconnected session.Nov 18 00:30:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841#:  e) ossec9710iLDovecot Auth failed on disconnected session.Nov 18 00:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387l9  -g% ossec13001iDExim Auth failed2025-11-18 00:30:10 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:33922: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)61.72.58.2421835841(8  e%) ossec9710iwDovecot Auth failed on disconnected session.Nov 18 00:31:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.14515628227  k' ossec9709iwMultiple Dovecot Aborted Logins with empty userNov 18 00:31:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t6  -u' ossec13001i Exim Auth failed2025-11-18 00:29:12 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:47618: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)182.42.113.101814991S5  -7# ossec13001i:Exim Auth failed2025-11-18 00:30:01 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:39434: 535 Incorrect authentication data (set_id=financeiro)14.98.28.4312697504 W' ossec9708iDovecot Aborted Login with empty userNov 18 00:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903403  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:29:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841s2  -q) ossec13001i6Exim Auth failed2025-11-18 00:29:56 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:38168: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)121.73.169.1672186224 \*R ~tj`VLB8.$zpRH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p 4 *   R H f \ > vlND:0&bX|hr^J@6,"TxndZPF( <2~LB8tj.`$Vpf\Rz | r h ^ T J @ 6 , "    x n d Z P F < 2 (  f\H>4*  vlbXND:0& i; i\: iR9 iP8 i< i~6 ix5 if4 if3 ib2 iP1 iF0 i@/ i.. i&- i", i+ i* i) i*( i*' i & i% i$ i# i" i! i i i i i i i i i i i i i i i i ij i i it it i i iR i8 i8 i6 i& i" iR i i i i i  i i i  i i i i i i i i i i i i i i i i i i i i i i if i` iJ id iT iH iF iF iB i@ i@ i i i i i i, i& i i i i i i i i i i i i i} i} ii iZ iy ie id iX iL iw io ig iw iw iL iD i: i6 i' i% i i i i  i i i i i i i i i i i i i i i ik ii ie iM iE iE i7 i1 i- i- i' i i i i i? i> i#a i!` if i_ i ^ ie id i] ic i\ i[ iZ iY iX iW iV iS iR iU iQ iT iP i[L iWK iUO iLN iBM i:J i*I i"H i G iF iE iD iC iB iA i@ i? i> i= i7 i i  i  i i i i i i i i} i i| i i i{ i iz i iy i~ i i i ix iyw iwv i_t i[o iOs iCr i=n i=m i9p i)q i%u i!d ii i g if ih il i)b ik ij ie ib ia i` ic i^ i] i\ i[ iZ i_ icY iMX i9W i'T i%P iO iN iM i L i S iR iV iQ iU iJ iF iE iD iC iI iH iB iA i@ iG iK i;   nozO5\xO  -y+ ossec13001iExim Auth failed2025-11-18 00:32:14 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:47310: 535 Incorrect authentication data (set_id=diretoria@holdingsantahelena.agr.br)220.201.218.1461814991VN  -9' ossec13001iExim Auth failed2025-11-18 00:32:12 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:36912: 535 Incorrect authentication data (set_id=compras)46.212.39.2013144096UM  -9% ossec13001iExim Auth failed2025-11-18 00:32:53 dovecot_login authenticator failed for ([59.10.56.129]) [59.10.56.129]:33104: 535 Incorrect authentication data (set_id=diretoria)59.10.56.1291835841UL  -9' ossec13001iExim Auth failed2025-11-18 00:32:51 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:42942: 535 Incorrect authentication data (set_id=contato)91.239.23.149458258K W' ossec9708iDovecot Aborted Login with empty userNov 18 00:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'J  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:31:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750qI  -s% ossec13001iExim Auth failed2025-11-18 00:31:34 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:39247: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)89.67.37.219798544H W' ossec9708iDovecot Aborted Login with empty userNov 18 00:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034aG  -M) ossec13001iExim Auth failed2025-11-18 00:31:11 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:45373: 535 Incorrect authentication data (set_id=alex.vendas)109.207.33.24862902528F  eG' ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 00:31:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084#E  e' ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 00:31:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.1371307582D  e9) ossec9710iiDovecot Auth failed on disconnected session.Nov 18 00:30:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730C  W' ossec9708iZDovecot Aborted Login with empty userNov 18 00:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+VoNFtZDPt+xV3kv>177.87.121.473469034SB  -5% ossec13001iyExim Auth failed2025-11-18 00:31:04 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:50876: 535 Incorrect authentication data (set_id=contato)221.145.5.141835841A  -' ossec13001ieExim Auth failed2025-11-18 00:30:45 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:53270: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)92.255.190.692017370  5  Yfctr^  -m+ ossec13001iFExim Auth failed2025-11-18 00:34:30 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:43788: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)194.179.135.1742661886b] -K+ ossec13001iFExim Auth failed2025-11-18 00:34:30 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51971: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034k\  -a) ossec13001iBExim Auth failed2025-11-18 00:34:26 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:33351: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)115.141.143.581835841[  - ) ossec13001i@Exim Auth failed2025-11-18 00:34:22 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:49820: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)177.174.95.2453469034oZ  -i) ossec13001i@Exim Auth failed2025-11-18 00:34:22 dovecot_login authenticator failed for ([194.230.82.157]) [194.230.82.157]:56532: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)194.230.82.15726584341Y  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:33:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<12t+IdZDfJprhr+5>107.134.191.1856252001X  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:33:24 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.208.188.232, lip=200.150.196.245, TLS, session=185.208.188.2323175395gV  -[) ossec13001iExim Auth failed2025-11-18 00:33:13 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:47817: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)102.23.254.239953987+U  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:33:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001T  k' ossec9709i,Multiple Dovecot Aborted Logins with empty userNov 18 00:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)S  e+' ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 00:33:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758eR  -W' ossec13001iExim Auth failed2025-11-18 00:32:38 dovecot_login authenticator failed for ([61.80.161.172]) [61.80.161.172]:57765: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)61.80.161.1721835841oQ  -i) ossec13001iExim Auth failed2025-11-18 00:32:37 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:60065: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)178.232.51.1353144096kP  -_+ ossec13001iExim Auth failed2025-11-18 00:32:31 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59400: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651 K'N  ) A '6,K]n -C) ossec13001iExim Auth failed2025-11-18 00:36:53 dovecot_login authenticator failed for (User) [177.74.174.120]:57376: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)177.74.174.1203469034am  -K+ ossec13001iExim Auth failed2025-11-18 00:36:27 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51820: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034Rl  -3% ossec13001iExim Auth failed2025-11-18 00:36:11 dovecot_login authenticator failed for ([59.46.182.10]) [59.46.182.10]:52759: 535 Incorrect authentication data (set_id=xavier)59.46.182.101814991k ;) ossec13008iMail Recipient rejected2025-11-18 00:36:15 H=(localhost.localdomain) [78.153.140.207]:39446 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167gj  -[' ossec13001iExim Auth failed2025-11-18 00:36:07 dovecot_login authenticator failed for ([58.35.120.169]) [58.35.120.169]:20678: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)58.35.120.1691814991ii  -a% ossec13001iExim Auth failed2025-11-18 00:35:55 dovecot_login authenticator failed for ([59.16.192.32]) [59.16.192.32]:50264: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)59.16.192.321835841-h  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:35:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730.g e1' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:35:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730mf  -c+ ossec13001iExim Auth failed2025-11-18 00:35:36 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:39210: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)219.152.206.1551814991e W' ossec9708iDovecot Aborted Login with empty userNov 18 00:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dd  -W% ossec13001ifExim Auth failed2025-11-18 00:35:00 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:53349: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)203.252.10.41835841Yc  -=) ossec13001i`Exim Auth failed2025-11-18 00:34:55 dovecot_login authenticator failed for ([203.193.147.37]) [203.193.147.37]:57997: 535 Incorrect authentication data (set_id=eduardo)203.193.147.371269750b W' ossec9708iJDovecot Aborted Login with empty userNov 18 00:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*a  e'+ ossec9710idDovecot Auth failed on disconnected session.Nov 18 00:34:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991U`  -7' ossec13001iTExim Auth failed2025-11-18 00:34:44 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:36496: 535 Incorrect authentication data (set_id=xavier)103.249.19.341643084U_  -7' ossec13001iHExim Auth failed2025-11-18 00:34:31 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:48634: 535 Incorrect authentication data (set_id=xavier)93.119.19.1722510769 Z ,  $ 2  , FQ7ZY~  -=) ossec13001i Exim Auth failed2025-11-18 00:37:46 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:55339: 535 Incorrect authentication data (set_id=contato)83.239.108.2182017370} W' ossec9708iDovecot Aborted Login with empty userNov 18 00:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q|  -k+ ossec13001iExim Auth failed2025-11-18 00:37:32 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:42606: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)128.185.227.1421269750B{  [a+ ossec5706i SSH insecure connection attempt (scan).Nov 18 00:37:47 hosting sshd[31602]: Did not receive identification string from 162.216.149.129 port 60232162.216.149.1296252001bz  -M+ ossec13001iExim Auth failed2025-11-18 00:37:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51523: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.1413469034y  - + ossec13001iExim Auth failed2025-11-18 00:37:10 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:45346: 535 Incorrect authentication data (set_id=sec.geral)122.162.240.14912697500x  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:38:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867nw  -m# ossec13001iExim Auth failed2025-11-18 00:37:57 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:60621: 535 Incorrect authentication data (set_id=envios@comercial.art.br)42.200.73.31819730pv  -m' ossec13001iExim Auth failed2025-11-18 00:37:04 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:54745: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)187.58.241.903469034yu  -{+ ossec13001iExim Auth failed2025-11-18 00:37:02 dovecot_login authenticator failed for ([196.200.112.238]) [196.200.112.238]:3029: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)196.200.112.2382328926t  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8lRVLdZDvpSxV3kv>177.87.121.473469034ns  -g) ossec13001iExim Auth failed2025-11-18 00:36:41 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:37947: 535 Incorrect authentication data (set_id=contato)24.112.109.2486252001kr  -c' ossec13001iExim Auth failed2025-11-18 00:36:38 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:16974: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)83.136.176.122510769q  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034pp  -q% ossec13001iExim Auth failed2025-11-18 00:36:30 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:39595: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)95.87.213.16732800\o  -C) ossec13001iExim Auth failed2025-11-18 00:36:27 dovecot_login authenticator failed for (218.pool90-160-135.dynamic.orange.es) [90.160.135.218]:54940: 535 Incorrect authentication data90.160.135.2182510769 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4'  1562822 1562822s 1562822i 1562822h 1562822Y 15628222 1562822" 1562822 1562822 1562822| 1562822d 1562822_ 1562822A 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822M 1562822' 1562822 1562822 1562822 1562822 1562822 1562822| 1562822X 15628221 1562822, 1562822 1562822 1562822 1562822 1562822 1562822 1562822o 1562822l 1562822g 1562822W 1562822J 1562822% 1562822 1562822 1562822 1562822 1562822 1562822 1562822z 1562822g 1562822] 1562822U 1562822< 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822~ 1562822h 1562822a 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822{ 1562822H 15628227 1562822. 1562822! 1562822 1562822 1562822 1562822 1562822_ 1562822W 15628227 1562822 1562822 1562822 1562822 1562822z 1562822g 1562822F 1562822; 1562822 1562822 1562822 1562822 1562822 1562822 1562822n 1562822e 1562822J 1562822 1562822 1562822 1562822 1562822 1562822 1562822i 1562822` 15628223 1562822% 1562822 1562822 1562822 1562822 1562822 1562822 1562822n 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822X 1562822R 15628228 1562822 1562822 1562822 1562822 1562822 1562822 1562822p 1562822j 1562822X 1562822J 1562822 1562822 1562822 1562822 1562822o 1562822^ 1562822R 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822l 1562822- 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 m 1562822 f 1562822 D 1562822 ) 1562822  1562822 1562822 1562822 1562822 y 1562822 n 1562822 m 1562822 d 1562822 ? 1562822 > 1562822 $ 1562822 1562822  1562822 1562822 1562822 1562822 1562822 1562822 1562822 } 1562822 m 1562822 Z 1562822 X 1562822 1 1562822  1562822 1562822 1562822 1562822 s 1562822 J 1562822 = 1562822  1562822  1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 j 1562822 e 1562822 ' 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822~ 1562822[ 1562822X 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822s 1562822d 1562822c 1562822F 15628220 1562822 1562822 1562822 1562822 1562822 1562822| 1562822z 1562822f 15628227 1562822# 1562822 1562822 1562822 1562822 1562822w 1562822_ 1562822E 1562822; 1562822* 1562822 1562822 1562822 v  X ,M3?v3  e;) ossec9710itDovecot Auth failed on disconnected session.Nov 18 00:39:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387  W' ossec9708itDovecot Aborted Login with empty userNov 18 00:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:40:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  e!% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:39:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370*  e)) ossec9710iRDovecot Auth failed on disconnected session.Nov 18 00:38:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044p  -i+ ossec13001i8Exim Auth failed2025-11-18 00:38:31 dovecot_login authenticator failed for ([222.139.245.70]) [222.139.245.137]:39378: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)222.139.245.1371814991 W' ossec9708i8Dovecot Aborted Login with empty userNov 18 00:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[  -?+ ossec13001i6Exim Auth failed2025-11-18 00:38:29 dovecot_login authenticator failed for ([128.185.252.110]) [128.185.252.110]:57400: 535 Incorrect authentication data (set_id=envios)128.185.252.1101269750(  e'' ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 00:38:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001B  [a+ ossec5706i"SSH insecure connection attempt (scan).Nov 18 00:38:10 hosting sshd[32104]: Did not receive identification string from 162.216.149.129 port 58434162.216.149.1296252001U  -7) ossec13001iRExim Auth failed2025-11-18 00:38:57 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:39995: 535 Incorrect authentication data (set_id=info)94.204.236.202290557  ;) ossec13008iMail Recipient rejected2025-11-18 00:37:16 H=(localhost.localdomain) [78.153.140.207]:43120 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167] -C) ossec13001iExim Auth failed2025-11-18 00:37:09 dovecot_login authenticator failed for (User) [177.74.174.120]:57376: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)177.74.174.1203469034*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:37:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841c  -U% ossec13001iExim Auth failed2025-11-18 00:37:50 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:49221: 535 Incorrect authentication data (set_id=envios@comercial.art.br)78.81.209.762017370  yd  -Q+ ossec13001iExim Auth failed2025-11-18 00:40:57 dovecot_login authenticator failed for ([221.149.233.246]) [221.149.233.246]:53353: 535 Incorrect authentication data (set_id=paulinho.vendas)221.149.233.2461835841Z  -A' ossec13001iExim Auth failed2025-11-18 00:40:48 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:53152: 535 Incorrect authentication data (set_id=atendimento)123.209.76.172077456 W' ossec9708iDovecot Aborted Login with empty userNov 18 00:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0QHOOdZD3umxV3kv>177.87.121.473469034'  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:40:30 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=191.53.129.193, lip=200.150.196.245, TLS, session=191.53.129.1933469034}  -+ ossec13001iExim Auth failed2025-11-18 00:40:21 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:44549: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)121.202.146.1441819730Z  -?) ossec13001iExim Auth failed2025-11-18 00:40:14 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:49394: 535 Incorrect authentication data (set_id=juridico)117.248.201.941269750}  -' ossec13001iExim Auth failed2025-11-18 00:40:57 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:58293: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)88.11.230.1602510769O  -/% ossec13001iExim Auth failed2025-11-18 00:40:50 dovecot_login authenticator failed for ([5.77.211.174]) [5.77.211.174]:55456: 535 Incorrect authentication data (set_id=info)5.77.211.174174982'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:40:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991t  -s) ossec13001iExim Auth failed2025-11-18 00:40:31 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:40392: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)125.20.228.1461269750i  -a% ossec13001iExim Auth failed2025-11-18 00:40:24 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:34189: 535 Incorrect authentication data (set_id=atendimento@lixadorajl.com.br)58.16.201.521814991&  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:40:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044%  e#% ossec9710ijDovecot Auth failed on disconnected session.Nov 18 00:39:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841m  -e) ossec13001iExim Auth failed2025-11-18 00:39:54 dovecot_login authenticator failed for ([121.73.162.213]) [121.73.162.213]:53944: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)121.73.162.2132186224/  e9# ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:39:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730 (  " (V,  -9' ossec13001i"Exim Auth failed2025-11-18 00:42:26 dovecot_login authenticator failed for ([218.22.187.67]) [218.22.187.66]:56322: 535 Incorrect authentication data (set_id=contato)218.22.187.661814991c+  -U' ossec13001iExim Auth failed2025-11-18 00:42:17 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64198: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795e*  -Y% ossec13001iExim Auth failed2025-11-18 00:42:15 dovecot_login authenticator failed for 82-64-205-45.subs.proxad.net [82.64.205.45]:32497: 535 Incorrect authentication data (set_id=ferramentaria)82.64.205.453017382n)  -g) ossec13001iExim Auth failed2025-11-18 00:42:08 dovecot_login authenticator failed for ([220.189.209.18]) [220.189.209.18]:35134: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)220.189.209.181814991(  W' ossec9708i*Dovecot Aborted Login with empty userNov 18 00:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034A'  [_+ ossec5706i*SSH insecure connection attempt (scan).Nov 18 00:42:32 hosting sshd[4679]: Did not receive identification string from 147.185.133.129 port 58952147.185.133.1296252001.&  e1+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 00:42:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758% W' ossec9708iDovecot Aborted Login with empty userNov 18 00:41:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034($  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:41:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001P#  -/% ossec13001iExim Auth failed2025-11-18 00:41:18 dovecot_login authenticator failed for ([111.62.42.70]) [111.62.42.70]:42978: 535 Incorrect authentication data (set_id=info)111.62.42.701814991v"  -w) ossec13001iExim Auth failed2025-11-18 00:41:16 dovecot_login authenticator failed for (host-94.198.134.241.vernet.su) [94.198.134.241]:58372: 535 Incorrect authentication data (set_id=envios@comercial.art.br)94.198.134.24120173706!  e?+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:42:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822q  -o' ossec13001iExim Auth failed2025-11-18 00:41:49 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:58796: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)70.174.168.956252001b  -Q' ossec13001iExim Auth failed2025-11-18 00:41:32 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:44312: 535 Incorrect authentication data (set_id=novamanha)152.231.25.643686110Q  -3% ossec13001iExim Auth failed2025-11-18 00:41:31 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:42142: 535 Incorrect authentication data (set_id=envios)95.35.29.192294640*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:41:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750  y>,:  e/' ossec9710i\Dovecot Auth failed on disconnected session.Nov 18 00:43:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520019 Sq' ossec11000iRLogin failed on the cpanel service.[2025-11-18 00:43:14 -0300] info [cpaneld] 66.23.230.106 - projetol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password66.23.230.1066252001"8  e% ossec9710iPDovecot Auth failed on disconnected session.Nov 18 00:43:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<7SstQ9ZDrrovT1jH>47.79.88.1991861060*7  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:44:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.119156282276  eE' ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 00:43:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651&5  e#' ossec9710ixDovecot Auth failed on disconnected session.Nov 18 00:43:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841s4  -s' ossec13001ifExim Auth failed2025-11-18 00:43:34 dovecot_login authenticator failed for ([111.57.17.172]) [111.57.17.172]:50412: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)111.57.17.17218149913 W' ossec9708ifDovecot Aborted Login with empty userNov 18 00:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z2  -) ossec13001ibExim Auth failed2025-11-18 00:43:29 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:62404: 535 Incorrect authentication data (set_id=vendas@arkson.com.br)107.175.76.1466252001U1  -;' ossec13001iPExim Auth failed2025-11-18 00:43:11 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:49935: 535 Incorrect authentication data (set_id=recepcao)65.20.179.251992370  k' ossec9709iFMultiple Dovecot Aborted Logins with empty userNov 18 00:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o/  -i) ossec13001i@Exim Auth failed2025-11-18 00:42:55 dovecot_login authenticator failed for ([90.160.139.163]) [90.160.139.163]:52949: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)90.160.139.1632510769*.  e+' ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 00:42:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822--  e/) ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 00:42:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730   Y@&.H  e/+ ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 00:46:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822pG  -m' ossec13001i Exim Auth failed2025-11-18 00:46:39 dovecot_login authenticator failed for ([219.248.4.146]) [219.248.4.146]:59134: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)219.248.4.1461835841F W' ossec9708iDovecot Aborted Login with empty userNov 18 00:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5IdPT9ZDspaxV3kv>177.87.121.4734690343E  e=' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:46:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001sD  -q) ossec13001iExim Auth failed2025-11-18 00:46:01 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:53834: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)179.184.218.493469034C  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7hSDTdZDlo6xV3kv>177.87.121.473469034B  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340A  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:44:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<0oBRSdZDHJNAF/Qn>64.23.244.396252001@ W' ossec9708iDovecot Aborted Login with empty userNov 18 00:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/?  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:44:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<8Z2hR9ZDor0tPZWl>45.61.149.16562520017>  eA+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:44:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<72t/R9ZDVreGx8nN>134.199.201.2056252001R=  -3% ossec13001iExim Auth failed2025-11-18 00:44:07 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:59497: 535 Incorrect authentication data (set_id=vendas)211.196.31.21835841i<  -[+ ossec13001iExim Auth failed2025-11-18 00:44:01 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:43522: 535 Incorrect authentication data (set_id=contato)185.183.103.1212635167$;  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:44:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001  c4 ,V  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:49:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730U  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qT  -m) ossec13001iExim Auth failed2025-11-18 00:48:15 dovecot_login authenticator failed for ([119.77.172.143]) [119.77.172.143]:4507: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)119.77.172.1431668284S  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034R  So% ossec11000iLogin failed on the cpanel service.[2025-11-18 00:48:53 -0300] info [cpaneld] 157.66.54.66 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password157.66.54.661643084[Q  -C' ossec13001iExim Auth failed2025-11-18 00:48:28 dovecot_login authenticator failed for ([111.26.218.96]) [111.26.218.97]:41944: 535 Incorrect authentication data (set_id=fabio.vendas)111.26.218.9718149911P  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:48:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<2okmVdZDKMCd5hjP>157.230.24.2072921044+O  e1# ossec9710iUDovecot Auth failed on disconnected session.Nov 18 00:47:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750)N e+% ossec9710iLDovecot Auth failed on disconnected session.Nov 18 00:47:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.332721037M  eA+ ossec9710iBDovecot Auth failed on disconnected session.Nov 18 00:47:14 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.100.107.238, lip=200.150.196.245, TLS, session=175.100.107.2381831722L  e) ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 00:47:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=218.27.205.159, lip=200.150.196.245, TLS, session=218.27.205.1591814991K W' ossec9708iWDovecot Aborted Login with empty userNov 18 00:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034BJ  [a+ ossec5706i:SSH insecure connection attempt (scan).Nov 18 00:47:05 hosting sshd[10791]: Did not receive identification string from 185.247.137.188 port 40479185.247.137.1882635167.I  e3' ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 00:46:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=220.246.36.42, lip=200.150.196.245, session=220.246.36.421819730   R #27%#d  e!# ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:50:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730jc  -a' ossec13001iExim Auth failed2025-11-18 00:50:08 dovecot_login authenticator failed for ([27.24.141.105]) [27.24.141.105]:45386: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)27.24.141.1051814991pb  -m' ossec13001i)Exim Auth failed2025-11-18 00:51:03 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:47456: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)182.95.46.1861269750}a  -) ossec13001i#Exim Auth failed2025-11-18 00:50:57 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:51806: 535 Incorrect authentication data (set_id=ieqcampocomprido)95.229.202.1973175395+`  e-' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 00:50:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<3hXMXtZDKpMnaoFh>39.106.129.971814991]_  -E) ossec13001iExim Auth failed2025-11-18 00:50:44 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:39212: 535 Incorrect authentication data (set_id=pastorpaulo)120.29.140.1401835841^ W' ossec9708i Dovecot Aborted Login with empty userNov 18 00:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m]  -e) ossec13001iExim Auth failed2025-11-18 00:50:26 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:48368: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)125.19.160.2061269750+\  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:50:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750)[  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:50:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750$Z  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:49:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<2xYVW9ZDUM3Bl4nP>193.151.137.207130758Y W' ossec9708iDovecot Aborted Login with empty userNov 18 00:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(X  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:49:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001W  ;) ossec13008iMail Recipient rejected2025-11-18 00:49:06 H=(localhost.localdomain) [78.153.140.207]:34948 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167 x & D  c1[x_s  -G+ ossec13001i{Exim Auth failed2025-11-18 00:52:26 dovecot_login authenticator failed for ([117.247.239.202]) [117.247.239.202]:47346: 535 Incorrect authentication data (set_id=formula316)117.247.239.2021269750Rr  -3% ossec13001iqExim Auth failed2025-11-18 00:52:16 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:37430: 535 Incorrect authentication data (set_id=rafael)36.135.62.831814991.q  e1) ossec9710ikDovecot Auth failed on disconnected session.Nov 18 00:52:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<0kVJY9ZDZMiYNbyQ>152.53.188.1442921044+p  e-' ossec9710icDovecot Auth failed on disconnected session.Nov 18 00:52:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001-o  e3% ossec9710iCDovecot Auth failed on disconnected session.Nov 18 00:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<3tbrYNZD3OR3xBIC>119.196.18.21835841#n  e% ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 00:51:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991mm  -c+ ossec13001ieExim Auth failed2025-11-18 00:52:04 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:45005: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)177.236.145.1883996063xl  -% ossec13001icExim Auth failed2025-11-18 00:52:01 dovecot_login authenticator failed for 221-120-4-33.emome-ip.hinet.net [221.120.4.33]:58373: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)221.120.4.331668284k  k' ossec9709icMultiple Dovecot Aborted Logins with empty userNov 18 00:52:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  W' ossec9708iEDovecot Aborted Login with empty userNov 18 00:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-i  e-+ ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 00:51:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841^h  -G) ossec13001i3Exim Auth failed2025-11-18 00:51:13 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:55790: 535 Incorrect authentication data (set_id=fabio.vendas)12.222.177.1466252001lg  -c) ossec13001iYExim Auth failed2025-11-18 00:51:52 dovecot_login authenticator failed for ([222.128.15.132]) [222.128.15.132]:43936: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)222.128.15.1321814991_f  -K' ossec13001iExim Auth failed2025-11-18 00:50:45 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:36865: 535 Incorrect authentication data (set_id=ieqcampocomprido)154.127.90.342440476e  -+ ossec13001iExim Auth failed2025-11-18 00:50:29 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:50895: 535 Incorrect authentication data (set_id=pastorpaulo@pibtrindade.com.br)223.197.153.1441819730 V y_7sl:`FVl  -c) ossec13001iExim Auth failed2025-11-18 00:53:44 dovecot_login authenticator failed for 221-120-57-174.emome-ip.hinet.net [221.120.57.174]:47790: 535 Incorrect authentication data (set_id=alex.vendas)221.120.57.1741668284 W' ossec9708iDovecot Aborted Login with empty userNov 18 00:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -9' ossec13001iExim Auth failed2025-11-18 00:53:29 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:40856: 535 Incorrect authentication data (set_id=adriana)182.95.50.1541269750.~  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:53:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991}  -% ossec13001iExim Auth failed2025-11-18 00:53:09 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:55500: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)181.54.70.403686110@|  [_) ossec5706iSSH insecure connection attempt (scan).Nov 18 00:52:42 hosting sshd[18962]: Did not receive identification string from 147.185.133.25 port 59986147.185.133.256252001${  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:52:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822z W' ossec9708iDovecot Aborted Login with empty userNov 18 00:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342y  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:52:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.18062520013x e=% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:52:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001!w  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:53:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991ev -Q+ ossec13001iExim Auth failed2025-11-18 00:52:51 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52284: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034Yu  -=) ossec13001iExim Auth failed2025-11-18 00:52:40 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:47626: 535 Incorrect authentication data (set_id=contato)111.26.106.1191814991+t  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<7N4QZdZDqIOKxX03>138.197.125.556252001   pd0B 1  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:54:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841j  -a' ossec13001iExim Auth failed2025-11-18 00:54:13 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:56844: 535 Incorrect authentication data (set_id=alex.vendas)96.56.228.14962520010  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:54:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  - ) ossec13001iExim Auth failed2025-11-18 00:54:32 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:58870: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)185.137.75.2273017382`  -K) ossec13001iExim Auth failed2025-11-18 00:54:32 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:56520: 535 Incorrect authentication data (set_id=administrativo1)125.19.253.1541269750  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -+ ossec13001iExim Auth failed2025-11-18 00:54:20 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [113.160.171.125]:36181: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)113.160.171.1251562822.  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:54:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001p  -i+ ossec13001iExim Auth failed2025-11-18 00:54:59 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:41710: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)222.108.177.1101835841k  -_+ ossec13001i Exim Auth failed2025-11-18 00:54:52 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:55289: 535 Incorrect authentication data (set_id=financeiro)121.202.140.1111819730|  - # ossec13001iExim Auth failed2025-11-18 00:53:11 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:46902: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)2.37.223.583175395#  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:54:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.22818610600  e;# ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:53:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483 Q  A S ol~d{Ug~Q)  e%+ ossec9710iaDovecot Auth failed on disconnected session.Nov 18 00:56:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841e  -U) ossec13001iEExim Auth failed2025-11-18 00:55:48 dovecot_login authenticator failed for ([220.180.204.31]) [220.180.204.31]:53518: 535 Incorrect authentication data (set_id=andressa.financeiro)220.180.204.311814991j  -a' ossec13001iAExim Auth failed2025-11-18 00:55:44 dovecot_login authenticator failed for ([143.202.145.6]) [143.202.145.6]:35456: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)143.202.145.638654835  eA' ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 00:55:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651i  -_' ossec13001iExim Auth failed2025-11-18 00:55:11 dovecot_login authenticator failed for ([200.195.67.82]) [200.195.67.82]:41304: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)200.195.67.823469034e  -U+ ossec13001i9Exim Auth failed2025-11-18 00:55:37 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:57020: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795 W' ossec9708i5Dovecot Aborted Login with empty userNov 18 00:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -a' ossec13001i1Exim Auth failed2025-11-18 00:55:28 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:49508: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)27.24.141.1121814991  - ) ossec13001iExim Auth failed2025-11-18 00:55:10 dovecot_login authenticator failed for line161-37.adsl.kirov.ru [89.254.228.161]:53769: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)89.254.228.1612017370`  -K) ossec13001iSExim Auth failed2025-11-18 00:56:02 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:39760: 535 Incorrect authentication data (set_id=isabellylisboa)116.171.27.2481814991j  -c% ossec13001iQExim Auth failed2025-11-18 00:55:59 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:58338: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)203.82.40.341694008X  -?% ossec13001i1Exim Auth failed2025-11-18 00:55:28 dovecot_login authenticator failed for ([111.26.63.85]) [111.26.63.85]:33550: 535 Incorrect authentication data (set_id=atualizacoes)111.26.63.851814991i  -_' ossec13001iExim Auth failed2025-11-18 00:55:09 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:42312: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)180.92.235.701210997y  -}) ossec13001i=Exim Auth failed2025-11-18 00:55:41 dovecot_login authenticator failed for ([112.25.253.122]) [112.25.253.122]:42804: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)112.25.253.1221814991O  -/# ossec13001i5Exim Auth failed2025-11-18 00:55:32 dovecot_login authenticator failed for ([110.16.40.3]) [110.16.40.3]:1820: 535 Incorrect authentication data (set_id=contato)110.16.40.31814991"  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:54:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<0thPa9ZDVOKYNbyQ>152.53.188.1442921044 6 T/JM6b-  -O) ossec13001iExim Auth failed2025-11-18 00:56:59 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:50726: 535 Incorrect authentication data (set_id=andre.nascimento)121.73.168.2342186224-,  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:56:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387y+  -{+ ossec13001iyExim Auth failed2025-11-18 00:56:40 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:3077: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)196.200.112.2372328926a*  -M) ossec13001i_Exim Auth failed2025-11-18 00:56:14 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:41961: 535 Incorrect authentication data (set_id=compras)46.212.117.1313144096!)  e+ ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 00:56:12 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=190.181.109.110, lip=200.150.196.245, TLS, session=190.181.109.11038654830(  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:57:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<7TqxdNZDgr9SnOdL>82.156.231.751814991' W' ossec9708iqDovecot Aborted Login with empty userNov 18 00:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u&  -s+ ossec13001ikExim Auth failed2025-11-18 00:56:26 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:36390: 535 Incorrect authentication data (set_id=financeiro)122.185.176.1261269750j%  -_) ossec13001iExim Auth failed2025-11-18 00:56:57 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:55498: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)103.233.92.1231269750,$  e-) ossec9710iyDovecot Auth failed on disconnected session.Nov 18 00:56:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.10420774565#  eA' ossec9710iwDovecot Auth failed on disconnected session.Nov 18 00:56:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822g"  -[' ossec13001iiExim Auth failed2025-11-18 00:56:23 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:38442: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)74.196.184.786252001q!  -m) ossec13001i[Exim Auth failed2025-11-18 00:56:10 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:44420: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)152.52.236.1581269750*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:57:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044 Q  yLWzQ%<  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:58:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991Y;  -=) ossec13001iExim Auth failed2025-11-18 00:58:22 dovecot_login authenticator failed for ([128.185.96.217]) [128.185.242.74]:44256: 535 Incorrect authentication data (set_id=contato)128.185.242.741269750q:  -o' ossec13001iExim Auth failed2025-11-18 00:58:25 dovecot_login authenticator failed for (58-115-53-172.twt1.com.tw) [58.115.53.172]:43654: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)58.115.53.1721668284)9  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:58:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=186.224.121.147, lip=200.150.196.245, TLS, session=186.224.121.147346903428  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:58:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.10518197307  -' ossec13001iExim Auth failed2025-11-18 00:58:47 dovecot_login authenticator failed for 223-22-241-32.mobile.dynamic.aptg.com.tw [223.22.241.32]:51575: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)223.22.241.321668284/6  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:58:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822k5  -a) ossec13001iExim Auth failed2025-11-18 00:58:07 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:36144: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)103.251.31.1661269750'4  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:57:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.5562520013  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2X6hdtZDhLGxV3kv>177.87.121.473469034P2  -3% ossec13001iExim Auth failed2025-11-18 00:57:30 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:38300: 535 Incorrect authentication data (set_id=rafael)65.20.174.63992371  W' ossec9708iDovecot Aborted Login with empty userNov 18 00:57:25 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 116 secs): user=<>, rip=115.231.78.11, lip=200.150.196.245, session=115.231.78.111814991]0  -C+ ossec13001iExim Auth failed2025-11-18 00:57:19 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:59722: 535 Incorrect authentication data (set_id=salamuni)171.244.199.1681562822o/  -g+ ossec13001iExim Auth failed2025-11-18 00:57:08 dovecot_login authenticator failed for ([121.131.220.139]) [121.131.220.139]:59762: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)121.131.220.1391835841.  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 00:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  cIr>J  W' ossec9708iaDovecot Aborted Login with empty userNov 18 01:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fI  -U+ ossec13001iQExim Auth failed2025-11-18 01:00:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51881: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034'H  e#) ossec9710iIDovecot Auth failed on disconnected session.Nov 18 01:00:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730G  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340F  e3+ ossec9710iwDovecot Auth failed on disconnected session.Nov 18 01:00:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001SE  -5% ossec13001ioExim Auth failed2025-11-18 01:00:47 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:56463: 535 Incorrect authentication data (set_id=contato)38.20.150.696251999D W' ossec9708i%Dovecot Aborted Login with empty userNov 18 00:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-C  e/) ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 00:59:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750(B  e'' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 00:59:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084&A  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:58:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730V@  -9' ossec13001iExim Auth failed2025-11-18 00:59:02 dovecot_login authenticator failed for ([111.57.17.172]) [111.57.17.172]:50694: 535 Incorrect authentication data (set_id=contato)111.57.17.1721814991d?  -Q+ ossec13001iExim Auth failed2025-11-18 00:59:00 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50611: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.23116056516>  eE% ossec9710iDovecot Auth failed on disconnected session.Nov 18 00:58:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382= W' ossec9708iDovecot Aborted Login with empty userNov 18 00:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0 @ 4 6252001p 6252001 6252001| 6252001x 6252001q 6252001j 6252001f 6252001b 6252001X 6252001@ 6252001> 62520012 62520011 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001| 6252001y 6252001x 6252001t 6252001p 6252001h 6252001X 6252001E 6252001A 6252001c 6252001b 6252001M 6252001A 6252001@ 6252001= 6252001& 6252001" 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001{ 6252001x 6252001l 6252001_ 6252001[ 6252001M 6252001B 6252001> 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001l 6252001h 6252001f 6252001Z 6252001V 6252001C 6252001- 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001{ 6252001p 6252001n 6252001m 6252001l 6252001k 6252001j 6252001h 6252001b 6252001^ 6252001[ 6252001Z 6252001Y 6252001Q 6252001H 6252001F 6252001D 6252001< 6252001/ 6252001, 6252001# 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001w 6252001s 6252001m 6252001_ 6252001Z 6252001O 6252001K 6252001J 6252001B 6252001A 62520018 6252001& 6252001# 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001} 6252001u 6252001s 6252001i 6252001] 6252001P 6252001C 6252001* 6252001' 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001v 6252001n 6252001a 6252001X 6252001R 6252001J 62520010 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 E ' F i ~uE,Z  e3# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:02:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<+BWhiNZD7tgXXz9j>23.95.63.996252001Y W' ossec9708iDovecot Aborted Login with empty userNov 18 01:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3gCGiNZDArWxV3kv>177.87.121.473469034kX  -a) ossec13001iExim Auth failed2025-11-18 01:03:00 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:59063: 535 Incorrect authentication data (set_id=rodrigo)220.246.43.1091819730,W  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:02:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001cV  -O+ ossec13001iExim Auth failed2025-11-18 01:02:44 dovecot_login authenticator failed for (drogariasbigfarma.com.br) [111.122.211.212]:37592: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991U W' ossec9708iDovecot Aborted Login with empty userNov 18 01:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -+ ossec13001iExim Auth failed2025-11-18 01:01:31 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:55237: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)201.173.216.1333996063S W+ ossec9708iDovecot Aborted Login with empty userNov 18 01:01:21 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034YR  -C% ossec13001iExim Auth failed2025-11-18 01:01:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63525: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758TQ  -7% ossec13001iExim Auth failed2025-11-18 01:02:06 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:52614: 535 Incorrect authentication data (set_id=juridico)203.252.10.41835841[P  -C) ossec13001iExim Auth failed2025-11-18 01:02:01 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:58806: 535 Incorrect authentication data (set_id=contato)94.154.217.188690791YO  -C' ossec13001iExim Auth failed2025-11-18 01:01:56 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:42452: 535 Incorrect authentication data (set_id=atualizacoes)65.20.251.17099237]N  -G) ossec13001iExim Auth failed2025-11-18 01:01:37 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:56540: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549uM  -u) ossec13001iExim Auth failed2025-11-18 01:01:52 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:59522: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)128.185.194.221269750lL  -e' ossec13001iExim Auth failed2025-11-18 01:01:42 dovecot_login authenticator failed for (dns58.online.tj.cn) [218.69.234.21]:41141: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)218.69.234.211814991lK  -g% ossec13001icExim Auth failed2025-11-18 01:00:35 dovecot_login authenticator failed for (ws6-94.maryno.net) [188.244.6.94]:55350: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)188.244.6.942017370 Q   v]i~Q)h  e%+ ossec9710iXDovecot Auth failed on disconnected session.Nov 18 01:04:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991gg  -Y) ossec13001iVExim Auth failed2025-11-18 01:04:36 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:34562: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)121.188.248.311835841pf  -k) ossec13001iExim Auth failed2025-11-18 01:03:34 dovecot_login authenticator failed for ([79.135.236.154]) [79.135.236.154]:51206: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)79.135.236.1542017370e  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(d  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:03:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251mc  -e) ossec13001iExim Auth failed2025-11-18 01:03:12 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:33373: 535 Incorrect authentication data (set_id=rodrigo)181.114.143.793865483b  k' ossec9709i4Multiple Dovecot Aborted Logins with empty userNov 18 01:04:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7zvejdZDstWxV3kv>177.87.121.473469034/a  e1+ ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 01:03:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841z`  -}+ ossec13001iExim Auth failed2025-11-18 01:03:10 dovecot_login authenticator failed for (drogariasbigfarma.com.br) [111.122.211.212]:42216: 535 Incorrect authentication data (set_id=admin@drogariasbigfarma.com.br)111.122.211.2121814991#_  e!# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:03:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483~^  -+ ossec13001iExim Auth failed2025-11-18 01:02:26 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:58156: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)185.183.103.1212635167e]  -[# ossec13001iExim Auth failed2025-11-18 01:02:14 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:27722: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)218.76.73.41814991V\  -9' ossec13001iExim Auth failed2025-11-18 01:02:43 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:56335: 535 Incorrect authentication data (set_id=rodrigo)27.223.98.1171814991)[  e+% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001 ** Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p R f \  H > 4 * vlND:0&bX|rhJ@6^,"Txnd2ZP(F< ~tj`VB8.$Lf\4*RH>zp | r h ^ T J @ 6 , "    x n d  vlbXND:0& iUj iMi i_b i[f iWk iMe i5d ikg iic i-a i` i_ i^ i ] i\ i[ iZ iY iX iW iV iU iT iS iR iQ iP iO iN iM ifL i^K iPJ iNI iNH iDG i2F i*E i"D i C i:B i,A i(@ i? i> i= i< i; i: i9 i8 i7 i6 i5 i4 i3 i2 i1 in0 il/ i. i- iv, i>+ i>* i6) i2( i(' i2& i% i$ i# i" iP! i i i i i i i i  i i i i i i i i i i i~ iv in i i i i6 i* i\ iB i i i i i i& i i i i i i i i i i i i i i| i if iR iF ij ih if iZ iX iV i i4 i* i i i i i i i i i i i i i i i i i i i i i i i i i iw io ic ia iQ iI i% i% i! i i i i i i ikq iem icp icl ick iYg iEj iCo i=i i5n i i i i i{ iy iQ iQ i= i9 i' i i i i~ i } i | i i i i iy ix iw i{ iv iz is ir iq iu ip io in im i}l iqt ioh i i i i i i i i i i i i i i i i i i i iy iy iw iq ik ii ia i_ i] i[ iS iQ iE iA i= i9 i5 i5 i3 i1 i1 i i2 i i i i i  i i i i i i i i i i i i i i i~ i i} iw iv i| i{ iu it iz iy ix i{s iqr  j 5 X >Z2R$' )v  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:07:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`u  -K) ossec13001iExim Auth failed2025-11-18 01:05:52 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:41320: 535 Incorrect authentication data (set_id=isabellylisboa)189.113.185.143469034t W' ossec9708iDovecot Aborted Login with empty userNov 18 01:05:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ys  -}) ossec13001iExim Auth failed2025-11-18 01:05:30 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:35823: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)220.178.246.431814991*r  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:05:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387\q  -I% ossec13001i|Exim Auth failed2025-11-18 01:05:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62604: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758$p  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:06:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841`o  -M' ossec13001ifExim Auth failed2025-11-18 01:04:52 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:52075: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730n W' ossec9708iRDovecot Aborted Login with empty userNov 18 01:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6t2pj9ZDduOxV3kv>177.87.121.473469034Ym  -?' ossec13001iFExim Auth failed2025-11-18 01:04:20 dovecot_login authenticator failed for ([118.121.234.5]) [118.121.234.5]:48324: 535 Incorrect authentication data (set_id=financeiro)118.121.234.518149911l  e7) ossec9710ijDovecot Auth failed on disconnected session.Nov 18 01:04:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<9RzskNZDMsuB4kCN>129.226.64.1411819730&k  e!) ossec9710ihDovecot Auth failed on disconnected session.Nov 18 01:04:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358411j  e9' ossec9710ifDovecot Auth failed on disconnected session.Nov 18 01:04:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.17915228673i  e9+ ossec9710iZDovecot Auth failed on disconnected session.Nov 18 01:04:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<5/4TkNZD3Jdns7yS>103.179.188.1461562822 . u;}H. W' ossec9708iBDovecot Aborted Login with empty userNov 18 01:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:07:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   3G' ossec11301iNew FTP connection.Nov 18 01:07:32 hosting pure-ftpd: (?@117.40.114.11) [INFO] New connection from 117.40.114.11117.40.114.1118149916  eA) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:07:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750)  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:07:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430844  e;+ ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 01:08:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 ~  e# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:07:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750l}  -a+ ossec13001iExim Auth failed2025-11-18 01:06:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55507: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651S|  -5% ossec13001iExim Auth failed2025-11-18 01:06:47 dovecot_login authenticator failed for ([36.135.62.82]) [36.135.62.83]:33748: 535 Incorrect authentication data (set_id=adriana)36.135.62.831814991f{  -U+ ossec13001iExim Auth failed2025-11-18 01:06:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52143: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034z  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034yy  -{+ ossec13001iExim Auth failed2025-11-18 01:06:27 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:53071: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)124.246.114.1111880251 x  S{) ossec11000iLogin failed on the cpanel service.[2025-11-18 01:06:10 -0300] info [webmaild] 177.220.174.45 - anderson@implementarconsultoria.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect177.220.174.453469034(w  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:06:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001  Y  -=) ossec13001iExim Auth failed2025-11-18 01:10:18 dovecot_login authenticator failed for ([178.169.78.196]) [178.169.78.196]:58570: 535 Incorrect authentication data (set_id=eliezer)178.169.78.1962017370  -+ ossec13001iExim Auth failed2025-11-18 01:11:06 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:43778: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)122.148.199.1652077456p  -k) ossec13001iExim Auth failed2025-11-18 01:11:02 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:52068: 535 Incorrect authentication data (set_id=administrativo1)27.124.111.1222077456`  ;?' ossec13008iMail Recipient rejected2025-11-18 01:10:39 H=(localhost) [179.0.178.104]:60873 F= rejected RCPT : Unrouteable address179.0.178.1043469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034F  -' ossec13001iExim Auth failed2025-11-18 01:09:43 dovecot_login authenticator failed for ([122.139.16.200]) [119.51.252.26]:48400: 535 Incorrect authentication data119.51.252.261814991  W' ossec9708i~Dovecot Aborted Login with empty userNov 18 01:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -]+ ossec13001ivExim Auth failed2025-11-18 01:09:26 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:47265: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)222.108.177.1101835841$  e## ossec9710inDovecot Auth failed on disconnected session.Nov 18 01:09:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483i  -[+ ossec13001iExim Auth failed2025-11-18 01:10:02 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:5163: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)171.244.199.1681562822  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -C) ossec13001iExim Auth failed2025-11-18 01:09:52 dovecot_login authenticator failed for ([121.148.184.47]) [121.148.184.47]:59279: 535 Incorrect authentication data (set_id=marialuiza)121.148.184.471835841)  e%+ ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 01:08:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<0L8lndZDcOlrhr+5>107.134.191.1856252001d  -U' ossec13001i*Exim Auth failed2025-11-18 01:08:09 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:50270: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)213.234.8.1142017370.  e5% ossec9710i\Dovecot Auth failed on disconnected session.Nov 18 01:08:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841 [ }Z[$#  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:12:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758S"  -5% ossec13001iExim Auth failed2025-11-18 01:12:08 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:41954: 535 Incorrect authentication data (set_id=contato)14.99.61.2481269750!  k' ossec9709iPMultiple Dovecot Aborted Logins with empty userNov 18 01:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001iExim Auth failed2025-11-18 01:12:05 dovecot_login authenticator failed for (syn-075-138-108-057.res.spectrum.com) [75.138.108.57]:52214: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)75.138.108.576252001 W+ ossec9708iDovecot Aborted Login with empty userNov 18 01:11:47 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034d  -U' ossec13001iExim Auth failed2025-11-18 01:11:45 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:53965: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)77.211.31.2222510769  -) ossec13001iExim Auth failed2025-11-18 01:11:41 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:50305: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)198.71.106.1026252001|  -% ossec13001iExim Auth failed2025-11-18 01:11:38 dovecot_login authenticator failed for cable-89-216-24-21.static.sbb.rs [89.216.24.21]:59018: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)89.216.24.216290252[  -A) ossec13001iExim Auth failed2025-11-18 01:11:28 dovecot_login authenticator failed for ([223.82.116.176]) [223.82.116.176]:1168: 535 Incorrect authentication data (set_id=financeiro)223.82.116.1761814991n  -k% ossec13001i Exim Auth failed2025-11-18 01:11:54 dovecot_login authenticator failed for broadband-37-110-40-20.ip.moscow.rt.ru [37.110.40.20]:58328: 535 Incorrect authentication data (set_id=fabio.vendas)37.110.40.202017370#  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:11:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387(  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:10:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822t  -u' ossec13001iExim Auth failed2025-11-18 01:10:48 dovecot_login authenticator failed for ([103.190.91.99]) [103.190.91.99]:37308: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)103.190.91.991269750.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:10:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841 f! ~f,2  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:14:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<3wtms9ZDJLgtPZWl>45.61.149.1656252001l1  -e' ossec13001iExim Auth failed2025-11-18 01:14:07 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:39982: 535 Incorrect authentication data (set_id=ieqcampocomprido)47.18.200.2426252001|0  - # ossec13001inExim Auth failed2025-11-18 01:13:34 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:44778: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)103.59.4.361269750/ W' ossec9708ilDovecot Aborted Login with empty userNov 18 01:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n.  -g) ossec13001iExim Auth failed2025-11-18 01:13:53 dovecot_login authenticator failed for 110-25-105-224.adsl.fetnet.net [110.25.105.224]:43304: 535 Incorrect authentication data (set_id=ieqcampocomprido)110.25.105.2241668284r-  -o) ossec13001iExim Auth failed2025-11-18 01:13:53 dovecot_login authenticator failed for ([113.218.214.16]) [113.218.214.16]:46974: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)113.218.214.161814991r,  -o) ossec13001ivExim Auth failed2025-11-18 01:13:42 dovecot_login authenticator failed for ([219.138.90.104]) [219.138.90.104]:46517: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)219.138.90.1041814991#+  e' ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 01:12:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=109.70.204.63, lip=200.150.196.245, TLS, session=109.70.204.633175395(*  e+# ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 01:12:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750f)  -U+ ossec13001i6Exim Auth failed2025-11-18 01:12:37 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52423: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034(  W' ossec9708i2Dovecot Aborted Login with empty userNov 18 01:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]'  -E) ossec13001i(Exim Auth failed2025-11-18 01:12:23 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:46040: 535 Incorrect authentication data (set_id=alex.vendas)195.222.57.18332776055&  eA' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 01:12:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084/%  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:12:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<1DD6qtZDMomB4kCN>129.226.64.1411819730[$  -?+ ossec13001iExim Auth failed2025-11-18 01:12:10 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:41626: 535 Incorrect authentication data (set_id=cpanel)103.158.138.1791269750  )A  - + ossec13001i,Exim Auth failed2025-11-18 01:16:43 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:36324: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)203.198.173.1371819730.@  e/+ ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 01:16:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<7eryutZDbs1rhr+5>107.134.191.1856252001 ? -#' ossec13001iExim Auth failed2025-11-18 01:16:16 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:54622: 535 Incorrect authentication data (set_id=rodrigo@rreguimaraes.com.br)189.31.138.383469034)>  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:15:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001=  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<42T7ttZDJoqxV3kv>177.87.121.473469034U<  -5) ossec13001iExim Auth failed2025-11-18 01:15:23 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:60976: 535 Incorrect authentication data (set_id=edna)152.52.210.1181269750Q;  -3' ossec13001iExim Auth failed2025-11-18 01:15:07 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:57580: 535 Incorrect authentication data (set_id=edna)65.20.251.17099237:  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z9  -% ossec13001iExim Auth failed2025-11-18 01:15:57 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:40855: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)91.126.40.542510769_8  -K' ossec13001iExim Auth failed2025-11-18 01:14:55 dovecot_login authenticator failed for ([117.32.97.246]) [117.32.97.246]:43382: 535 Incorrect authentication data (set_id=marcelo.pinheiro)117.32.97.2461814991.7 e1' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:14:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730`6  -O% ossec13001iExim Auth failed2025-11-18 01:14:12 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:55620: 535 Incorrect authentication data (set_id=fabio.vendas)14.203.9.1302077456~5  -) ossec13001iExim Auth failed2025-11-18 01:14:39 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:43062: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)122.186.244.341269750o4  -m% ossec13001iExim Auth failed2025-11-18 01:14:38 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:50250: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)90.173.78.9025107693 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 )B ( P  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oO  -i) ossec13001iExim Auth failed2025-11-18 01:18:23 dovecot_login authenticator failed for (nsg-corporate-78.243.186.122.airtel.in) [122.186.243.78]:35484: 535 Incorrect authentication data (set_id=contato)122.186.243.781269750zN  -) ossec13001iExim Auth failed2025-11-18 01:18:07 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:53306: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)110.25.112.1451668284M  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:19:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6wuJw9ZD7tOxV3kv>177.87.121.473469034eL  -S+ ossec13001ifExim Auth failed2025-11-18 01:17:41 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:46772: 535 Incorrect authentication data (set_id=ieqcampocomprido)197.219.228.2421036973K W' ossec9708i^Dovecot Aborted Login with empty userNov 18 01:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]J -C) ossec13001iPExim Auth failed2025-11-18 01:17:19 dovecot_login authenticator failed for (User) [177.74.174.120]:58182: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)177.74.174.1203469034[I  -?+ ossec13001iNExim Auth failed2025-11-18 01:17:17 dovecot_login authenticator failed for ([183.167.198.120]) [183.167.198.120]:56875: 535 Incorrect authentication data (set_id=bianca)183.167.198.1201814991H  -') ossec13001iNExim Auth failed2025-11-18 01:17:17 dovecot_login authenticator failed for (94x181x191x152.static-business.penza.ertelecom.ru) [94.181.191.152]:58214: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)94.181.191.1522017370~G  -) ossec13001iDExim Auth failed2025-11-18 01:17:07 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:47938: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)195.159.217.7131440960F  e7' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 01:16:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867*E  e)) ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 01:16:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044D W' ossec9708i"Dovecot Aborted Login with empty userNov 18 01:16:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034cC  -S' ossec13001i Exim Auth failed2025-11-18 01:16:09 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33589: 535 Incorrect authentication data (set_id=xavier)42.200.70.1341819730SB  -5% ossec13001i:Exim Auth failed2025-11-18 01:16:57 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:55400: 535 Incorrect authentication data (set_id=contato)111.26.63.871814991  z M yYo?^1^ W' ossec9708iDovecot Aborted Login with empty userNov 18 01:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)]  e') ossec9710i Dovecot Auth failed on disconnected session.Nov 18 01:20:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697503\  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:19:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387&[  3O+ ossec11301iNew FTP connection.Nov 18 01:19:50 hosting pure-ftpd: (?@193.138.218.203) [INFO] New connection from 193.138.218.203193.138.218.2032661886,Z  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<+OIaxtZDItekXLll>164.92.185.1012921044fY  -U+ ossec13001iExim Auth failed2025-11-18 01:19:29 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:40264: 535 Incorrect authentication data (set_id=secretarioadjunto)111.170.146.1771814991&X  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:19:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001rW  -m+ ossec13001iExim Auth failed2025-11-18 01:19:08 dovecot_login authenticator failed for ([222.134.242.169]) [222.134.242.169]:51632: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)222.134.242.1691814991V  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:20:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347U  Ac+ ossec11302iFTP Authentication failed.Nov 18 01:19:55 hosting pure-ftpd: (?@193.138.218.203) [WARNING] Authentication failed for user [OIxlhfZ8<]193.138.218.2032661886)T  e+% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:19:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841&S  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:19:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<6GZixNZD4KKnR+bm>167.71.230.2301269750,R  e3# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:18:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730(Q  e)% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370    K1l  e;' ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 01:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.1391307580k  e9% ossec9710iWDovecot Auth failed on disconnected session.Nov 18 01:21:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841%j  e!' ossec9710iUDovecot Auth failed on disconnected session.Nov 18 01:21:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001ki  -c' ossec13001iMExim Auth failed2025-11-18 01:21:32 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:56518: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)125.23.228.8612697507h  eA+ ossec9710ioDovecot Auth failed on disconnected session.Nov 18 01:22:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<4rBYztZDGIRns7yS>103.179.188.1461562822g  k' ossec9709ikMultiple Dovecot Aborted Logins with empty userNov 18 01:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034@f  [_) ossec5706i[SSH insecure connection attempt (scan).Nov 18 01:21:45 hosting sshd[24097]: Did not receive identification string from 162.216.150.72 port 59498162.216.150.726252001e  W' ossec9708iMDovecot Aborted Login with empty userNov 18 01:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-d  e-+ ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 01:21:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991c  - ) ossec13001iiExim Auth failed2025-11-18 01:21:59 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:41832: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)138.59.146.1643469034Vb  -9' ossec13001i_Exim Auth failed2025-11-18 01:21:50 dovecot_login authenticator failed for ([71.193.140.76]) [71.193.140.76]:44222: 535 Incorrect authentication data (set_id=contato)71.193.140.766252001ba  -O) ossec13001i-Exim Auth failed2025-11-18 01:21:00 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:47452: 535 Incorrect authentication data (set_id=envios)116.98.104.1381562822`  -' ossec13001iExim Auth failed2025-11-18 01:20:44 dovecot_login authenticator failed for (11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:39279: 535 Incorrect authentication data (set_id=envios@comercial.art.br)125.64.209.111814991*_  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:20:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841  t A @G"dz  -Q+ ossec13001iExim Auth failed2025-11-18 01:23:31 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51834: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.14134690346y  eA) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:23:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=200.141.211.58, lip=200.150.196.245, TLS, session=200.141.211.5834690347x  eA+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:23:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001]w -C) ossec13001iExim Auth failed2025-11-18 01:23:34 dovecot_login authenticator failed for (User) [177.74.174.120]:60729: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)177.74.174.1203469034bv  -Q' ossec13001iExim Auth failed2025-11-18 01:23:33 dovecot_login authenticator failed for ([36.135.107.57]) [36.135.107.57]:59978: 535 Incorrect authentication data (set_id=andressa.financeiro)36.135.107.571814991*u  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:22:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991,t  e-) ossec9710iqDovecot Auth failed on disconnected session.Nov 18 01:22:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730us  -y' ossec13001iExim Auth failed2025-11-18 01:23:03 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:50968: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)91.75.106.225290557}r  -+ ossec13001iExim Auth failed2025-11-18 01:23:00 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:47752: 535 Incorrect authentication data (set_id=contato)122.179.134.1201269750/q  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:22:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.3962520012p e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:22:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044o  - ) ossec13001iExim Auth failed2025-11-18 01:22:47 dovecot_login authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:37842: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)109.202.61.15520173704n  e=) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:22:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730m W' ossec9708iDovecot Aborted Login with empty userNov 18 01:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 8 a 3\l80  e5) ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 01:25:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<6sxe2tZDzOWd5hjP>157.230.24.2072921044l  -e' ossec13001i'Exim Auth failed2025-11-18 01:25:09 dovecot_login authenticator failed for (95-165-81-180.dynamic.spd-mgts.ru) [95.165.81.180]:61359: 535 Incorrect authentication data (set_id=coordenacao)95.165.81.1802017370  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:24:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001-  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.10129210445  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:24:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<4po819ZDnNaWXx+e>150.95.31.1581605651  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:24:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:24:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822#  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:24:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=211.223.41.90, lip=200.150.196.245, TLS, session=211.223.41.901835841u~  -s+ ossec13001iExim Auth failed2025-11-18 01:24:47 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:23190: 535 Incorrect authentication data (set_id=coordenacao@maringasoldas.com.br)171.244.140.1341562822'}  e%' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 01:24:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<3ACQ19ZD6pk7GIXF>59.24.133.19718358416|  eC' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 01:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001{ W' ossec9708iDovecot Aborted Login with empty userNov 18 01:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  l ? :R/v  -y' ossec13001iExim Auth failed2025-11-18 01:27:49 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:56995: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)103.148.92.571168579  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e/# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:27:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<6Pmu4dZDnOkXXz9j>23.95.63.996252001,  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:27:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:28:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d  -U' ossec13001iExim Auth failed2025-11-18 01:27:57 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:41202: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)111.26.61.2441814991a  -K+ ossec13001iExim Auth failed2025-11-18 01:27:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52245: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034j  -]+ ossec13001iExim Auth failed2025-11-18 01:27:41 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:56406: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)178.178.194.1372017370.  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:27:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822)  e%+ ossec9710i{Dovecot Auth failed on disconnected session.Nov 18 01:26:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001 W' ossec9708iyDovecot Aborted Login with empty userNov 18 01:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340  e7' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 01:25:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001(  e'' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 01:25:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822 W' ossec9708i=Dovecot Aborted Login with empty userNov 18 01:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  iA{#  -' ossec13001iExim Auth failed2025-11-18 01:29:10 dovecot_login authenticator failed for broadband-188-32-79-237.ip.moscow.rt.ru [188.32.79.237]:36442: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)188.32.79.2372017370*"  e)) ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 01:29:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750$!  e## ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:29:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730&  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:29:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<5dmG59ZDjpGP9IUv>143.244.133.471269750u  -s+ ossec13001iGExim Auth failed2025-11-18 01:29:58 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:59931: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)203.193.137.2501269750,  e3# ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 01:29:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750\  -E' ossec13001iMExim Auth failed2025-11-18 01:30:04 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:42572: 535 Incorrect authentication data (set_id=ferramentaria)183.182.99.921655842{  -' ossec13001iIExim Auth failed2025-11-18 01:30:01 dovecot_plain authenticator failed for (wd0ea9bcl7ydd6meaei95d4m4akonv) [45.144.52.234]:29082: 535 Incorrect authentication data (set_id=mariacecilia@adlondrina.com.br)45.144.52.234660013,  e-) ossec9710iEDovecot Auth failed on disconnected session.Nov 18 01:29:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<45ZT6tZDqpWKxX03>138.197.125.556252001 W' ossec9708i-Dovecot Aborted Login with empty userNov 18 01:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g  -W+ ossec13001iExim Auth failed2025-11-18 01:28:29 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:35598: 535 Incorrect authentication data (set_id=marialuiza)178.232.116.1653144096W  -;' ossec13001iExim Auth failed2025-11-18 01:28:16 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:42429: 535 Incorrect authentication data (set_id=recepcao)184.151.88.2762519997  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:28:07 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.68.179.38, lip=200.150.196.245, TLS, session=185.68.179.383175395   aH[e4( u1  -u) ossec13001iExim Auth failed2025-11-18 01:31:09 dovecot_login authenticator failed for ([208.69.161.192]) [208.69.161.192]:59078: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)208.69.161.19262520010  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:31:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  -) ossec13001i{Exim Auth failed2025-11-18 01:30:50 dovecot_login authenticator failed for (nsg-corporate-78.243.186.122.airtel.in) [122.186.243.78]:54472: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)122.186.243.781269750-.  e-+ ossec9710iuDovecot Auth failed on disconnected session.Nov 18 01:30:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841r-  -o) ossec13001iiExim Auth failed2025-11-18 01:30:32 dovecot_login authenticator failed for ([219.129.105.50]) [219.129.105.50]:34972: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)219.129.105.501814991i,  -]) ossec13001i]Exim Auth failed2025-11-18 01:30:20 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:52208: 535 Incorrect authentication data (set_id=contato)177.61.176.1103469034+  W' ossec9708iiDovecot Aborted Login with empty userNov 18 01:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+YCl7NZDQoOxV3kv>177.87.121.4734690340* e7% ossec9710igDovecot Auth failed on disconnected session.Nov 18 01:30:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001))  e)' ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 01:30:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<2s+p69ZDqJukXF7M>164.92.94.2046252001l(  -e' ossec13001iOExim Auth failed2025-11-18 01:30:07 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:45670: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)222.120.176.61835841n'  -k% ossec13001i?Exim Auth failed2025-11-18 01:29:51 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:34857: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)117.135.6.101814991.&  e1) ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 01:29:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.14429210443%  e9+ ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 01:29:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001o$  -i) ossec13001i3Exim Auth failed2025-11-18 01:29:38 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:49313: 535 Incorrect authentication data (set_id=aureovieira)116.48.149.1231819730  _ we@  -S+ ossec13001iExim Auth failed2025-11-18 01:32:28 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63140: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651p?  -k) ossec13001iExim Auth failed2025-11-18 01:32:09 dovecot_login authenticator failed for ([39.152.138.179]) [39.152.138.178]:46614: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)39.152.138.1781814991^>  -G) ossec13001iExim Auth failed2025-11-18 01:33:01 dovecot_login authenticator failed for ([112.25.253.122]) [112.25.253.122]:60086: 535 Incorrect authentication data (set_id=atualizacoes)112.25.253.1221814991l=  -i# ossec13001iExim Auth failed2025-11-18 01:32:44 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:40285: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)187.93.2.863469034*<  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:31:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841t;  -u' ossec13001iExim Auth failed2025-11-18 01:31:49 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:47734: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)37.46.160.1752661886\:  -A+ ossec13001iExim Auth failed2025-11-18 01:31:43 dovecot_login authenticator failed for ([109.233.215.154]) [109.233.215.154]:57806: 535 Incorrect authentication data (set_id=adriana)109.233.215.1542017370v9  -w) ossec13001iExim Auth failed2025-11-18 01:31:31 dovecot_login authenticator failed for ([178.46.148.174]) [178.46.148.174]:45376: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)178.46.148.1742017370n8  -g) ossec13001iExim Auth failed2025-11-18 01:31:29 dovecot_login authenticator failed for (host-94.198.134.241.vernet.su) [94.198.134.241]:58386: 535 Incorrect authentication data (set_id=paulinho.vendas)94.198.134.2412017370d7  -Q+ ossec13001iExim Auth failed2025-11-18 01:32:04 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:56594: 535 Incorrect authentication data (set_id=administrativo1)128.185.211.1021269750"6  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:31:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<3rCH8dZDOpiYNbyQ>152.53.188.1442921044/5  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:31:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991q4  -q% ossec13001iExim Auth failed2025-11-18 01:31:48 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:54022: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)160.25.58.1916430843 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903452  e?) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:31:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730 n# 8 ] C M ^-*Mphn0P  e;# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:33:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483hO  -_% ossec13001iExim Auth failed2025-11-18 01:33:27 dovecot_login authenticator failed for ([125.90.72.62]) [125.90.72.62]:47024: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)125.90.72.621814991VN  -9' ossec13001iExim Auth failed2025-11-18 01:33:19 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:57726: 535 Incorrect authentication data (set_id=compras)128.185.187.21269750%M  e!' ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 01:33:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991[L  -G' ossec13001i'Exim Auth failed2025-11-18 01:33:42 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:44130: 535 Incorrect authentication data (set_id=isabellylisboa)65.20.205.19799237YK  -;+ ossec13001iExim Auth failed2025-11-18 01:32:57 dovecot_login authenticator failed for ([121.131.220.141]) [121.131.220.141]:46601: 535 Incorrect authentication data (set_id=edna)121.131.220.1411835841YJ  -?' ossec13001iExim Auth failed2025-11-18 01:32:56 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:43299: 535 Incorrect authentication data (set_id=financeiro)188.231.3.2463017382I -) ossec13001iExim Auth failed2025-11-18 01:32:19 dovecot_login authenticator failed for broadband-188-32-104-175.ip.moscow.rt.ru [188.32.104.175]:59958: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)188.32.104.1752017370-H  e3% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:32:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001kG  -a) ossec13001iExim Auth failed2025-11-18 01:32:54 dovecot_login authenticator failed for ([210.22.130.22]) [58.246.241.234]:54235: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)58.246.241.2341814991rF  -o) ossec13001iExim Auth failed2025-11-18 01:32:43 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:39836: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)128.185.214.781269750E W' ossec9708iDovecot Aborted Login with empty userNov 18 01:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034WD  -9) ossec13001iExim Auth failed2025-11-18 01:32:23 dovecot_login authenticator failed for (46.243.179.116.leadertelecom.ru) [46.243.179.116]:42070: 535 Incorrect authentication data46.243.179.1162017370gC  -[' ossec13001iExim Auth failed2025-11-18 01:32:58 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:57017: 535 Incorrect authentication data (set_id=assessoria)179.184.33.863469034lB  -c) ossec13001iExim Auth failed2025-11-18 01:32:55 dovecot_login authenticator failed for ([200.46.214.104]) [200.46.214.110]:33888: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)200.46.214.1103703430iA  -_' ossec13001iExim Auth failed2025-11-18 01:32:46 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:38706: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)161.8.241.1712077456  & 0  + 4(_  e%) ossec9710iyDovecot Auth failed on disconnected session.Nov 18 01:35:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001l^  -c) ossec13001iqExim Auth failed2025-11-18 01:34:56 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:47710: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)103.140.18.1861269750] W' ossec9708iYDovecot Aborted Login with empty userNov 18 01:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034R\  -3% ossec13001iOExim Auth failed2025-11-18 01:34:23 dovecot_login authenticator failed for ([31.130.35.29]) [31.130.35.29]:58545: 535 Incorrect authentication data (set_id=rafael)31.130.35.292017370/[  e7% ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 01:34:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<3Sv++NZDkN9vAEul>111.0.75.1651814991#Z  e% ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 01:33:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<6wyZ+NZDtu0IiXsk>8.137.123.361814991"Y  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:33:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060PX  -/% ossec13001i Exim Auth failed2025-11-18 01:33:14 dovecot_login authenticator failed for ([27.39.128.68]) [27.39.128.68]:43508: 535 Incorrect authentication data (set_id=edna)27.39.128.681814991W  k' ossec9709i;Multiple Dovecot Aborted Logins with empty userNov 18 01:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034XV  -=' ossec13001i)Exim Auth failed2025-11-18 01:33:44 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:49094: 535 Incorrect authentication data (set_id=sec.geral)70.174.168.976252001%U  e!' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 01:33:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822YT  -C% ossec13001i Exim Auth failed2025-11-18 01:33:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64535: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758S  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034vR  -y' ossec13001iExim Auth failed2025-11-18 01:33:30 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:43496: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)180.92.235.701210997\Q  -A+ ossec13001iExim Auth failed2025-11-18 01:33:29 dovecot_login authenticator failed for ([176.100.124.153]) [176.100.124.153]:51536: 535 Incorrect authentication data (set_id=contato)176.100.124.1532017370    n  - ' ossec13001iExim Auth failed2025-11-18 01:36:32 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:58852: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)81.234.121.572661886qm  -m) ossec13001iExim Auth failed2025-11-18 01:36:01 dovecot_login authenticator failed for ([177.174.95.245]) [177.174.95.245]:45102: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)177.174.95.2453469034#l  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:35:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758k W' ossec9708iDovecot Aborted Login with empty userNov 18 01:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1gSJ/tZD/OuxV3kv>177.87.121.473469034[j  -?+ ossec13001iExim Auth failed2025-11-18 01:35:28 dovecot_login authenticator failed for ([27.123.105.234]) [128.185.192.166]:47412: 535 Incorrect authentication data (set_id=adriana)128.185.192.1661269750`i  -I+ ossec13001iExim Auth failed2025-11-18 01:35:25 dovecot_login authenticator failed for (066249.telemar.net.br) [200.216.172.182]:34843: 535 Incorrect authentication data (set_id=contato)200.216.172.1823469034bh  -S% ossec13001iExim Auth failed2025-11-18 01:35:52 dovecot_login authenticator failed for ([111.0.126.86]) [111.0.126.86]:44886: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)111.0.126.861814991Yg  -=) ossec13001iExim Auth failed2025-11-18 01:35:41 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:48753: 535 Incorrect authentication data (set_id=contato)190.213.54.2023573591)f  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:35:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<077D/tZDDtR9gnHM>125.130.113.2041835841we  -{' ossec13001iExim Auth failed2025-11-18 01:35:29 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:37153: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)202.156.16.911880251jd  -]+ ossec13001iyExim Auth failed2025-11-18 01:35:04 dovecot_login authenticator failed for ([175.203.199.118]) [175.203.199.118]:8150: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)175.203.199.1181835841.c  e5% ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 01:34:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<8mct+9ZDTeR3xBIC>119.196.18.21835841)b  e') ossec9710iKDovecot Auth failed on disconnected session.Nov 18 01:34:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044}a  -) ossec13001iCExim Auth failed2025-11-18 01:34:10 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:52537: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)185.40.122.2502629691s`  -s' ossec13001i|Exim Auth failed2025-11-18 01:35:07 dovecot_login authenticator failed for ([60.12.106.119]) [60.12.106.119]:40412: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)60.12.106.1191814991     #Bi}  -_' ossec13001i&Exim Auth failed2025-11-18 01:37:56 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:35146: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.156.80.111269750u|  -u) ossec13001i Exim Auth failed2025-11-18 01:37:32 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:40162: 535 Incorrect authentication data (set_id=sac@compensadosparana.com.br)180.94.191.2191821275{ W' ossec9708i Dovecot Aborted Login with empty userNov 18 01:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034uz  -s+ ossec13001iExim Auth failed2025-11-18 01:37:10 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:36800: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)128.185.235.1101269750fy  -U+ ossec13001i&Exim Auth failed2025-11-18 01:37:57 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51604: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.14134690342x  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:37:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730w  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]v  -E) ossec13001iExim Auth failed2025-11-18 01:36:14 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:36370: 535 Incorrect authentication data (set_id=junior.gomes)180.148.10.1241210997Zu  -A' ossec13001iExim Auth failed2025-11-18 01:36:57 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:49176: 535 Incorrect authentication data (set_id=vendas.luiz)114.98.235.341814991Tt  -5' ossec13001iExim Auth failed2025-11-18 01:36:57 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:52538: 535 Incorrect authentication data (set_id=bruno)182.95.57.15812697503s  e?% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:36:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<6yq5AtdD1M0zTY0d>51.77.141.293017382sr  -q) ossec13001iExim Auth failed2025-11-18 01:36:41 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:52096: 535 Incorrect authentication data (set_id=contato)198.71.106.1026252001cq  -Y! ossec13001iExim Auth failed2025-11-18 01:36:27 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:48374: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)1.30.20.981814991up  -u) ossec13001iExim Auth failed2025-11-18 01:36:21 dovecot_login authenticator failed for ([46.163.174.216]) [46.163.174.216]:34670: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)46.163.174.2162017370o  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  I^X  -=) ossec13001iFExim Auth failed2025-11-18 01:38:28 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:52525: 535 Incorrect authentication data (set_id=eliezer)94.204.185.231290557g  -Y) ossec13001i8Exim Auth failed2025-11-18 01:38:14 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:48542: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)103.251.31.15412697503  e=' ossec9710ihDovecot Auth failed on disconnected session.Nov 18 01:39:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<6Vz7CtdDOuJSnOdL>82.156.231.751814991&  e!) ossec9710iRDovecot Auth failed on disconnected session.Nov 18 01:38:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<1relCddDxsukXLll>164.92.185.1012921044 W' ossec9708iJDovecot Aborted Login with empty userNov 18 01:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Q  -1% ossec13001iBExim Auth failed2025-11-18 01:38:24 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:56902: 535 Incorrect authentication data (set_id=contato)182.78.67.221269750o  -m' ossec13001i2Exim Auth failed2025-11-18 01:38:08 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:53420: 535 Incorrect authentication data (set_id=atualizacoes)149.210.37.163909037  eE' ossec9710iTDovecot Auth failed on disconnected session.Nov 18 01:38:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822`  -I+ ossec13001iExim Auth failed2025-11-18 01:37:39 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:47498: 535 Incorrect authentication data (set_id=vendas.luiz)111.171.127.1901835841_  -I) ossec13001i0Exim Auth failed2025-11-18 01:38:06 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:35378: 535 Incorrect authentication data (set_id=sac)116.98.104.13815628220  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:37:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730\  -I% ossec13001iExim Auth failed2025-11-18 01:37:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60251: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758,  e1% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:37:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841-  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:37:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841y~  -{+ ossec13001i*Exim Auth failed2025-11-18 01:38:00 dovecot_login authenticator failed for ([210.211.111.147]) [210.211.111.149]:25921: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)210.211.111.1491562822  j : G X?\. S  -7# ossec13001iExim Auth failed2025-11-18 01:39:42 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:40093: 535 Incorrect authentication data (set_id=financeiro)218.76.73.41814991/  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:39:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758(  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:39:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730&  e%% ossec9710ipDovecot Auth failed on disconnected session.Nov 18 01:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:40:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:40:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084_  -M% ossec13001iExim Auth failed2025-11-18 01:39:34 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:49243: 535 Incorrect authentication data (set_id=tassiane@louvoreterno.com.br)84.54.33.2052750405  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  -_+ ossec13001i~Exim Auth failed2025-11-18 01:39:25 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50050: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651o  -k) ossec13001izExim Auth failed2025-11-18 01:39:21 dovecot_login authenticator failed for ([46.210.107.161]) [46.210.107.161]:36426: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)46.210.107.161294640,  e++ ossec9710ixDovecot Auth failed on disconnected session.Nov 18 01:39:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<+nbkC9dDEpdns7yS>103.179.188.14615628222  e7+ ossec9710ipDovecot Auth failed on disconnected session.Nov 18 01:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001*  e)) ossec9710iXDovecot Auth failed on disconnected session.Nov 18 01:38:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750.  e1) ossec9710iLDovecot Auth failed on disconnected session.Nov 18 01:38:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387 * x n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f  \ R H > 4  * vbX:N0&Dl|rhJ@6^,T"xndZPF(<2 j~`tV8.$LB*  zpf\RH>4 | r h ^ T J @ 6 , "    vlbXND:0& i i i i i i i i i i i i i i i i iw i i i i{ i{ i ic iY iO iI iD~ i} i | i{ iz i+y i'x iw iv iu it is ir iq ip io in im il ixk ij iti iVh iVg iVf i@e i@d i0c i&b i6a i,` i&_ i^ i] i\ i[ iZ iY iX iW iV iU iT iS iR iQ iP iO iN iTM ijL ifK idJ idI i(H i$G iF iE i8D i(C iB iA i@ i? i> i= i< i ; i: i9 i8 i7 i6 i5 ij4 if3 ib2 iv1 in0 iB/ i:. i.- iN, i6+ i,* i") iX( i' i& i% i$ i# i" i! i i i i i i i i i ip i i i i i~ iz ix ip ih iX iT iR iL iJ iF iB i8 i2 i0 i* i& i& i i i i i  i  i i i i i i i i i i i i i i i i i i i i iE i? i9 i9 i5 i3 i- i' i i i i i i i i i i i i i i i i i i i i} i} iy iq io iO iI iC iA i? i; i5 i+ i i i i i i i i i i i i i i i| iy iy iq i_ iY iO iK iC i; i; i5 i5 i) i' i! i i i i i i i  i  i i i i i i i i i i i i i i i iZ i i i i i i i i i i i i i i i{ iu ii ii ig i] i[ iO iM iI iG     0*)  e)) ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 01:42:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251(  k' ossec9709iXMultiple Dovecot Aborted Logins with empty userNov 18 01:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347'  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:42:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651&  -/' ossec13001iExim Auth failed2025-11-18 01:41:27 dovecot_login authenticator failed for (3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:39630: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)124.239.129.21814991f%  -[% ossec13001iExim Auth failed2025-11-18 01:41:52 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:35172: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)36.135.62.871814991S$  -7# ossec13001iExim Auth failed2025-11-18 01:41:51 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:59158: 535 Incorrect authentication data (set_id=assessoria)8.209.221.71861060U#  -9% ossec13001iExim Auth failed2025-11-18 01:41:49 dovecot_login authenticator failed for ([220.67.139.254]) [221.145.5.14]:58322: 535 Incorrect authentication data (set_id=adriana)221.145.5.141835841" W' ossec9708iDovecot Aborted Login with empty userNov 18 01:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s!  -s' ossec13001iExim Auth failed2025-11-18 01:41:29 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:34734: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)121.73.163.192186224/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:42:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001q  -o' ossec13001iExim Auth failed2025-11-18 01:41:02 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:51454: 535 Incorrect authentication data (set_id=isabellylisboa)182.76.134.581269750{  -% ossec13001iExim Auth failed2025-11-18 01:40:49 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:58552: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)84.211.19.123144096 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -S+ ossec13001iExim Auth failed2025-11-18 01:40:20 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:60436: 535 Incorrect authentication data (set_id=andre.nascimento)121.178.185.1411835841w  -y) ossec13001iExim Auth failed2025-11-18 01:40:11 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:50936: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)103.171.12.1701269750 B n 99,IU;@Bz7  -}+ ossec13001iExim Auth failed2025-11-18 01:45:13 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:45819: 535 Incorrect authentication data (set_id=administrativo1)122.187.229.2471269750w6  -y) ossec13001iExim Auth failed2025-11-18 01:44:49 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:56878: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)190.117.96.17439324885 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8W26HtdDguWxV3kv>177.87.121.473469034p4  SE) ossec11000ijLogin failed on the cpanel service.[2025-11-18 01:43:20 -0300] info [cpaneld] 102.50.254.252 - OIxlhfZ8< "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified102.50.254.2522542007_3  -G+ ossec13001ifExim Auth failed2025-11-18 01:43:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51958: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034o2  -i+ ossec13001ibExim Auth failed2025-11-18 01:43:13 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:48552: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)102.215.188.1951929501 W' ossec9708ivDovecot Aborted Login with empty userNov 18 01:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<44UoG9dDFsSxV3kv>177.87.121.473469034|0  -' ossec13001inExim Auth failed2025-11-18 01:43:26 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:58950: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)76.132.238.4362520011/  e9' ossec9710iBDovecot Auth failed on disconnected session.Nov 18 01:42:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867.  W' ossec9708i:Dovecot Aborted Login with empty userNov 18 01:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,-  e-) ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 01:42:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456&,  e'# ossec9710iNDovecot Auth failed on disconnected session.Nov 18 01:42:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.7138654830+  e5) ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 01:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750g* -U+ ossec13001i,Exim Auth failed2025-11-18 01:42:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52270: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034  l z*xF  -{) ossec13001iExim Auth failed2025-11-18 01:46:19 dovecot_login authenticator failed for (122.55.143.46.static.pldt.net) [122.55.131.144]:33902: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)122.55.131.1441694008.E  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:46:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.14118197306D  eA) ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 01:46:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750WC  -=% ossec13001i(Exim Auth failed2025-11-18 01:46:32 dovecot_login authenticator failed for ([59.46.182.10]) [59.46.182.10]:50006: 535 Incorrect authentication data (set_id=atendimento)59.46.182.101814991nB  -i' ossec13001iExim Auth failed2025-11-18 01:46:00 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:36269: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)180.172.33.521814991#A  3K) ossec11301iNew FTP connection.Nov 18 01:45:54 hosting pure-ftpd: (?@148.113.193.59) [INFO] New connection from 148.113.193.59148.113.193.596251999b@  -Q' ossec13001iExim Auth failed2025-11-18 01:45:47 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:45128: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)111.93.80.1581269750?  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y>  -?' ossec13001iExim Auth failed2025-11-18 01:45:25 dovecot_login authenticator failed for ([95.66.220.207]) [95.66.220.207]:29586: 535 Incorrect authentication data (set_id=financeiro)95.66.220.2072017370n=  -k' ossec13001iExim Auth failed2025-11-18 01:45:14 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:33708: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)213.55.79.1953379960<  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:45:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822;  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 01:46:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6jUbJNdDqJyxV3kv>177.87.121.473469034\:  -A+ ossec13001iExim Auth failed2025-11-18 01:45:59 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:42078: 535 Incorrect authentication data (set_id=contato)200.149.213.2423469034*9  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:45:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387+8  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841  f<T  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iS  -a% ossec13001iExim Auth failed2025-11-18 01:48:19 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:60781: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)221.145.5.141835841-R  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:48:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<8sS6K9dDkoVrhr+5>107.134.191.1856252001'Q  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:49:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483ZP  -C% ossec13001iExim Auth failed2025-11-18 01:48:32 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:42729: 535 Incorrect authentication data (set_id=xavier)121.44.0.1442077456'O  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:48:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841N  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&M  e!) ossec9710iTDovecot Auth failed on disconnected session.Nov 18 01:47:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841+L  e-' ossec9710ijDovecot Auth failed on disconnected session.Nov 18 01:47:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084K W' ossec9708ifDovecot Aborted Login with empty userNov 18 01:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'J  e%' ossec9710idDovecot Auth failed on disconnected session.Nov 18 01:47:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001$I  e!' ossec9710idDovecot Auth failed on disconnected session.Nov 18 01:47:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758H W' ossec9708i(Dovecot Aborted Login with empty userNov 18 01:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8M/WJddDSqmxV3kv>177.87.121.473469034`G  -I+ ossec13001i$Exim Auth failed2025-11-18 01:46:27 dovecot_login authenticator failed for ([114.254.255.247]) [114.254.255.247]:36493: 535 Incorrect authentication data (set_id=alex.vendas)114.254.255.2471814991 T tAW*ETmc  -g+ ossec13001i0Exim Auth failed2025-11-18 01:50:55 dovecot_login authenticator failed for ([197.231.202.201]) [197.231.202.201]:55068: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)197.231.202.20151537ab  -O' ossec13001i&Exim Auth failed2025-11-18 01:50:45 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58974: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730)a  e-# ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 01:51:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001f`  -Y' ossec13001i,Exim Auth failed2025-11-18 01:50:51 dovecot_login authenticator failed for ([31.173.29.136]) [31.173.29.136]:57144: 535 Incorrect authentication data (set_id=envios@comercial.art.br)31.173.29.1362017370/_  e3) ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 01:50:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730^ W' ossec9708iDovecot Aborted Login with empty userNov 18 01:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/]  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:50:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822Z\  -E% ossec13001iExim Auth failed2025-11-18 01:50:24 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:42186: 535 Incorrect authentication data (set_id=paulinho.vendas)37.34.237.45285570q[  -q' ossec13001iExim Auth failed2025-11-18 01:49:59 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:39068: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)45.82.110.150660013Z  e# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:49:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750Y W' ossec9708iDovecot Aborted Login with empty userNov 18 01:49:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7D6fMNdDguqxV3kv>177.87.121.473469034VX  -9' ossec13001iExim Auth failed2025-11-18 01:49:24 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:56282: 535 Incorrect authentication data (set_id=contato)192.34.164.136252001+W  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:49:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841pV  -o% ossec13001iExim Auth failed2025-11-18 01:49:12 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:47190: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)84.211.19.1231440961U  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:48:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 e-K 2  [Ae.q e1' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:53:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.10518197300p  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:53:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730)o  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:53:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758 n  -) ossec13001iExim Auth failed2025-11-18 01:52:40 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:45120: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)72.239.139.16262520017m  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:52:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084l W' ossec9708iDovecot Aborted Login with empty userNov 18 01:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#k  e' ossec9710ixDovecot Auth failed on disconnected session.Nov 18 01:52:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<7TewOddDCro+PIOJ>62.60.131.137130758&j e%% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:52:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<5wHOO9dD+qTBHmEh>193.30.97.33272103i  k' ossec9709itMultiple Dovecot Aborted Logins with empty userNov 18 01:52:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0/6POddD9K+xV3kv>177.87.121.4734690340h  e5) ossec9710iVDovecot Auth failed on disconnected session.Nov 18 01:51:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841+g  e+) ossec9710iVDovecot Auth failed on disconnected session.Nov 18 01:51:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822f  W' ossec9708iVDovecot Aborted Login with empty userNov 18 01:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^e  -E+ ossec13001i@Exim Auth failed2025-11-18 01:51:12 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52069: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.1413469034Od  -/# ossec13001i@Exim Auth failed2025-11-18 01:51:11 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:52474: 535 Incorrect authentication data (set_id=envios)77.34.2.1792017370  V3WrB)_  -G+ ossec13001iIExim Auth failed2025-11-18 01:55:35 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51590: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034~ W' ossec9708iDDovecot Aborted Login with empty userNov 18 01:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$}  e## ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:54:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750|  W' ossec9708i Dovecot Aborted Login with empty userNov 18 01:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,{  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:54:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867az  -K+ ossec13001iExim Auth failed2025-11-18 01:54:10 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:39724: 535 Incorrect authentication data (set_id=junior.gomes)171.244.199.1681562822Xy  -A# ossec13001i+Exim Auth failed2025-11-18 01:55:06 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:51665: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999x  k' ossec9709i'Multiple Dovecot Aborted Logins with empty userNov 18 01:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*w  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:53:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044)v  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:53:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<82ayPtdDWNIv+yzS>47.251.44.2106252001 u -' ossec13001iExim Auth failed2025-11-18 01:53:22 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:61814: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)189.31.138.383469034|t  -' ossec13001iExim Auth failed2025-11-18 01:53:47 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:50736: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)200.89.159.593865483$s  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:53:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<6ES/PtdDvKml0iHB>165.210.33.1932233387r W' ossec9708iDovecot Aborted Login with empty userNov 18 01:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  x  -' ossec13001iExim Auth failed2025-11-18 01:58:06 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:34090: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)208.96.233.676251999l  -c) ossec13001iExim Auth failed2025-11-18 01:57:52 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:37144: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)152.52.246.1781269750  W' ossec9708iDovecot Aborted Login with empty userNov 18 01:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -[) ossec13001iExim Auth failed2025-11-18 01:57:11 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:49759: 535 Incorrect authentication data (set_id=adriana)95.210.105.2023175395]  -G) ossec13001iExim Auth failed2025-11-18 01:56:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:33884: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549k  -_+ ossec13001iwExim Auth failed2025-11-18 01:56:21 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:36450: 535 Incorrect authentication data (set_id=eliezer)213.238.254.1562661886a  -Q' ossec13001iExim Auth failed2025-11-18 01:56:41 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:57882: 535 Incorrect authentication data (set_id=contato)91.219.196.17690791  -+) ossec13001iExim Auth failed2025-11-18 01:56:41 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:45614: 535 Incorrect authentication data (set_id=lucas)179.48.229.1173469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 01:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  -e) ossec13001i{Exim Auth failed2025-11-18 01:56:27 dovecot_login authenticator failed for ([181.64.123.166]) [181.64.123.166]:46186: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)181.64.123.1663932488~  -+ ossec13001i{Exim Auth failed2025-11-18 01:56:26 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:60948: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)121.202.195.1941819730  -) ossec13001iExim Auth failed2025-11-18 01:56:48 dovecot_login authenticator failed for (213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:57255: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)213.142.48.1432017370v  -y' ossec13001icExim Auth failed2025-11-18 01:56:02 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:51400: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)177.174.15.693469034+  e-' ossec9710iYDovecot Auth failed on disconnected session.Nov 18 01:55:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520012  e7+ ossec9710iODovecot Auth failed on disconnected session.Nov 18 01:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001 5 %  " E  5]  -G' ossec13001iExim Auth failed2025-11-18 01:58:20 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:45730: 535 Incorrect authentication data (set_id=isabellylisboa)182.78.93.1901269750r  -o) ossec13001iExim Auth failed2025-11-18 01:58:09 dovecot_login authenticator failed for ([175.125.68.208]) [175.125.68.208]:46740: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)175.125.68.2081835841l  -c) ossec13001iExim Auth failed2025-11-18 01:58:02 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:59387: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)119.201.59.2241835841^  -M% ossec13001iExim Auth failed2025-11-18 01:57:54 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:51157: 535 Incorrect authentication data (set_id=loopert)2.55.122.202294640p  -k) ossec13001iExim Auth failed2025-11-18 01:57:48 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:52247: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)111.23.117.1081814991s  -u% ossec13001iExim Auth failed2025-11-18 01:57:31 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:47313: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)211.196.31.21835841p  -k) ossec13001iExim Auth failed2025-11-18 01:57:44 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:35591: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)103.144.37.1021269750(  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:57:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001-  e5# ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:57:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730'  e'% ossec9710iDovecot Auth failed on disconnected session.Nov 18 01:57:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<3NQKTNdDOppbejg7>91.122.56.592017370Y  -=) ossec13001iExim Auth failed2025-11-18 01:58:04 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:44190: 535 Incorrect authentication data (set_id=contato)158.222.23.2456252001\  -C) ossec13001iExim Auth failed2025-11-18 01:58:00 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:44682: 535 Incorrect authentication data (set_id=financeiro)120.157.27.2372077456  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 01:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -9' ossec13001iExim Auth failed2025-11-18 01:57:59 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:39634: 535 Incorrect authentication data (set_id=compras)45.82.109.136660013  - ) ossec13001iExim Auth failed2025-11-18 01:57:47 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:43124: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)195.159.217.713144096z  -' ossec13001iExim Auth failed2025-11-18 01:57:46 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:50622: 535 Incorrect authentication data (set_id=administrativo1)118.212.79.211814991 0reXK>1$ { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  oH.! | o b U H ; .|U !   y l _ R E 8 +   uh[NA4' ~qdWJ=;0# zm`SF9,vi\OB5(b=th\PD8, ~qdWJ0~qdWJ=0# 05n  2750405 2661886. 2750405u 2750405n 27504058 2750405 2750405 2750405 2750405P 27504053 272103.s 272103.j 272103, 272103*: 2635167. 2661886.@ 2510769.* 2510769- 2661886- 2510769- 2510769- 2658434- 2510769- 2542007-F 2661886-9 2510769, 2542007+ 2510769+ 2661886+y 2661886+Z 2661886+ 2661886* 2635167* 2510769* 272103) 272103'~ 272103% 272103 272103 @ 272103 272103 272103j 272103N 272103D 272103 272103 272103X 272103 2661886*X 2661886) 2661886( 2661886(u 2661886'Q 2661886': 2661886&Y 2661886$ 2661886$` 2661886$# 2661886# 2661886"M 2661886!" 2661886 2661886  2661886 2661886 2661886 2661886e 2661886= 2661886- 2661886 2661886n 2661886 2661886 2661886 2661886[ 2661886U 2661886 2661886w 2661886 2661886E 2661886@ 2661886 2661886 v 2661886  2661886 2661886 2661886 k 2661886 2661886E 2661886" 2661886 2661886 2661886 2661886 2661886 2661886v 2661886f 2661886F 2661886| 2661886s 2661886 2658434(^ 2658434 2658434 2658434 2658434I 2658434- 2658434 2658434 2635167*G 2635167* 2635167) 2635167#9 2635167! 2635167! 2635167 2635167 2635167 2635167z 2635167 2635167 2635167 2635167W 2635167J 2635167< 2635167 2635167 2635167 2635167 2635167 2635167 2635167S 2635167 2635167 26351671 2635167 2635167 2635167+ 2635167 2635167 > 2635167 2635167 r 2635167 J 2635167R 2635167 2635167D 2635167) 2635167 2635167[ 2635167 26351679 2635167 2635167 2635167 2629691 26296913 2629691` 2623032(4 2623032 2542007'C 2542007$r 2542007 2542007 2542007 25420074 2542007\ 2542007 2542007 2542007 U 2542007 ! 2542007 2542007 | 2542007v 2510769*1 2510769) 2510769( 2510769( 2510769( 2510769' 2510769' 2510769' 2510769'K 2510769'E 2510769', 2510769& 2510769& 2510769& 2510769&S 2510769& 2510769% 2510769% 2510769% 2510769% 2510769$ 2510769$, 2510769# 2510769  2510769 2510769 2510769 2510769 2510769~ 2510769X 2510769@ 2510769 2510769 25107699 25107694 2510769 2510769/ 2510769 2510769 2510769 2510769 2510769 2510769o 2510769C 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769| 2510769J 2510769 2510769 2510769 2510769 2510769 2510769 [ 2510769 2 2510769 2510769 2510769 W 2510769 0 2510769 / 2510769 2510769 i 2510769  2510769 2510769C 2510769// 2661886/ 2635167/ 2510769/ 2510769/ 2510769/] 2542007. 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 j 2750405 ? 2750405 : 27504054 27504051 2750405 2750405 2750405 2750405 2750405 2750405 2510769. %  9 < Z-;)-  e%+ ossec9710iADovecot Auth failed on disconnected session.Nov 18 01:59:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991g,  -]% ossec13001i;Exim Auth failed2025-11-18 01:59:38 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:39710: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)59.22.68.2131835841)+  e') ossec9710iIDovecot Auth failed on disconnected session.Nov 18 01:59:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730&*  e%% ossec9710iCDovecot Auth failed on disconnected session.Nov 18 01:59:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841) W' ossec9708i5Dovecot Aborted Login with empty userNov 18 01:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%(  e!' ossec9710i+Dovecot Auth failed on disconnected session.Nov 18 01:59:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001n'  -g) ossec13001iOExim Auth failed2025-11-18 01:59:58 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:48538: 535 Incorrect authentication data (set_id=contato)34.126.114.2391880251)&  e') ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 01:59:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750^%  -G) ossec13001iExim Auth failed2025-11-18 01:58:45 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:38195: 535 Incorrect authentication data (set_id=atualizacoes)190.114.243.873625428y$  -% ossec13001iExim Auth failed2025-11-18 01:58:42 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:55234: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)181.54.70.403686110T#  -7' ossec13001iExim Auth failed2025-11-18 01:58:36 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:41262: 535 Incorrect authentication data (set_id=igreja)45.82.109.136660013v"  -y' ossec13001iExim Auth failed2025-11-18 01:58:54 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:55836: 535 Incorrect authentication data (set_id=rafael)182.95.174.181269750! W' ossec9708iDovecot Aborted Login with empty userNov 18 01:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034n  -g) ossec13001iExim Auth failed2025-11-18 01:58:25 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:51247: 535 Incorrect authentication data (set_id=financeiro)220.246.46.1441819730e  -Y% ossec13001iExim Auth failed2025-11-18 01:58:25 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:41207: 535 Incorrect authentication data (set_id=igreja@pibtrindade.com.br)61.72.58.2421835841  zi{ante<  -Y% ossec13001iExim Auth failed2025-11-18 02:02:27 dovecot_login authenticator failed for 111-70-19-64.emome-ip.hinet.net [111.70.19.64]:33279: 535 Incorrect authentication data (set_id=financeiro)111.70.19.641668284^;  -G) ossec13001iExim Auth failed2025-11-18 02:02:23 dovecot_login authenticator failed for ([218.27.205.159]) [218.27.205.159]:35792: 535 Incorrect authentication data (set_id=atualizacoes)218.27.205.1591814991v:  -{% ossec13001iExim Auth failed2025-11-18 02:02:10 dovecot_login authenticator failed for 82-64-205-45.subs.proxad.net [82.64.205.45]:14521: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)82.64.205.453017382o9  -g+ ossec13001iExim Auth failed2025-11-18 02:01:45 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:41249: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)220.180.107.19318149918 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:01:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-7  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730Z6  -A' ossec13001iExim Auth failed2025-11-18 02:01:08 dovecot_login authenticator failed for ([27.24.141.111]) [27.24.141.111]:42650: 535 Incorrect authentication data (set_id=venesselume)27.24.141.1111814991[5  -C) ossec13001iExim Auth failed2025-11-18 02:01:01 dovecot_login authenticator failed for ([185.250.240.220]) [88.249.175.243]:6021: 535 Incorrect authentication data (set_id=formula316)88.249.175.243298795 4  -'' ossec13001i}Exim Auth failed2025-11-18 02:00:44 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:50204: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)61.95.198.138126975033  e?% ossec9710iyDovecot Auth failed on disconnected session.Nov 18 02:00:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<7jJFWNdDOLVAF/Qn>64.23.244.3962520012  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Hy+WddDcpOxV3kv>177.87.121.473469034f1  -U+ ossec13001iExim Auth failed2025-11-18 02:00:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51717: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034n0  -i' ossec13001i}Exim Auth failed2025-11-18 02:00:43 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:59088: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)167.250.118.33865483/  W' ossec9708iqDovecot Aborted Login with empty userNov 18 02:00:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343.  e;) ossec9710ioDovecot Auth failed on disconnected session.Nov 18 02:00:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387 v r =$@v4J  e;+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:03:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822'I e#) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:03:20 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=109.125.247.26, lip=200.150.196.245, TLS, session=109.125.247.267985444H  e=) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:03:13 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=117.187.66.166, lip=200.150.196.245, TLS, session=<+2ABYNdD/Lt1u0Km>117.187.66.1661814991+G  e+) ossec9710iGDovecot Auth failed on disconnected session.Nov 18 02:04:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841ZF  -?) ossec13001i;Exim Auth failed2025-11-18 02:03:54 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:49104: 535 Incorrect authentication data (set_id=unijovem)210.97.109.1921835841]E  -G' ossec13001i5Exim Auth failed2025-11-18 02:03:48 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:63492: 535 Incorrect authentication data (set_id=isabellylisboa)103.161.93.531269750!D  e) ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 02:03:36 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.177.253.166, lip=200.150.196.245, TLS, session=14.177.253.1661562822C  W' ossec9708i%Dovecot Aborted Login with empty userNov 18 02:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341B  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:02:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.20729210444A  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:02:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001@ W' ossec9708iDovecot Aborted Login with empty userNov 18 02:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p?  -i+ ossec13001iExim Auth failed2025-11-18 02:02:10 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:47081: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)220.189.196.1341814991:>  eG+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:03:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001=  -+ ossec13001iExim Auth failed2025-11-18 02:02:43 dovecot_login authenticator failed for (nsg-corporate-150.144.185.122.airtel.in) [122.185.144.150]:36104: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)122.185.144.1501269750 T1~qdWJ=0# zm`SF9,vi\OB5(reXK>1 G : -   w j ] P C 6 )    s f Y L ? 2 %   }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0# zm`SF9, v i \ O B 5 (    K > 1 $  1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991-| 1814991-{ 1814991-x 1814991-v 1814991-q 1814991-o 1814991-h 1814991-` 1814991-Z 1814991-: 1814991-1 1814991-) 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991,| 1814991,x 1814991,t 1814991,[ 1814991,W 1814991,V 1814991,J 1814991,H 1814991,> 1814991,= 1814991,9 1814991,8 1814991,5 1814991,1 1819730 c 1819730 ( 1819730  1819730 1819730 1819730 ^ 1819730 E 1819730 e 1819730 W 1819730 T 1819730 H 1819730 # 1819730 1819730 1819730 1819730 ! 1819730 1819730 F 1819730 1819730 1819730 1819730q 1819730 1819730 1819730 1819730 1819730 1819730. 1819730 1819730 1819730 1819730 1819730` 1819730* 1819730 1819730 1819730 1819730. 1819730 1819730 1819730] 1819730= 1819730 1819730 1819730 1819730 1819730 1819730 1819730N 18197301 1819730( 1819730 1819730 1819730K 1819730 1819730 1819730 1819730 1819730a 1819730 1819730 1819730M 1814991, 1814991+ 1814991+ 1814991+ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/x 1814991/w 1814991/e 1814991/\ 1814991/[ 1814991/U 1814991/P 1814991/N 1814991/H 1814991/E 1814991/D 1814991/< 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991.l 1814991.e 1814991.b 1814991.` 1814991.R 1814991.M 1814991. 1814991- 1814991- 1814991-+ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730z 1819730w 1819730v 1819730j 18197302 1819730 1819730 1819730 1819730 1819730 1819730Q 1819730= 1819730/ 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730h 1819730g 1819730W 1819730I 1819730G 1819730# 1819730 1819730 1819730 1819730 1819730 1819730 1819730{ 1819730] 1819730G 1819730: 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730T 1819730H 1819730= 1819730 1819730 1819730 1819730 1819730 ~ 1819730 l   ,Y  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:05:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822'X  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:05:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991W W' ossec9708iaDovecot Aborted Login with empty userNov 18 02:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034aV  -Q% ossec13001iYExim Auth failed2025-11-18 02:04:25 dovecot_login authenticator failed for (1075fm.com.br) [206.82.9.238]:52614: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)206.82.9.2386252001pU  -m' ossec13001iSExim Auth failed2025-11-18 02:04:18 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:59181: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)103.148.92.471168579dT  -Q+ ossec13001iwExim Auth failed2025-11-18 02:04:55 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51580: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034vS  -y' ossec13001imExim Auth failed2025-11-18 02:04:44 dovecot_plain authenticator failed for (s4300ciysdvuz66wgofiavhslf0c) [47.238.209.37]:37600: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)47.238.209.3718197307R  eE' ossec9710imDovecot Auth failed on disconnected session.Nov 18 02:04:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651XQ  -C# ossec13001ikExim Auth failed2025-11-18 02:04:42 dovecot_login authenticator failed for (31-154-68-141.orange.net.il) [2.55.68.141]:56164: 535 Incorrect authentication data (set_id=ti)2.55.68.141294640yP  -' ossec13001i)Exim Auth failed2025-11-18 02:03:37 dovecot_login authenticator failed for 111-70-49-179.emome-ip.hinet.net [111.70.49.179]:57467: 535 Incorrect authentication data (set_id=unijovem@pibtrindade.com.br)111.70.49.1791668284YO  -C% ossec13001i!Exim Auth failed2025-11-18 02:03:27 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56777: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758N  -++ ossec13001iExim Auth failed2025-11-18 02:03:16 dovecot_login authenticator failed for (red.138.118.214.203.ssservicios.com.ar) [138.118.214.203]:45283: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)138.118.214.2033865483M  k' ossec9709iCMultiple Dovecot Aborted Logins with empty userNov 18 02:04:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bL -K+ ossec13001i/Exim Auth failed2025-11-18 02:03:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51616: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034)K  e%+ ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 02:03:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001 4=zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+=' ~qdWJuh[NA4~qdWJ=0# 0 3469034" 3469034#$ 3469034# 3469034# 3469034# 3469034# 3469034#L 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034"[ 3469034#V 3469034#Pu 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034"| 3469034"y 3469034"v 3469034"b 3469034"a 3469034"X 3469034"V 3469034"U 3469034"T 3469034"J 3469034"C 3469034"; 3469034"7 3469034", 3469034") 3469034"! 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034! 3469034!{ 3469034!r 3469034!i 3469034!e 3469034!^ 3469034!Z 3469034!Q 3469034!L 3469034!I 3469034!C 3469034!; 3469034!9 3469034!1 3469034!/ 3469034!* 3469034!% 3469034!! 3469034! 3469034! 3469034! 3469034! 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 z 3469034 u 3469034 m 3469034 k 3469034 g 3469034 f 3469034 ^ 3469034 U 3469034 R 3469034 I 3469034 B 3469034 = 3469034 ; 3469034 3 3469034 0 3469034 / 3469034 & 3469034  3469034  3469034  3469034  3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034| 3469034w 3469034o 3469034j 3469034e 3469034\ 3469034[ 3469034X 3469034V 3469034U 3469034N 3469034L 3469034E 3469034C 3469034? 3469034, 3469034# 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034w 3469034r 3469034q 3469034o 3469034e 3469034c 3469034` 3469034^ 3469034Z 3469034U 3469034L 3469034K 3469034I 3469034#I 3469034#F 3469034#D 3469034#< 3469034#8 3469034#2 3469034#, 3469034#+ 3469034#%   +Ph  -/% ossec13001iExim Auth failed2025-11-18 02:06:47 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:60542: 535 Incorrect authentication data (set_id=toro)58.16.201.521814991g  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#f  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:06:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060/e  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:07:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<7NLzbtdD+oUtPZWl>45.61.149.1656252001qd  -m) ossec13001iExim Auth failed2025-11-18 02:06:55 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:51209: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)190.114.243.873625428\c  -C) ossec13001iExim Auth failed2025-11-18 02:06:34 dovecot_login authenticator failed for ([58.222.188.154]) [58.222.188.154]:50866: 535 Incorrect authentication data (set_id=financeiro)58.222.188.1541814991]b  -I' ossec13001iExim Auth failed2025-11-18 02:06:22 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:47239: 535 Incorrect authentication data (set_id=administrativo1)91.75.106.225290557ua  -s+ ossec13001iExim Auth failed2025-11-18 02:06:17 dovecot_login authenticator failed for ([177.236.145.124]) [177.236.145.124]:48045: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)177.236.145.1243996063t`  -u' ossec13001iExim Auth failed2025-11-18 02:06:10 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:42820: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)83.136.176.122510769e_ -Q+ ossec13001iExim Auth failed2025-11-18 02:06:07 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51992: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034d^  -Q+ ossec13001iExim Auth failed2025-11-18 02:05:18 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50207: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651,]  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:05:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<4Doka9dDZugtPZWl>45.61.149.1656252001d\  -[% ossec13001iExim Auth failed2025-11-18 02:05:37 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:41710: 535 Incorrect authentication data (set_id=toro@toromartelinho.com.br)65.20.204.8899237[ W' ossec9708iDovecot Aborted Login with empty userNov 18 02:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2tvMaddDzoWxV3kv>177.87.121.473469034'Z  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:05:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841  s Y 'f<\{\v  -E) ossec13001imExim Auth failed2025-11-18 02:09:01 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:44895: 535 Incorrect authentication data (set_id=atendimento)94.204.185.231290557]u  -C+ ossec13001iaExim Auth failed2025-11-18 02:08:48 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:50645: 535 Incorrect authentication data (set_id=atendimento)222.108.177.1101835841\t  -I% ossec13001iSExim Auth failed2025-11-18 02:08:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64847: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758&s  e!) ossec9710iQDovecot Auth failed on disconnected session.Nov 18 02:08:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750(r  e'' ossec9710iADovecot Auth failed on disconnected session.Nov 18 02:08:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001&q  e!) ossec9710iqDovecot Auth failed on disconnected session.Nov 18 02:09:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<+m1QdtdDIM6YNbyQ>152.53.188.14429210440p  e3+ ossec9710i7Dovecot Auth failed on disconnected session.Nov 18 02:08:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<8PTvctdDAPlxoZB3>113.161.144.1191562822 o  [w% ossec12004i1Possible Dovecot CVE-2019-11500 attemptNov 18 02:08:01 hosting dovecot: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=186.233.225.118, session=3.131.215.386252001$n  e## ossec9710i1Dovecot Auth failed on disconnected session.Nov 18 02:08:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730.m  e/+ ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 02:07:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991l W' ossec9708iDovecot Aborted Login with empty userNov 18 02:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/k  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:07:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<0Jheb9dDmJKKxX03>138.197.125.556252001j  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:07:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343i  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:06:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001 ( tyw[(/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:10:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:10:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841e  -U+ ossec13001iExim Auth failed2025-11-18 02:10:11 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:61034: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.1372987951  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:09:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001Y  -?' ossec13001iExim Auth failed2025-11-18 02:09:54 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:50574: 535 Incorrect authentication data (set_id=formula316)120.157.17.962077456l  -e' ossec13001iExim Auth failed2025-11-18 02:09:40 dovecot_login authenticator failed for (90.247.17.175.adsl-pool.jlccptt.net.cn) [175.17.247.90]:34890: 535 Incorrect authentication data (set_id=xavier)175.17.247.901814991w~  -y) ossec13001iExim Auth failed2025-11-18 02:09:35 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:57310: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)89.242.182.1592635167}  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o|  -i) ossec13001iExim Auth failed2025-11-18 02:09:27 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:57636: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)103.168.241.321269750{  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*z  e)) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 02:08:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<4kI0dddDNopA44h6>64.227.136.1221269750(y  e'' ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 02:08:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822x W' ossec9708iQDovecot Aborted Login with empty userNov 18 02:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<486IdNdDTMaxV3kv>177.87.121.473469034ew  -Y% ossec13001iIExim Auth failed2025-11-18 02:08:24 dovecot_login authenticator failed for ([5.142.17.130]) [5.142.17.130]:52182: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)5.142.17.1302017370  nD,  e/' ossec9710ibDovecot Auth failed on disconnected session.Nov 18 02:13:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991  k' ossec9709i`Multiple Dovecot Aborted Logins with empty userNov 18 02:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -G+ ossec13001i^Exim Auth failed2025-11-18 02:13:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51945: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034+  e++ ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 02:12:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758+  e+) ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 02:12:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001&  e#) ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 02:12:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.253.159.81, lip=200.150.196.245, TLS, session=185.253.159.81732800)  e+% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:11:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841k  -_+ ossec13001iExim Auth failed2025-11-18 02:11:46 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51783: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:11:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044(  e+# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:11:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750S  -5% ossec13001iExim Auth failed2025-11-18 02:11:00 dovecot_login authenticator failed for ([112.5.76.239]) [112.5.76.239]:54032: 535 Incorrect authentication data (set_id=contato)112.5.76.2391814991   -#+ ossec13001iExim Auth failed2025-11-18 02:10:38 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:33236: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)107.135.117.2456252001 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  {jP"  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:15:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991-  e3% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:14:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358411  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:14:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4GwAitdDUOOxV3kv>177.87.121.473469034  -%' ossec13001iExim Auth failed2025-11-18 02:14:19 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:50495: 535 Incorrect authentication data (set_id=secretaria@adlondrina.com.br)189.31.138.3834690342  e=% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:14:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382T  -7% ossec13001iExim Auth failed2025-11-18 02:14:01 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:51798: 535 Incorrect authentication data (set_id=contato)115.77.111.21562822  -' ossec13001iExim Auth failed2025-11-18 02:13:47 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:44052: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)109.69.15.2522510769 W' ossec9708i~Dovecot Aborted Login with empty userNov 18 02:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343  eA# ossec9710ipDovecot Auth failed on disconnected session.Nov 18 02:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483U  -7' ossec13001i\Exim Auth failed2025-11-18 02:12:59 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:50504: 535 Incorrect authentication data (set_id=envios)38.87.177.2526252001  W' ossec9708iBDovecot Aborted Login with empty userNov 18 02:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  - ) ossec13001i4Exim Auth failed2025-11-18 02:12:19 dovecot_login authenticator failed for 104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:42197: 535 Incorrect authentication data (set_id=envios@comercial.art.br)104.203.37.2256252001&  e%% ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 02:12:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<9oukgddDfrUI2Cjk>8.216.40.2281861060 4  pF,\.  -I' ossec13001ifExim Auth failed2025-11-18 02:17:26 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:35990: 535 Incorrect authentication data (set_id=paulinho.vendas)62.201.212.5499237q-  -k+ ossec13001i\Exim Auth failed2025-11-18 02:17:15 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:38881: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)177.236.146.2093996063o,  -m% ossec13001iLExim Auth failed2025-11-18 02:16:59 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:33884: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)1.212.225.9918358414+  e?' ossec9710i<Dovecot Auth failed on disconnected session.Nov 18 02:16:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.10518197302*  e7+ ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 02:16:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001) W' ossec9708i2Dovecot Aborted Login with empty userNov 18 02:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7+EpkddDCKaxV3kv>177.87.121.473469034&(  e%% ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 02:16:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991-'  e5# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:15:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001&  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$%  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:15:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<1Nz5jNdDiNEkMrGr>36.50.177.1711562822+$  e)+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:15:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841#  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6S5Zj9dDJJ6xV3kv>177.87.121.473469034]"  -G' ossec13001iExim Auth failed2025-11-18 02:15:29 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:43676: 535 Incorrect authentication data (set_id=adm)213.41.173.773017382g!  -Y) ossec13001iExim Auth failed2025-11-18 02:15:13 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37694: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)192.34.128.2026252001 3  Z.3w=  -y) ossec13001iExim Auth failed2025-11-18 02:19:59 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:55736: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)221.224.133.981814991(<  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:19:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<1eaQnNdDlqBn9M4G>103.244.206.616430840;  e3+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:19:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=185.124.182.191, lip=200.150.196.245, TLS, session=185.124.182.1913175395:  -) ossec13001iExim Auth failed2025-11-18 02:19:36 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:45077: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)118.103.253.481820814*9  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:18:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750i8  -a% ossec13001iExim Auth failed2025-11-18 02:18:28 dovecot_login authenticator failed for ([5.142.17.130]) [5.142.17.130]:44806: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)5.142.17.1302017370U7  -9' ossec13001iExim Auth failed2025-11-18 02:18:18 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:54288: 535 Incorrect authentication data (set_id=doninha)94.207.20.193290557'6  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:18:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.5618197305  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1c1OmNdDxtWxV3kv>177.87.121.473469034,4  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:18:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044l3  -a+ ossec13001iExim Auth failed2025-11-18 02:19:03 dovecot_login authenticator failed for (166-135.adsl.static.espeed.com.bn) [119.160.135.166]:37060: 535 Incorrect authentication data (set_id=contato)119.160.135.16618208142  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:19:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+eQcmtdDut6xV3kv>177.87.121.473469034j1  -]+ ossec13001i~Exim Auth failed2025-11-18 02:17:48 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:43181: 535 Incorrect authentication data (set_id=sec.geral)121.202.146.1441819730a0  -Q% ossec13001ivExim Auth failed2025-11-18 02:17:41 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:33110: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)61.72.58.2421835841/ W' ossec9708inDovecot Aborted Login with empty userNov 18 02:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 * x n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p  f \  * R H > 4 lbXND:0v&^TJ@|6rh,"xZPF<nd2( ~t.jL$`B8Vz> 4* pf\RH | r h ^ T J @ 6 , "    vlbXND:0& i i i i i i i i i i i i i iy ia i i i iu ig ie i_ i3 iN iJ iE i= i7 i5 i' iE i= i/ iW i7 i) i! i i i i i  i i i i i i i i i i i i i~ iv iP iN iF i6 ib ib i i i i. i  i i i~ i0} i| i{ iz iy ix iw iv iu it is ir iq ip io in im il ik ij ii iNh iJg i^f i\e iPd iRc iLb ila iZ` iX_ ib^ iF] i|\ il[ iBZ i4Y i,X i,W i V iU iT iS i:R i&Q iP iO i*N i(M i$L iK iJ iI iH iG iF iE iD iC iB iA i@ i? i> i= i< i; i: i3 i2 i9 i6 i5 i4 i8 i7 i~1 iv0 in/ if. i\- iL, i<+ i4* i2) i0( i# i' i& i" i% i$ i! i i i i i i i i i~ ip ib i` i^ i\ iB i5 i/ i- i) i) i% i! i i i i i  i i i i iW iQ i- i+ i i i i i i i i i i i i i i is is ii iY iM iK i- i) i  i i i i i i i i i> i4 i0 i0 i* i i i i i i i i i i i i i i i i i i iq im ia i_ i_ iS iQ iQ iI iA i7 i1 i1 i' i i i i iP iY i i i i i i i i i i i i i i i i iw im im ik ia iY iS iG iC i;  szYL  -=) ossec13001i$Exim Auth failed2025-11-18 02:20:35 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:35804: 535 Incorrect authentication data (set_id=contato)121.188.248.311835841uK  -s+ ossec13001iExim Auth failed2025-11-18 02:20:17 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:51374: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)209.115.177.2126251999.J  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822nI  -i' ossec13001iExim Auth failed2025-11-18 02:19:52 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:47820: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)182.95.51.1661269750H -' ossec13001iExim Auth failed2025-11-18 02:19:48 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:55346: 535 Incorrect authentication data (set_id=secretaria@cieadep.com)189.31.138.383469034nG  -g) ossec13001iExim Auth failed2025-11-18 02:19:41 dovecot_login authenticator failed for ([183.104.220.84]) [183.104.220.84]:55488: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)183.104.220.841835841F W' ossec9708iDovecot Aborted Login with empty userNov 18 02:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-E  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<2+O0nddDGK6l0iHB>165.210.33.1932233387(D  e)% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:19:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991|C  -% ossec13001iExim Auth failed2025-11-18 02:19:30 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:46748: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)137.27.32.706252001~B  -) ossec13001iExim Auth failed2025-11-18 02:20:05 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:63586: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)220.246.43.1721819730PA  -/% ossec13001iExim Auth failed2025-11-18 02:19:54 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:33303: 535 Incorrect authentication data (set_id=info)45.251.69.121269750@  -' ossec13001iExim Auth failed2025-11-18 02:19:44 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:49933: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)109.69.15.2522510769e?  -W' ossec13001iExim Auth failed2025-11-18 02:20:05 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:51691: 535 Incorrect authentication data (set_id=adriana)201.172.88.853996063->  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867  [  -) ossec13001ilExim Auth failed2025-11-18 02:21:47 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:52254: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)178.140.212.922017370kZ  -c' ossec13001iBExim Auth failed2025-11-18 02:21:05 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:53915: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)45.115.173.111269750nY  -g) ossec13001i4Exim Auth failed2025-11-18 02:20:51 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:35286: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)103.129.195.431269750|X  -% ossec13001i,Exim Auth failed2025-11-18 02:20:43 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:48225: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)90.164.107.32510769fW  -W) ossec13001i,Exim Auth failed2025-11-18 02:20:43 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:54050: 535 Incorrect authentication data (set_id=atualizacoes)222.252.21.2401562822V W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  - ' ossec13001iExim Auth failed2025-11-18 02:20:28 dovecot_login authenticator failed for (16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:60698: 535 Incorrect authentication data (set_id=administrativo1)125.67.190.161814991YT  -?' ossec13001iExim Auth failed2025-11-18 02:20:26 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:51803: 535 Incorrect authentication data (set_id=financeiro)188.231.3.2463017382'S  e#) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:20:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251|R  -+ ossec13001i:Exim Auth failed2025-11-18 02:20:58 dovecot_login authenticator failed for ([116.237.207.234]) [116.237.207.234]:45518: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)116.237.207.2341814991qQ  -k+ ossec13001i&Exim Auth failed2025-11-18 02:20:37 dovecot_login authenticator failed for ([121.131.220.137]) [121.131.220.137]:43391: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)121.131.220.1371835841P  - ) ossec13001iExim Auth failed2025-11-18 02:20:17 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45048: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)57.132.150.1626252001O  W# ossec9708iDovecot Aborted Login with empty userNov 18 02:20:14 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 3 secs): user=<>, rip=86.54.31.32, lip=191.243.196.56, TLS, session=86.54.31.322750405$N  e+ ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 02:20:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758_M  -G+ ossec13001i(Exim Auth failed2025-11-18 02:20:40 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:33377: 535 Incorrect authentication data (set_id=financeiro)123.129.196.1181814991 ' T p *'i  - ' ossec13001iExim Auth failed2025-11-18 02:22:08 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:57873: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)174.134.45.646252001lh  -g) ossec13001iNExim Auth failed2025-11-18 02:21:18 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:49116: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)185.255.47.19099237vg  -y' ossec13001iJExim Auth failed2025-11-18 02:21:13 dovecot_plain authenticator failed for (v6ouyp0hvn7goacj1s520kc46wjq) [116.104.237.6]:56491: 535 Incorrect authentication data (set_id=marcos@louvoreterno.com.br)116.104.237.61562822Xf  -;) ossec13001i^Exim Auth failed2025-11-18 02:21:33 dovecot_login authenticator failed for ([175.237.47.241]) [175.237.47.241]:41917: 535 Incorrect authentication data (set_id=rafael)175.237.47.2411835841e  W' ossec9708i\Dovecot Aborted Login with empty userNov 18 02:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034rd  -o) ossec13001iPExim Auth failed2025-11-18 02:21:19 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:45310: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)109.207.33.2536290252c ;' ossec13008iRMail Recipient rejected2025-11-18 02:21:21 H=([127.0.1.1]) [104.243.245.4]:4082 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : "JunkMail rejected - ([127.0.1.1]) [104.243.245.4]:4082 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/104.243.245.4"104.243.245.43996063hb  -_% ossec13001iLExim Auth failed2025-11-18 02:21:16 dovecot_login authenticator failed for ([220.67.138.254]) [221.145.5.14]:54698: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)221.145.5.141835841`a  -K) ossec13001ilExim Auth failed2025-11-18 02:21:47 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:48036: 535 Incorrect authentication data (set_id=isabellylisboa)86.102.254.19820173702` e7) ossec9710iZDovecot Auth failed on disconnected session.Nov 18 02:21:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.10129210440_  e7' ossec9710iXDovecot Auth failed on disconnected session.Nov 18 02:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991k^  -c' ossec13001ibExim Auth failed2025-11-18 02:21:37 dovecot_login authenticator failed for ([177.174.16.55]) [177.174.16.55]:60002: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)177.174.16.553469034,]  e++ ossec9710iFDovecot Auth failed on disconnected session.Nov 18 02:21:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001\  k' ossec9709i|Multiple Dovecot Aborted Logins with empty userNov 18 02:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9a/YpNdDCLGxV3kv>177.87.121.473469034 ^ -EWj[r^-x  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:23:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044_w  -Q! ossec13001iExim Auth failed2025-11-18 02:23:10 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:46512: 535 Incorrect authentication data (set_id=formula316)87.76.5.362017370ev  -W' ossec13001iExim Auth failed2025-11-18 02:24:05 dovecot_login authenticator failed for ([189.11.15.126]) [189.11.15.126]:43834: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)189.11.15.1263469034 u  [w% ossec12004iPossible Dovecot CVE-2019-11500 attemptNov 18 02:24:02 hosting dovecot: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=200.150.207.122, session=3.131.215.386252001it  -_' ossec13001iExim Auth failed2025-11-18 02:23:49 dovecot_login authenticator failed for ([89.175.253.50]) [89.175.253.50]:48440: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)89.175.253.502017370js  -c% ossec13001iExim Auth failed2025-11-18 02:23:22 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:57811: 535 Incorrect authentication data (set_id=marialuiza)75.80.65.2146252001dr  -U' ossec13001iExim Auth failed2025-11-18 02:22:44 dovecot_login authenticator failed for ([78.111.147.32]) [78.111.147.32]:56196: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)78.111.147.322017370dq  -U' ossec13001iExim Auth failed2025-11-18 02:22:33 dovecot_login authenticator failed for ([79.135.236.30]) [79.135.236.30]:50272: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)79.135.236.302017370Yp  -=) ossec13001iExim Auth failed2025-11-18 02:22:21 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:37394: 535 Incorrect authentication data (set_id=contato)200.199.32.1743469034to  -s) ossec13001iExim Auth failed2025-11-18 02:22:18 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:56238: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)116.98.104.1381562822yn  -% ossec13001iExim Auth failed2025-11-18 02:22:16 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:53724: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)81.16.164.762661886hm  -a# ossec13001iExim Auth failed2025-11-18 02:22:52 dovecot_login authenticator failed for ([101.13.6.86]) [101.13.6.86]:42428: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)101.13.6.8616682845l  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:22:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<7jg5p9dDzq2dQi/y>157.66.47.2421562822Vk  -;% ossec13001iExim Auth failed2025-11-18 02:22:39 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:41922: 535 Incorrect authentication data (set_id=formula316)111.26.63.871814991j W' ossec9708iDovecot Aborted Login with empty userNov 18 02:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7ruaptdDvL6xV3kv>177.87.121.473469034 [ g [[|  - ! ossec13001ibExim Auth failed2025-11-18 02:25:53 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:52184: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)87.76.5.3620173702  e7+ ossec9710ibDovecot Auth failed on disconnected session.Nov 18 02:25:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<9Q6OstdDDtRns7yS>103.179.188.14615628220  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:24:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758V  -5+ ossec13001iExim Auth failed2025-11-18 02:24:42 dovecot_login authenticator failed for ([191.102.75.65]) [186.179.100.100]:1255: 535 Incorrect authentication data (set_id=edna)186.179.100.10036861101  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:24:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<5a5orNdDnqt2wSaf>118.193.38.1591819730  k' ossec9709i.Multiple Dovecot Aborted Logins with empty userNov 18 02:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#  3K) ossec11301i New FTP connection.Nov 18 02:24:47 hosting pure-ftpd: (?@45.156.129.169) [INFO] New connection from 45.156.129.16945.156.129.1692264397  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4Gu9rddD7OexV3kv>177.87.121.473469034S  -3' ossec13001iExim Auth failed2025-11-18 02:24:22 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:34794: 535 Incorrect authentication data (set_id=edna)1.235.192.1311835841U~  -;# ossec13001iExim Auth failed2025-11-18 02:24:09 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:55432: 535 Incorrect authentication data (set_id=atualizacoes)14.98.28.431269750&}  e%% ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 02:25:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001m|  -i' ossec13001iExim Auth failed2025-11-18 02:23:09 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:34388: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)31.135.26.217798544{ W' ossec9708iDovecot Aborted Login with empty userNov 18 02:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'z  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:23:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.7138654835y  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:23:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651 c  j6c)  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:27:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430849  eG) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:27:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=116.71.133.131, lip=200.150.196.245, TLS, session=<1tHktddDDIV0R4WD>116.71.133.1311168579  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:28:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:27:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<184ouddDsr2qQMFo>170.64.193.1042077456  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:27:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841)  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:26:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`  -K) ossec13001i~Exim Auth failed2025-11-18 02:26:21 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:58775: 535 Incorrect authentication data (set_id=isabellylisboa)111.85.118.14718149919  eG) ossec9710ivDovecot Auth failed on disconnected session.Nov 18 02:26:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750.  e1) ossec9710iPDovecot Auth failed on disconnected session.Nov 18 02:25:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750 W' ossec9708iNDovecot Aborted Login with empty userNov 18 02:25:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034S  -7# ossec13001iFExim Auth failed2025-11-18 02:25:25 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:63865: 535 Incorrect authentication data (set_id=financeiro)218.76.73.41814991  -) ossec13001i6Exim Auth failed2025-11-18 02:25:09 dovecot_login authenticator failed for (188x186x183x88.dynamic.tmn.ertelecom.ru) [188.186.183.88]:40110: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)188.186.183.882017370  $ W' ossec9708i=Dovecot Aborted Login with empty userNov 18 02:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5Euov9dDuuSxV3kv>177.87.121.4734690343#  e9+ ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 02:29:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822("  e+# ossec9710iWDovecot Auth failed on disconnected session.Nov 18 02:29:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483Y!  -=) ossec13001i7Exim Auth failed2025-11-18 02:29:25 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:33178: 535 Incorrect authentication data (set_id=leandro)121.159.71.2491835841~  -) ossec13001i)Exim Auth failed2025-11-18 02:29:11 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:50085: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)223.197.145.331819730j  -a' ossec13001i!Exim Auth failed2025-11-18 02:29:04 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:42018: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)119.192.59.801835841 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t  -q+ ossec13001iExim Auth failed2025-11-18 02:28:20 dovecot_login authenticator failed for ([211.239.181.182]) [211.239.181.182]:45660: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)211.239.181.1821835841[  -C' ossec13001iExim Auth failed2025-11-18 02:28:53 dovecot_login authenticator failed for ([92.124.133.35]) [92.124.133.35]:55232: 535 Incorrect authentication data (set_id=junior.gomes)92.124.133.352017370n  -m# ossec13001iExim Auth failed2025-11-18 02:28:48 dovecot_login authenticator failed for ([46.44.0.185]) [46.44.0.185]:50768: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)46.44.0.1852017370a  -K+ ossec13001i Exim Auth failed2025-11-18 02:28:40 dovecot_login authenticator failed for ([211.224.227.120]) [211.224.227.120]:37090: 535 Incorrect authentication data (set_id=junior.gomes)211.224.227.1201835841(  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:28:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001&  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:28:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841\  -E' ossec13001iExim Auth failed2025-11-18 02:27:55 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:54286: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001/  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:27:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730 & % A a I :Y4  -C% ossec13001iExim Auth failed2025-11-18 02:31:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49435: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758.3  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:31:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044*2  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:30:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841`1  -I+ ossec13001iuExim Auth failed2025-11-18 02:30:27 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:41116: 535 Incorrect authentication data (set_id=vendas.luiz)197.219.228.2501036973_0  -G+ ossec13001igExim Auth failed2025-11-18 02:30:13 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51877: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034n/  -e+ ossec13001ieExim Auth failed2025-11-18 02:30:11 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:49868: 535 Incorrect authentication data (set_id=alex.vendas)188.234.212.1012017370u.  -w' ossec13001i_Exim Auth failed2025-11-18 02:30:05 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:42388: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)217.29.30.1351527747^-  -I' ossec13001i3Exim Auth failed2025-11-18 02:29:22 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:41420: 535 Incorrect authentication data (set_id=administrativo1)182.95.49.1861269750 ,  3G' ossec11301iNNew FTP connection.Nov 18 02:29:50 hosting pure-ftpd: (?@91.92.242.214) [INFO] New connection from 91.92.242.21491.92.242.2142750405 +  -#' ossec13001iJExim Auth failed2025-11-18 02:29:46 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:42464: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)50.171.64.1706252001*  -3) ossec13001iEExim Auth failed2025-11-18 02:29:40 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:39621: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)122.160.50.1551269750\)  -C) ossec13001i=Exim Auth failed2025-11-18 02:29:32 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:38216: 535 Incorrect authentication data (set_id=financeiro)49.206.201.2531269750`(  -O' ossec13001i7Exim Auth failed2025-11-18 02:29:25 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:50681: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795u'  -u) ossec13001i5Exim Auth failed2025-11-18 02:29:23 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:37975: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)86.102.254.1982017370&  -' ossec13001i'Exim Auth failed2025-11-18 02:29:09 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:62548: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)184.57.39.1706252001V%  -9) ossec13001iEExim Auth failed2025-11-18 02:29:39 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:16181: 535 Incorrect authentication data (set_id=bruno)196.190.180.19337996 = hsP#FW=C W' ossec9708iDovecot Aborted Login with empty userNov 18 02:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kB  -c' ossec13001iExim Auth failed2025-11-18 02:31:19 dovecot_login authenticator failed for ([81.161.17.124]) [81.161.17.124]:63308: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)81.161.17.1242017370YA  -=) ossec13001iExim Auth failed2025-11-18 02:31:59 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:47866: 535 Incorrect authentication data (set_id=brizola)182.95.176.1941269750)@  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:31:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822?  e# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:31:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750(>  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:31:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001d=  -U' ossec13001iExim Auth failed2025-11-18 02:32:04 dovecot_login authenticator failed for ([171.48.24.152]) [171.48.24.152]:47881: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)171.48.24.1521269750]<  -E) ossec13001iExim Auth failed2025-11-18 02:32:02 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:50263: 535 Incorrect authentication data (set_id=vendas.luiz)189.44.133.2383469034&;  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:31:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841,:  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:31:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867r9  -o) ossec13001iExim Auth failed2025-11-18 02:31:40 dovecot_login authenticator failed for ([157.122.198.51]) [157.122.198.51]:59589: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)157.122.198.5118149918  - ) ossec13001iExim Auth failed2025-11-18 02:31:04 dovecot_login authenticator failed for (161.81.253.239.hk.chinamobile.com) [161.81.253.239]:57084: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)161.81.253.23918197307  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:31:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346  W' ossec9708iyDovecot Aborted Login with empty userNov 18 02:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345  -' ossec13001iaExim Auth failed2025-11-18 02:30:07 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:47592: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)122.186.64.861269750  TRhN5#Q  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:35:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387$P  e!' ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 02:33:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758/O  e5' ossec9710iMDovecot Auth failed on disconnected session.Nov 18 02:34:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822N  k' ossec9709iKMultiple Dovecot Aborted Logins with empty userNov 18 02:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034M  W' ossec9708i-Dovecot Aborted Login with empty userNov 18 02:33:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034L W' ossec9708iDovecot Aborted Login with empty userNov 18 02:32:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fK  -_% ossec13001iExim Auth failed2025-11-18 02:32:29 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:58435: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)65.20.175.7599237~J  -+ ossec13001iExim Auth failed2025-11-18 02:32:17 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:48926: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)121.202.206.11918197305I  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:32:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430842H  e9) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:32:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<2Cafy9dDjJ92wSaf>118.193.38.1591819730wG  -{' ossec13001iExim Auth failed2025-11-18 02:32:49 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:34002: 535 Incorrect authentication data (set_id=contato)125.23.140.5412697500F  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:32:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841VE  -9' ossec13001iExim Auth failed2025-11-18 02:32:24 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:39410: 535 Incorrect authentication data (set_id=eliezer)196.28.226.6610369730D e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730  U m S'_  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,^  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:36:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001`]  -M' ossec13001iExim Auth failed2025-11-18 02:36:54 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:59232: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730'\  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:36:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750[  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034pZ  -o% ossec13001iExim Auth failed2025-11-18 02:35:08 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:47826: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)218.22.0.2001814991-Y  e5# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<5g/y1tdD9u0rZDwA>43.100.60.01819730(X  e)% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:35:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370W W' ossec9708iDovecot Aborted Login with empty userNov 18 02:35:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dV  -Y% ossec13001iExim Auth failed2025-11-18 02:35:18 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:39788: 535 Incorrect authentication data (set_id=contato)78.186.54.65298795(U  e#+ ossec9710isDovecot Auth failed on disconnected session.Nov 18 02:34:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001/T  e3) ossec9710isDovecot Auth failed on disconnected session.Nov 18 02:34:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730S W' ossec9708iiDovecot Aborted Login with empty userNov 18 02:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.R  e/+ ossec9710iYDovecot Auth failed on disconnected session.Nov 18 02:34:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001  0n  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:39:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044Xm  -;) ossec13001iExim Auth failed2025-11-18 02:39:40 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:33830: 535 Incorrect authentication data (set_id=adriana)152.52.210.1181269750kl  -e% ossec13001iExim Auth failed2025-11-18 02:39:39 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:54519: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)61.72.59.1061835841[k  -E% ossec13001iExim Auth failed2025-11-18 02:40:02 dovecot_login authenticator failed for ([58.58.130.22]) [58.58.130.22]:53215: 535 Incorrect authentication data (set_id=administrativo1)58.58.130.221814991j  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:40:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]i  -E) ossec13001iExim Auth failed2025-11-18 02:40:00 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:59798: 535 Incorrect authentication data (set_id=faturamento)221.209.48.2031814991h W' ossec9708iYDovecot Aborted Login with empty userNov 18 02:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342g  e=% ossec9710iWDovecot Auth failed on disconnected session.Nov 18 02:38:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001Zf  -A' ossec13001iQExim Auth failed2025-11-18 02:38:23 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:63340: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001{e  -) ossec13001iiExim Auth failed2025-11-18 02:38:48 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:51178: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)111.220.199.982077456ed  -S+ ossec13001i-Exim Auth failed2025-11-18 02:37:48 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:65090: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651\c  -I% ossec13001i+Exim Auth failed2025-11-18 02:37:46 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61939: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758&b  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:37:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044a W' ossec9708iDovecot Aborted Login with empty userNov 18 02:37:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$`  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:37:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001 ~ lr~2}  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:40:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387k|  -_+ ossec13001iExim Auth failed2025-11-18 02:40:33 dovecot_login authenticator failed for 182-155-213-175.veetime.com [182.155.213.175]:57582: 535 Incorrect authentication data (set_id=isabellylisboa)182.155.213.1751668284{ W' ossec9708iDovecot Aborted Login with empty userNov 18 02:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oz  -k' ossec13001iExim Auth failed2025-11-18 02:40:26 dovecot_login authenticator failed for ([36.135.100.48]) [36.135.100.48]:52730: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)36.135.100.481814991{y  -+ ossec13001iExim Auth failed2025-11-18 02:40:17 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12052: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)195.142.106.177298795fx  -[% ossec13001iExim Auth failed2025-11-18 02:40:16 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:52921: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)157.15.67.201643084zw  -' ossec13001iExim Auth failed2025-11-18 02:39:33 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:44044: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)93.241.232.142921044Wv  -9) ossec13001iExim Auth failed2025-11-18 02:39:25 dovecot_login authenticator failed for (static.vnpt.vn) [14.171.195.147]:52357: 535 Incorrect authentication data (set_id=contato)14.171.195.1471562822vu  -w) ossec13001iExim Auth failed2025-11-18 02:39:25 dovecot_login authenticator failed for ([128.185.247.53]) [182.95.222.118]:44348: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)182.95.222.1181269750,t  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:39:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750,s  e3# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:39:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001kr  -a) ossec13001iExim Auth failed2025-11-18 02:40:03 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:44459: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)218.156.93.2031835841wq  -y) ossec13001iExim Auth failed2025-11-18 02:39:49 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:48938: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)188.126.240.802661886p  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:39:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-o  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:39:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<9+Hg4tdDJJR2wSaf>118.193.38.1591819730 F  +  #'N4Fj  -a' ossec13001iExim Auth failed2025-11-18 02:41:34 dovecot_login authenticator failed for ([83.149.29.222]) [83.149.29.222]:45080: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)83.149.29.2222017370 W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7p2T6tdDdKuxV3kv>177.87.121.473469034U  -7' ossec13001i Exim Auth failed2025-11-18 02:41:28 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:45874: 535 Incorrect authentication data (set_id=rafael)182.95.115.701269750X  -?% ossec13001iExim Auth failed2025-11-18 02:40:59 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:33234: 535 Incorrect authentication data (set_id=financeiro)211.196.31.21835841c  -W# ossec13001iExim Auth failed2025-11-18 02:40:56 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:37418: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)14.6.16.1371835841g  -[' ossec13001iExim Auth failed2025-11-18 02:40:53 dovecot_login authenticator failed for ([61.246.66.225]) [182.95.174.18]:32888: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)182.95.174.181269750c  -Q) ossec13001iExim Auth failed2025-11-18 02:40:22 dovecot_login authenticator failed for ([183.221.220.37]) [183.221.220.37]:35334: 535 Incorrect authentication data (set_id=secretarioadjunto)183.221.220.3718149913  e=' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:40:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001,  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:40:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730[  -A+ ossec13001iExim Auth failed2025-11-18 02:40:31 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:54034: 535 Incorrect authentication data (set_id=contato)196.189.124.229337996m  -g' ossec13001iExim Auth failed2025-11-18 02:40:23 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:38478: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)180.172.33.521814991 Sq' ossec11000iLogin failed on the cpanel service.[2025-11-18 02:40:16 -0300] info [cpaneld] 165.22.212.32 - adlondri "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password165.22.212.321269750*  e1# ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:40:16 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=83.143.27.9, lip=200.150.196.245, TLS, session=83.143.27.9933860n  -i' ossec13001iExim Auth failed2025-11-18 02:40:31 dovecot_login authenticator failed for ([111.26.95.126]) [111.26.95.126]:35942: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)111.26.95.1261814991h  -]' ossec13001iExim Auth failed2025-11-18 02:40:22 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:50418: 535 Incorrect authentication data (set_id=paulo)182.76.86.1301269750s~  -o+ ossec13001iExim Auth failed2025-11-18 02:41:01 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:55782: 535 Incorrect authentication data (set_id=financeiro)188.219.104.2103175395  Q8L)(Eq  -m) ossec13001iExim Auth failed2025-11-18 02:43:57 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:37123: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)115.141.143.581835841-  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:43:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841_  -O# ossec13001i1Exim Auth failed2025-11-18 02:42:09 dovecot_login authenticator failed for 111-70-32-7.emome-ip.hinet.net [111.70.32.7]:49377: 535 Incorrect authentication data (set_id=contato)111.70.32.71668284}  -' ossec13001iiExim Auth failed2025-11-18 02:43:05 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:41614: 535 Incorrect authentication data (set_id=atualizacoes)81.62.212.1422658434  k' ossec9709igMultiple Dovecot Aborted Logins with empty userNov 18 02:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7v3q79dD4M2xV3kv>177.87.121.473469034h  -]' ossec13001i[Exim Auth failed2025-11-18 02:42:51 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:57536: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.95.60.1461269750  W' ossec9708iIDovecot Aborted Login with empty userNov 18 02:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347  eA+ ossec9710iEDovecot Auth failed on disconnected session.Nov 18 02:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<9ti+7ddDrL+Gx8nN>134.199.201.2056252001%  e#% ossec9710iADovecot Auth failed on disconnected session.Nov 18 02:42:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841Z  -A' ossec13001iExim Auth failed2025-11-18 02:41:27 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:52414: 535 Incorrect authentication data (set_id=venesselume)120.157.17.962077456(  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:41:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001Y  -?' ossec13001iExim Auth failed2025-11-18 02:41:11 dovecot_login authenticator failed for ([121.11.160.60]) [121.11.160.60]:50044: 535 Incorrect authentication data (set_id=formula316)121.11.160.601814991+  e/% ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 02:42:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.418358411  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:41:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758 | z|2*  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:44:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044`)  -I+ ossec13001iExim Auth failed2025-11-18 02:44:12 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:59974: 535 Incorrect authentication data (set_id=vanessalima)123.139.116.1841814991`(  -Q# ossec13001iExim Auth failed2025-11-18 02:44:46 dovecot_login authenticator failed for (49.207.9.39.actcorp.in) [49.207.9.39]:50852: 535 Incorrect authentication data (set_id=isabellylisboa)49.207.9.391269750' W' ossec9708iDovecot Aborted Login with empty userNov 18 02:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342&  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:44:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.18062520018%  eG' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:45:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<0+Lc9tdDwqSWXx+e>150.95.31.1581605651S$  -3' ossec13001iExim Auth failed2025-11-18 02:44:47 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:58544: 535 Incorrect authentication data (set_id=info)108.143.69.792750405.#  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:44:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001V"  -7) ossec13001iExim Auth failed2025-11-18 02:44:37 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:43047: 535 Incorrect authentication data (set_id=info)119.164.159.861814991!  - ) ossec13001iExim Auth failed2025-11-18 02:44:06 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:56087: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)220.246.43.1721819730[  -A) ossec13001iExim Auth failed2025-11-18 02:43:46 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:38754: 535 Incorrect authentication data (set_id=financeiro)182.95.176.1941269750l  -e' ossec13001iExim Auth failed2025-11-18 02:43:33 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:46750: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)103.251.31.341269750 W' ossec9708iDovecot Aborted Login with empty userNov 18 02:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l  -a+ ossec13001iExim Auth failed2025-11-18 02:43:30 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64991: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.23116056516  e?+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:43:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822  2 qeO/8 e5% ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 02:46:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.21662520017  -/) ossec13001i8Exim Auth failed2025-11-18 02:46:31 dovecot_login authenticator failed for (37x113x129x120.static-business.chel.ertelecom.ru) [37.113.129.120]:50604: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)37.113.129.1202017370&6  e#' ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 02:46:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<1oJb+9dDTMM7GIXF>59.24.133.1971835841^5 -E) ossec13001i!Exim Auth failed2025-11-18 02:46:09 dovecot_login authenticator failed for (User) [177.74.174.120]:61058: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)177.74.174.1203469034#4  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:45:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750<3  eM) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:45:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=94.198.210.128, lip=200.150.196.245, TLS, session=94.198.210.12831753952  -+ ossec13001iExim Auth failed2025-11-18 02:45:26 dovecot_login authenticator failed for (175-182-108-150.adsl.dynamic.seed.net.tw) [175.182.108.150]:33570: 535 Incorrect authentication data (set_id=sales@globalmedica.com.br)175.182.108.1501668284*1  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:46:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.11915628220  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2dKp+tdD7qexV3kv>177.87.121.473469034T/  -5' ossec13001iExim Auth failed2025-11-18 02:46:01 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:39372: 535 Incorrect authentication data (set_id=sales)182.95.54.1941269750^. -E) ossec13001iExim Auth failed2025-11-18 02:45:53 dovecot_login authenticator failed for (User) [177.74.174.120]:61058: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)177.74.174.1203469034-  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1sfj+NdDKJuxV3kv>177.87.121.473469034v,  -y' ossec13001iExim Auth failed2025-11-18 02:44:22 dovecot_login authenticator failed for ([14.225.32.239]) [14.225.32.239]:55947: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)14.225.32.2391562822}+  S]+ ossec11000iLogin failed on the cpanel service.[2025-11-18 02:44:21 -0300] info [webmaild] 151.243.109.221 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect151.243.109.2212750405   (G  e'' ossec9710i|Dovecot Auth failed on disconnected session.Nov 18 02:47:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991aF  -K+ ossec13001iExim Auth failed2025-11-18 02:47:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52212: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034lE  -a+ ossec13001ifExim Auth failed2025-11-18 02:47:17 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:59826: 535 Incorrect authentication data (set_id=alex.vendas)121.202.138.1811819730{D  -# ossec13001ifExim Auth failed2025-11-18 02:47:16 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:39058: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)42.200.73.31819730lC  -g% ossec13001iExim Auth failed2025-11-18 02:47:54 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:46596: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)103.90.27.831643084,B  e/' ossec9710iJDovecot Auth failed on disconnected session.Nov 18 02:46:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001^A  -I' ossec13001iFExim Auth failed2025-11-18 02:46:45 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:55939: 535 Incorrect authentication data (set_id=administrativo1)107.85.14.2086252001j@  -a' ossec13001iFExim Auth failed2025-11-18 02:46:44 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:52016: 535 Incorrect authentication data (set_id=financeiro)89.179.78.2472017370_?  -Q! ossec13001i%Exim Auth failed2025-11-18 02:46:12 dovecot_login authenticator failed for ([1.183.3.58]) [1.183.3.58]:56838: 535 Incorrect authentication data (set_id=sales@louvoreterno.com.br)1.183.3.581814991j>  -c% ossec13001iXExim Auth failed2025-11-18 02:47:03 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:54833: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)61.72.58.2421835841$=  e## ossec9710iPDovecot Auth failed on disconnected session.Nov 18 02:46:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730T<  -5' ossec13001iJExim Auth failed2025-11-18 02:46:49 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:49694: 535 Incorrect authentication data (set_id=sales)37.28.177.1412017370&;  e!) ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 02:46:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044 :  -!+ ossec13001i:Exim Auth failed2025-11-18 02:46:33 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:38295: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)203.198.173.13718197309 W' ossec9708i:Dovecot Aborted Login with empty userNov 18 02:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<31hr/NdDrLGxV3kv>177.87.121.473469034 ) x G j Pk7)PU  -5! ossec13001iExim Auth failed2025-11-18 02:48:21 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:54262: 535 Incorrect authentication data (set_id=aureovieira)5.30.78.23290557bT  -M+ ossec13001iExim Auth failed2025-11-18 02:48:13 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52244: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.1413469034S  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 02:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gR  -]% ossec13001iExim Auth failed2025-11-18 02:49:01 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:46620: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)203.82.40.341694008)Q  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:48:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044P  W' ossec9708iDovecot Aborted Login with empty userNov 18 02:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340O  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001aN  -S% ossec13001iExim Auth failed2025-11-18 02:48:24 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62785: 535 Incorrect authentication data (set_id=postamster@ciadoluminoso.com.br)62.60.131.40130758M W' ossec9708iuDovecot Aborted Login with empty userNov 18 02:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YL  -=) ossec13001itExim Auth failed2025-11-18 02:47:30 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:39186: 535 Incorrect authentication data (set_id=contato)125.20.245.1821269750-K  e1' ossec9710inDovecot Auth failed on disconnected session.Nov 18 02:47:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520010J  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:48:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001"I  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:47:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060*H  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:47:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841  h q C R8 %c  e#% ossec9710i PDovecot Auth failed on disconnected session.Nov 18 02:51:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060b W' ossec9708i *Dovecot Aborted Login with empty userNov 18 02:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ia  -_' ossec13001i Exim Auth failed2025-11-18 02:50:14 dovecot_login authenticator failed for ([36.135.103.30]) [36.135.103.30]:39538: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)36.135.103.301814991*`  e-% ossec9710i JDovecot Auth failed on disconnected session.Nov 18 02:51:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<8veDDNhDbKBzR+4E>115.71.238.41835841w_  -y) ossec13001i HExim Auth failed2025-11-18 02:51:03 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:38051: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)71.208.122.1856252001x^  -}' ossec13001i 2Exim Auth failed2025-11-18 02:50:42 dovecot_login authenticator failed for 111-70-33-227.emome-ip.hinet.net [111.70.33.227]:46367: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)111.70.33.2271668284/]  e1+ ossec9710i 0Dovecot Auth failed on disconnected session.Nov 18 02:50:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841\ W' ossec9708iDovecot Aborted Login with empty userNov 18 02:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m[  -e) ossec13001iExim Auth failed2025-11-18 02:49:27 dovecot_login authenticator failed for ([211.252.96.146]) [211.252.96.146]:43236: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)211.252.96.1461835841*Z  e)) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:50:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001sY  -u% ossec13001i Exim Auth failed2025-11-18 02:50:05 dovecot_login authenticator failed for (89.20.106.40.permonline.ru) [89.20.106.40]:59513: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)89.20.106.402017370.X  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:48:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822-W  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:48:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697501V e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 02:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170 D  8 A '9AHX5*CD{s  -' ossec13001i XExim Auth failed2025-11-18 02:51:19 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:60662: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)73.128.151.926252001cr  -U' ossec13001i Exim Auth failed2025-11-18 02:52:02 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:52242: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795`q  -I+ ossec13001i pExim Auth failed2025-11-18 02:51:43 dovecot_login authenticator failed for ([220.124.230.188]) [220.124.230.188]:43657: 535 Incorrect authentication data (set_id=vendas.luiz)220.124.230.1881835841#p  k+ ossec9709i hMultiple Dovecot Aborted Logins with empty userNov 18 02:51:35 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=<00V/DthD7/yxm8ew>177.155.199.1763469034o W+ ossec9708i dDovecot Aborted Login with empty userNov 18 02:51:32 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034ln  -g% ossec13001i LExim Auth failed2025-11-18 02:51:06 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:37982: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)102.38.3.1772215636um -u' ossec13001i xExim Auth failed2025-11-18 02:51:52 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:50476: 535 Incorrect authentication data (set_id=sales@inovasite.com)98.220.97.1886252001tl  -s) ossec13001i nExim Auth failed2025-11-18 02:51:41 dovecot_login authenticator failed for (argument.net.tomline.ru) [213.183.100.27]:60582: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)213.183.100.272017370jk  -e# ossec13001i lExim Auth failed2025-11-18 02:51:38 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:46459: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)187.93.2.863469034j W' ossec9708i fDovecot Aborted Login with empty userNov 18 02:51:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034si  -y# ossec13001i `Exim Auth failed2025-11-18 02:51:28 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:35640: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)2.54.97.134294640Sh  -5% ossec13001i Exim Auth failed2025-11-18 02:52:06 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:48008: 535 Incorrect authentication data (set_id=contato)111.26.63.871814991Xg  -?% ossec13001i Exim Auth failed2025-11-18 02:51:59 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:39508: 535 Incorrect authentication data (set_id=misterthomas)27.24.141.881814991~f  -+ ossec13001i xExim Auth failed2025-11-18 02:51:52 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:40577: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)186.215.107.1893469034de  -Q+ ossec13001i rExim Auth failed2025-11-18 02:51:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51626: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034'd  e#) ossec9710i pDovecot Auth failed on disconnected session.Nov 18 02:51:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750 * n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z >  4 * p f \  R HvlbXND:0&TJ|@r6h^,"xnd(ZPF<2 ~tjVLB.$8` f>\4*RHzp | r h ^ T J @ 6 , "    x vlbXND:0& i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i q i i i e i [ i  i s i s i y i q i i i ] i  i U i S i Q i O i M i 5 i 3 i  i  i  i  i  i  i  i  i  i  i  i } i u i  i  i  i  i  i F i D i , i c i * i & i  i * i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i x i  i  i  i  i ~ i L i J i ` i \ i V i N i N i > i t i 8 i  i  i  i 2 i  i  i  i  i  i  i  i  i ~ i } i | i { i z i y i x i w i v i u i t i Xs i r i pq i hp i do i Ln i xm i nl i lk i fj i `i i h i g i xf i re i pd i Pc i J` i H_ i 2^ i 0] i *b i a i Z i Y i\ i[ iS iR iX iW iQ iP iV iO iN iU iT iJ iI iC iH iF i|G iuM itL inK ifE ifD iX> iP= iJB iJ< iFA iF@ i i i i i i i i i i i i i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i u i c i a i a i S i O i M i ; i 9 i / i ) i ' i % i % i ! i ! i  i  i  i@; i:: i:9 i87 i*8 i*6 i%? i!5 i1 i0 i/ i. i4 i- i3 i2 i% i( i$ i# i" i' i& i, i+ i* i) i! i i i i i i i ii ig i[ iI iE iA i1< i  i) i i i  i  i i i i i i i i i i i i i i i i i i i i i i i i i A'J  ) O v T<[A W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -G) ossec13001i Exim Auth failed2025-11-18 02:53:10 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:39444: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549V  -9' ossec13001i Exim Auth failed2025-11-18 02:53:03 dovecot_login authenticator failed for ([1.235.192.130]) [1.235.192.130]:51797: 535 Incorrect authentication data (set_id=contato)1.235.192.1301835841x  -! ossec13001i Exim Auth failed2025-11-18 02:52:33 dovecot_login authenticator failed for broadband-5-228-1-56.ip.moscow.rt.ru [5.228.1.56]:54168: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)5.228.1.562017370~  -' ossec13001i Exim Auth failed2025-11-18 02:52:20 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:50104: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)88.11.230.16025107695}  eC% ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:52:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<8jywENhD7s0zTY0d>51.77.141.293017382*|  e+' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:52:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822{ W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4YfnEdhDpOaxV3kv>177.87.121.473469034Vz  -9' ossec13001i Exim Auth failed2025-11-18 02:52:31 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:37261: 535 Incorrect authentication data (set_id=leandro)200.37.179.833932488Uy  -;# ossec13001i Exim Auth failed2025-11-18 02:52:21 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:45278: 535 Incorrect authentication data (set_id=misterthomas)46.8.245.342017370Vx  -9) ossec13001i Exim Auth failed2025-11-18 02:52:21 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:50579: 535 Incorrect authentication data (set_id=sales)196.189.59.226337996mw  -e) ossec13001i Exim Auth failed2025-11-18 02:52:08 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:33286: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)216.194.174.276252001,v  e-) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:52:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<2e5VE9hDyod2wSaf>118.193.38.1591819730Yu  -=) ossec13001i Exim Auth failed2025-11-18 02:52:45 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:35858: 535 Incorrect authentication data (set_id=leandro)121.73.168.1812186224Ut  -7' ossec13001i Exim Auth failed2025-11-18 02:52:05 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:34472: 535 Incorrect authentication data (set_id=xavier)182.95.46.1781269750 r i 7r W' ossec9708i VDovecot Aborted Login with empty userNov 18 02:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  e7% ossec9710i NDovecot Auth failed on disconnected session.Nov 18 02:55:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991u  -{# ossec13001i NExim Auth failed2025-11-18 02:55:25 dovecot_login authenticator failed for 111-70-51-5.emome-ip.hinet.net [111.70.51.5]:52988: 535 Incorrect authentication data (set_id=supports@opsconsorcios.com.br)111.70.51.51668284b  -Q' ossec13001i >Exim Auth failed2025-11-18 02:55:10 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:48121: 535 Incorrect authentication data (set_id=kgl@kglsolucoes.com)101.58.144.503175395*  e-% ossec9710i tDovecot Auth failed on disconnected session.Nov 18 02:56:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<+4pOHthDRY53xBIC>119.196.18.21835841  W' ossec9708i 8Dovecot Aborted Login with empty userNov 18 02:55:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 02:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e-' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:54:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991.  e/+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:54:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991  e' ossec9710i 2Dovecot Auth failed on disconnected session.Nov 18 02:54:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.72.153.110, lip=200.150.196.245, TLS, session=91.72.153.110290557/  e3) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:54:35 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=117.221.133.78, lip=200.150.196.245, TLS, session=<+OXpF9hDS7F13YVO>117.221.133.781269750X -;' ossec13001i Exim Auth failed2025-11-18 02:54:34 dovecot_login authenticator failed for (allsegsst.com.br) [112.122.54.54]:32062: 535 Incorrect authentication data (set_id=nologin)112.122.54.5418149913  e9+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:54:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001+  e1# ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:53:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750  Be-  - % ossec13001i Exim Auth failed2025-11-18 02:57:33 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:38924: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)111.70.32.101668284  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 02:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034!  e' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:56:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991 W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342  e;' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:56:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.10518197304  eC# ossec9710i xDovecot Auth failed on disconnected session.Nov 18 02:56:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483Y  -C% ossec13001i Exim Auth failed2025-11-18 02:56:47 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59184: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758V  -9' ossec13001i Exim Auth failed2025-11-18 02:56:42 dovecot_login authenticator failed for ([61.169.54.150]) [61.169.54.150]:44637: 535 Incorrect authentication data (set_id=contato)61.169.54.1501814991X  -=' ossec13001i Exim Auth failed2025-11-18 02:56:35 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:60242: 535 Incorrect authentication data (set_id=supports)125.19.195.661269750q  -k+ ossec13001i Exim Auth failed2025-11-18 02:56:28 dovecot_login authenticator failed for ([113.160.171.125]) [113.160.171.125]:19152: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)113.160.171.1251562822c  -U% ossec13001i ~Exim Auth failed2025-11-18 02:56:14 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:58352: 535 Incorrect authentication data (set_id=envios)65.181.79.601819730%  e%# ossec9710i LDovecot Auth failed on disconnected session.Nov 18 02:55:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001c  -U% ossec13001i JExim Auth failed2025-11-18 02:55:20 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:40600: 535 Incorrect authentication data (set_id=kgl)74.62.20.1706252001+  e)+ ossec9710i `Dovecot Auth failed on disconnected session.Nov 18 02:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841i  -]) ossec13001i \Exim Auth failed2025-11-18 02:55:39 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:55778: 535 Incorrect authentication data (set_id=envios@comercial.art.br)116.171.27.2481814991  mxJg- -U+ ossec13001i &Exim Auth failed2025-11-18 02:59:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52298: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034-,  e1' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:58:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867'+  e'% ossec9710i *Dovecot Auth failed on disconnected session.Nov 18 02:59:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991**  e)) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:58:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251) W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W(  -=% ossec13001i Exim Auth failed2025-11-18 02:58:26 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:30390: 535 Incorrect authentication data (set_id=vendas.luiz)203.252.10.41835841+'  e+) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:58:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730,&  e-+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:58:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1atkJthDGO3Bl4nP>193.151.137.207130758Y%  -=) ossec13001i Exim Auth failed2025-11-18 02:57:43 dovecot_login authenticator failed for ([222.128.15.132]) [222.128.15.132]:37754: 535 Incorrect authentication data (set_id=contato)222.128.15.1321814991$$  e' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:57:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822#  W' ossec9708i Dovecot Aborted Login with empty userNov 18 02:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)" e+% ossec9710i Dovecot Auth failed on disconnected session.Nov 18 02:58:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103{!  -' ossec13001i Exim Auth failed2025-11-18 02:57:59 dovecot_login authenticator failed for 110-25-93-213.adsl.fetnet.net [110.25.93.213]:41266: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)110.25.93.2131668284f  -U+ ossec13001i Exim Auth failed2025-11-18 02:57:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52181: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034  h8% #,;  e++ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:01:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<0ZqgMdhD8IyGx8nN>134.199.201.2056252001]:  -E) ossec13001i Exim Auth failed2025-11-18 03:01:09 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:33896: 535 Incorrect authentication data (set_id=aureovieira)115.141.143.581835841)9  e%+ ossec9710i }Dovecot Auth failed on disconnected session.Nov 18 03:00:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991e8 -Q+ ossec13001i uExim Auth failed2025-11-18 03:00:19 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52121: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.14134690347  W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e6  -W' ossec13001i Exim Auth failed2025-11-18 03:00:48 dovecot_login authenticator failed for ([5.141.122.210]) [5.141.122.210]:58616: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)5.141.122.2102017370&5  e%% ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:00:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991,4  e++ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:00:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628223  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 03:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(2  e'' ossec9710i FDovecot Auth failed on disconnected session.Nov 18 02:59:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430841 W' ossec9708i DDovecot Aborted Login with empty userNov 18 02:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.0  e5% ossec9710i ,Dovecot Auth failed on disconnected session.Nov 18 02:59:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<9ptPKdhDTYR3xBIC>119.196.18.21835841r/  -m+ ossec13001i cExim Auth failed2025-11-18 03:00:02 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:53136: 535 Incorrect authentication data (set_id=escritura1)177.207.248.1413469034.  -% ossec13001i *Exim Auth failed2025-11-18 02:59:06 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:55760: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)179.42.49.343469034 1   vwV1!I  e# ossec9710i QDovecot Auth failed on disconnected session.Nov 18 03:03:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.9562520011H  e9' ossec9710i ODovecot Auth failed on disconnected session.Nov 18 03:03:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991hG  -_' ossec13001i MExim Auth failed2025-11-18 03:03:56 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:54366: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)94.20.234.161587116F  k' ossec9709i 5Multiple Dovecot Aborted Logins with empty userNov 18 03:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lE  -c) ossec13001i 3Exim Auth failed2025-11-18 03:03:29 dovecot_login authenticator failed for ([83.220.245.109]) [83.220.245.109]:56196: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)83.220.245.1092017370hD  -a' ossec13001i Exim Auth failed2025-11-18 03:02:51 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:44770: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)65.20.143.15999237+C  e+) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750&B  e!) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:02:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730A W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-@  e/) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:02:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387t?  -q+ ossec13001i Exim Auth failed2025-11-18 03:02:10 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:48818: 535 Incorrect authentication data (set_id=memaagostinho)122.148.199.1652077456Y>  -=) ossec13001i Exim Auth failed2025-11-18 03:03:06 dovecot_login authenticator failed for ([128.185.247.53]) [182.95.222.118]:52052: 535 Incorrect authentication data (set_id=eduardo)182.95.222.1181269750s=  -o+ ossec13001i Exim Auth failed2025-11-18 03:01:59 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:40342: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)220.180.171.1571814991< W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   ,  <fjY W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:05:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034TX  -5' ossec13001i Exim Auth failed2025-11-18 03:05:11 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:58444: 535 Incorrect authentication data (set_id=sales)180.172.33.521814991fW  -U+ ossec13001i qExim Auth failed2025-11-18 03:04:31 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:35646: 535 Incorrect authentication data (set_id=sales)203.192.211.1561269750xV  -% ossec13001i iExim Auth failed2025-11-18 03:04:24 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:51623: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)174.79.87.536252001RU  -3% ossec13001i eExim Auth failed2025-11-18 03:04:20 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:6467: 535 Incorrect authentication data (set_id=compras)203.177.4.911694008\T  -I% ossec13001i [Exim Auth failed2025-11-18 03:04:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57059: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758iS  -[+ ossec13001i Exim Auth failed2025-11-18 03:04:58 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:52833: 535 Incorrect authentication data (set_id=aureovieira)207.200.180.1746252001lR  -a+ ossec13001i sExim Auth failed2025-11-18 03:04:34 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:57694: 535 Incorrect authentication data (set_id=compras)223.197.153.1351819730lQ  -e' ossec13001i sExim Auth failed2025-11-18 03:04:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:50691: 535 Incorrect authentication data (set_id=sales@lixadoracuritiba.com.br)83.136.176.122510769mP  -g' ossec13001i yExim Auth failed2025-11-18 03:04:40 dovecot_login authenticator failed for (90.247.17.175.adsl-pool.jlccptt.net.cn) [175.17.247.90]:21298: 535 Incorrect authentication data (set_id=contato)175.17.247.901814991O W' ossec9708i qDovecot Aborted Login with empty userNov 18 03:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344N  e?' ossec9710i iDovecot Auth failed on disconnected session.Nov 18 03:04:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651oM  -g+ ossec13001i ]Exim Auth failed2025-11-18 03:04:11 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:63106: 535 Incorrect authentication data (set_id=sales@calcautomacao.com.br)211.169.212.2061835841hL  -[) ossec13001i Exim Auth failed2025-11-18 03:04:47 dovecot_login authenticator failed for ([106.247.22.181]) [106.247.22.181]:38787: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)106.247.22.1811835841XK  -=' ossec13001i UExim Auth failed2025-11-18 03:04:03 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:38185: 535 Incorrect authentication data (set_id=comercial)189.80.46.2503469034J  W' ossec9708i SDovecot Aborted Login with empty userNov 18 03:04:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  , U Z 0 nh  -i' ossec13001i Exim Auth failed2025-11-18 03:06:44 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:42273: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)92.100.39.1802017370$g  e!' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758hf  -a# ossec13001i Exim Auth failed2025-11-18 03:06:35 dovecot_login authenticator failed for (adsl-5-141-80-56.salekhard.ru) [5.141.80.56]:54079: 535 Incorrect authentication data (set_id=administrativo1)5.141.80.562017370ie  -a' ossec13001i Exim Auth failed2025-11-18 03:06:09 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64927: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795Vd  -;% ossec13001i Exim Auth failed2025-11-18 03:07:02 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:59079: 535 Incorrect authentication data (set_id=financeiro)94.50.162.662017370)c  e') ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<9+xpRdhDDNSl0xnK>165.211.25.2022233387pb  -k) ossec13001i Exim Auth failed2025-11-18 03:06:50 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:33780: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)128.185.253.981269750#a  e+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758`  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 03:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&_  e%% ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001w^  -y) ossec13001i Exim Auth failed2025-11-18 03:06:23 dovecot_login authenticator failed for ([111.38.221.138]) [111.38.221.138]:53940: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)111.38.221.1381814991S]  -5% ossec13001i Exim Auth failed2025-11-18 03:06:13 dovecot_login authenticator failed for ([117.39.63.46]) [117.39.63.46]:49065: 535 Incorrect authentication data (set_id=adriana)117.39.63.461814991p\  -k) ossec13001i Exim Auth failed2025-11-18 03:06:57 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:60806: 535 Incorrect authentication data (set_id=sandromiguel)24.105.160.1006252001b[  -W# ossec13001i Exim Auth failed2025-11-18 03:06:53 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:47874: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)5.11.249.16298795vZ  -u+ ossec13001i Exim Auth failed2025-11-18 03:06:00 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:47653: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)222.108.177.1101835841  m @SLbkq~\w  -E' ossec13001i )Exim Auth failed2025-11-18 03:07:36 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:41432: 535 Incorrect authentication data (set_id=faturamento)118.121.234.51814991ov  -g+ ossec13001i %Exim Auth failed2025-11-18 03:07:32 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:43614: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)154.146.240.1232542007u W' ossec9708i %Dovecot Aborted Login with empty userNov 18 03:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{t  -+ ossec13001i !Exim Auth failed2025-11-18 03:07:29 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:45428: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)128.185.252.1101269750]s  -G' ossec13001i 9Exim Auth failed2025-11-18 03:07:53 dovecot_login authenticator failed for ([111.26.100.88]) [111.26.100.88]:34880: 535 Incorrect authentication data (set_id=isabellylisboa)111.26.100.881814991sr  -u% ossec13001i ;Exim Auth failed2025-11-18 03:07:54 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:40622: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)75.64.207.526252001fq  -Y' ossec13001i 'Exim Auth failed2025-11-18 03:07:34 dovecot_login authenticator failed for ppp85-141-77-192.pppoe.mtu-net.ru [85.141.77.192]:52942: 535 Incorrect authentication data (set_id=contato)85.141.77.1922017370p  -+ ossec13001i !Exim Auth failed2025-11-18 03:07:28 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:55194: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)188.234.212.1012017370io  -_' ossec13001i Exim Auth failed2025-11-18 03:07:20 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:36425: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)178.68.91.1192017370)n  e)' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:07:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<6/p6RthDfIVn9M4G>103.244.206.61643084m  W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:07:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,l  e++ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001jk  -_) ossec13001i Exim Auth failed2025-11-18 03:06:42 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:57872: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)178.176.229.3620173700j  e3+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822$i  e## ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:06:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483  % 5  ' Q ZqX&; q  -q% ossec13001i Exim Auth failed2025-11-18 03:09:21 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51580: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)85.19.195.1231440961  e5+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:09:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822}  -) ossec13001i Exim Auth failed2025-11-18 03:09:56 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:50548: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)123.193.152.641668284.  e1) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:09:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730g  -[' ossec13001i Exim Auth failed2025-11-18 03:09:40 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:46010: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)117.245.138.21269750.  e1) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:09:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044  W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -Y% ossec13001i MExim Auth failed2025-11-18 03:08:12 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:51166: 535 Incorrect authentication data (set_id=marialuiza)111.70.32.491668284s~  -s' ossec13001i uExim Auth failed2025-11-18 03:08:52 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:33274: 535 Incorrect authentication data (set_id=misterthomas)125.20.251.661269750R}  -3% ossec13001i cExim Auth failed2025-11-18 03:08:33 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:41073: 535 Incorrect authentication data (set_id=rafael)1.82.135.1541814991p|  -k) ossec13001i aExim Auth failed2025-11-18 03:08:32 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:57907: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)115.141.143.581835841{ W' ossec9708i aDovecot Aborted Login with empty userNov 18 03:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lz  -c) ossec13001i SExim Auth failed2025-11-18 03:08:19 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:60208: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)112.162.18.1501835841ay  -K+ ossec13001i OExim Auth failed2025-11-18 03:08:14 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:47582: 535 Incorrect authentication data (set_id=atualizacoes)219.152.206.1551814991rx  -o) ossec13001i /Exim Auth failed2025-11-18 03:07:41 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:48384: 535 Incorrect authentication data (set_id=financeiro)178.140.95.2212017370 n  m+K1J[ni  -a% ossec13001i Exim Auth failed2025-11-18 03:11:08 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:50543: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)61.72.59.1061835841k  -c' ossec13001i7Exim Auth failed2025-11-18 03:12:06 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:54394: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)111.26.79.1121814991c  -S' ossec13001i Exim Auth failed2025-11-18 03:10:48 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:43737: 535 Incorrect authentication data (set_id=formula316)103.148.92.571168579 W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -I% ossec13001i Exim Auth failed2025-11-18 03:10:07 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:33957: 535 Incorrect authentication data (set_id=contato)46.10.56.170732800  3C% ossec11301i New FTP connection.Nov 18 03:11:00 hosting pure-ftpd: (?@64.62.156.66) [INFO] New connection from 64.62.156.6664.62.156.666252001  3C% ossec11301i New FTP connection.Nov 18 03:10:54 hosting pure-ftpd: (?@64.62.156.38) [INFO] New connection from 64.62.156.3864.62.156.386252001(  e'' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001d  -Q+ ossec13001i Exim Auth failed2025-11-18 03:10:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64657: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651,  e/' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:10:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001/  e3+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:11:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758w  -{' ossec13001i Exim Auth failed2025-11-18 03:10:48 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:49006: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)73.128.151.926252001,  e/' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:10:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867m  -e) ossec13001i Exim Auth failed2025-11-18 03:09:56 dovecot_login authenticator failed for ([39.152.138.179]) [39.152.138.178]:50470: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)39.152.138.1781814991Y  -=) ossec13001i Exim Auth failed2025-11-18 03:09:52 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:43866: 535 Incorrect authentication data (set_id=contato)210.219.232.341835841  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 03:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1yeyTthDmsGxV3kv>177.87.121.473469034 V  B I / vV%  W) ossec9708i9Dovecot Aborted Login with empty userNov 18 03:12:07 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=109.105.209.23, lip=200.150.196.245, TLS, session=109.105.209.232264397%$  e%# ossec9710iqDovecot Auth failed on disconnected session.Nov 18 03:13:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483)#  e%+ ossec9710ioDovecot Auth failed on disconnected session.Nov 18 03:13:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001z"  -) ossec13001imExim Auth failed2025-11-18 03:13:01 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:48728: 535 Incorrect authentication data (set_id=contato)125.23.155.1101269750i!  -_' ossec13001igExim Auth failed2025-11-18 03:12:55 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:59870: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)218.4.205.2421814991  k' ossec9709iQMultiple Dovecot Aborted Logins with empty userNov 18 03:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)  e+' ossec9710iODovecot Auth failed on disconnected session.Nov 18 03:12:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758^ -E) ossec13001iIExim Auth failed2025-11-18 03:12:24 dovecot_login authenticator failed for (User) [177.74.174.120]:58803: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)177.74.174.1203469034  W' ossec9708ioDovecot Aborted Login with empty userNov 18 03:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)  -[+ ossec13001iWExim Auth failed2025-11-18 03:12:38 dovecot_login authenticator failed for 146-115-112-108.s362.c3-0.wak-ubr1.sbo-wak.ma.cable.rcncustomer.com [146.115.112.108]:56230: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)146.115.112.1086252001 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u  -s+ ossec13001i Exim Auth failed2025-11-18 03:11:25 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:46808: 535 Incorrect authentication data (set_id=assessoria)122.187.229.1941269750V  -9' ossec13001i Exim Auth failed2025-11-18 03:11:24 dovecot_login authenticator failed for ([119.206.62.88]) [119.206.62.88]:47300: 535 Incorrect authentication data (set_id=contato)119.206.62.881835841l  -c) ossec13001i Exim Auth failed2025-11-18 03:11:21 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:47349: 535 Incorrect authentication data (set_id=eleicoes)67.172.244.2356252001p  -m' ossec13001iExim Auth failed2025-11-18 03:11:17 dovecot_login authenticator failed for ([61.186.136.36]) [61.186.136.36]:55421: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)61.186.136.361814991 S ^nfvS4  e# ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:14:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<5sT6YdhDrNaUcQQF>148.113.4.51269750l3  -c) ossec13001iExim Auth failed2025-11-18 03:14:37 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:33132: 535 Incorrect authentication data (set_id=financeiro)175.156.80.16618802512 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+1  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:14:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456j0  -c% ossec13001iExim Auth failed2025-11-18 03:14:08 dovecot_login authenticator failed for ([101.13.2.177]) [101.13.2.177]:54376: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)101.13.2.1771668284b/  -Q' ossec13001iExim Auth failed2025-11-18 03:13:56 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:57724: 535 Incorrect authentication data (set_id=maia)24.119.144.866252001g.  -[' ossec13001iExim Auth failed2025-11-18 03:13:47 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:43953: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)14.48.227.1181835841l-  -e' ossec13001iyExim Auth failed2025-11-18 03:13:13 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:55138: 535 Incorrect authentication data (set_id=atualizacoes)78.66.119.13926618861,  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:13:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<9sl/XthDqqRrhr+5>107.134.191.1856252001#+  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:13:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758_*  -O% ossec13001iExim Auth failed2025-11-18 03:13:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64037: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)62.60.131.17130758) W' ossec9708iDovecot Aborted Login with empty userNov 18 03:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`(  -M' ossec13001iuExim Auth failed2025-11-18 03:13:08 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:46436: 535 Incorrect authentication data (set_id=contato)103.148.92.291168579('  e%) ossec9710iWDovecot Auth failed on disconnected session.Nov 18 03:12:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.14515628225&  eA' ossec9710iCDovecot Auth failed on disconnected session.Nov 18 03:12:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084  lShC  -[) ossec13001i5Exim Auth failed2025-11-18 03:16:20 dovecot_login authenticator failed for ([219.144.50.202]) [219.144.50.202]:33529: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)219.144.50.2021814991\B  -C) ossec13001i/Exim Auth failed2025-11-18 03:16:14 dovecot_login authenticator failed for ([111.26.115.121]) [111.26.115.122]:39382: 535 Incorrect authentication data (set_id=formula316)111.26.115.1221814991]A  -E) ossec13001iQExim Auth failed2025-11-18 03:16:49 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:44990: 535 Incorrect authentication data (set_id=aureovieira)103.233.92.1231269750@ W' ossec9708iADovecot Aborted Login with empty userNov 18 03:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W?  -;' ossec13001i?Exim Auth failed2025-11-18 03:16:31 dovecot_login authenticator failed for ([59.145.171.168]) [182.78.82.194]:58990: 535 Incorrect authentication data (set_id=adriana)182.78.82.1941269750}>  -' ossec13001i-Exim Auth failed2025-11-18 03:16:12 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:39687: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)217.29.30.1351527747p=  -k) ossec13001iExim Auth failed2025-11-18 03:15:51 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:35598: 535 Incorrect authentication data (set_id=isabellylisboa)83.227.140.1252661886!< 3G' ossec11301iNew FTP connection.Nov 18 03:15:51 hosting pure-ftpd: (?@20.65.193.148) [INFO] New connection from 20.65.193.14820.65.193.1486252001;  W' ossec9708i$Dovecot Aborted Login with empty userNov 18 03:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%:  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:15:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<9L8JZNhD+ptbejg7>91.122.56.5920173709  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r8  -s% ossec13001iExim Auth failed2025-11-18 03:15:30 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:52014: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)61.72.58.2421835841+7  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:15:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<8coCY9hDlN13xBIC>119.196.18.21835841k6  -_+ ossec13001iExim Auth failed2025-11-18 03:15:11 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61941: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.231160565105  e5) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:14:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841 z s t k7z,Q  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:19:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001^P  -I' ossec13001iExim Auth failed2025-11-18 03:19:01 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:48965: 535 Incorrect authentication data (set_id=paulinho.vendas)117.245.138.21269750-O  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:19:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044rN  -o) ossec13001iExim Auth failed2025-11-18 03:18:45 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46019: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)103.248.30.20512697501M  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:17:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.11015628221L  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:17:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044K W' ossec9708i~Dovecot Aborted Login with empty userNov 18 03:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340J  e5) ossec9710ixDovecot Auth failed on disconnected session.Nov 18 03:17:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730#I  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:17:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<82/Aa9hD2pKl0iHB>165.210.33.1932233387^H  -G) ossec13001iExim Auth failed2025-11-18 03:17:41 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:49308: 535 Incorrect authentication data (set_id=fernandabrum)50.217.255.1716252001{G  -' ossec13001i|Exim Auth failed2025-11-18 03:17:30 dovecot_login authenticator failed for 111-70-49-179.emome-ip.hinet.net [111.70.49.179]:55094: 535 Incorrect authentication data (set_id=fernandabrum@prafebrum.com.br)111.70.49.17916682840F  e9% ossec9710ixDovecot Auth failed on disconnected session.Nov 18 03:17:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001)E  e') ossec9710iEDovecot Auth failed on disconnected session.Nov 18 03:16:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<56THZ9hDgDSvfiX3>175.126.37.2471835841(D  e'' ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 03:16:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001 # +-`  e/) ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 03:20:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750o_  -k' ossec13001iLExim Auth failed2025-11-18 03:21:00 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:47831: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)41.219.149.782328926 ^  3G' ossec11301iNew FTP connection.Nov 18 03:19:51 hosting pure-ftpd: (?@50.207.23.120) [INFO] New connection from 50.207.23.12050.207.23.1206252001] W' ossec9708iDovecot Aborted Login with empty userNov 18 03:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W\  -=% ossec13001iExim Auth failed2025-11-18 03:19:17 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:50621: 535 Incorrect authentication data (set_id=vendas.luiz)111.50.70.341814991w[  -{' ossec13001iExim Auth failed2025-11-18 03:19:51 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:36708: 535 Incorrect authentication data (set_id=administrativo1)108.30.14.2216252001,Z  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:20:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.18062520015Y  Ac' ossec11302iFTP Authentication failed.Nov 18 03:19:57 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]50.207.23.1206252001tX  -u' ossec13001iExim Auth failed2025-11-18 03:19:41 dovecot_login authenticator failed for ([121.147.74.67]) [121.147.74.67]:40974: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)121.147.74.671835841'W  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750uV  -u) ossec13001iExim Auth failed2025-11-18 03:18:35 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:49460: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)186.97.203.1653686110U  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2vPhbthDOKGxV3kv>177.87.121.473469034T  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:19:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,S  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:18:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<12BobthDxo1w2eny>112.217.233.2421835841YR  -A' ossec13001iExim Auth failed2025-11-18 03:18:22 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:41852: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758  $.t;q  k' ossec9709inMultiple Dovecot Aborted Logins with empty userNov 18 03:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346p Ac' ossec11302ihFTP Authentication failed.Nov 18 03:21:27 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]50.207.23.1206252001Yo  -C% ossec13001ibExim Auth failed2025-11-18 03:21:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51309: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758!n 3G' ossec11301ibNew FTP connection.Nov 18 03:21:21 hosting pure-ftpd: (?@50.207.23.120) [INFO] New connection from 50.207.23.12050.207.23.1206252001Zm  c' ossec11321iXActive Response. FTP brute force attack (Port 21 is protected)Nov 18 03:21:10 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]50.207.23.1206252001l  S' ossec211321iXPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 50.207.23.12050.207.23.12062520019k  Ic' ossec11331i Stealth FTP brute force attackNov 18 03:21:56 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]50.207.23.12062520016j Ac' ossec11302iFTP Authentication failed.Nov 18 03:20:12 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]50.207.23.1206252001ri  -o) ossec13001iExim Auth failed2025-11-18 03:20:11 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:34430: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)190.114.243.873625428!h 3G' ossec11301iNew FTP connection.Nov 18 03:20:08 hosting pure-ftpd: (?@50.207.23.120) [INFO] New connection from 50.207.23.12050.207.23.12062520010g  e5) ossec9710iNDovecot Auth failed on disconnected session.Nov 18 03:21:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730ef  -U+ ossec13001iLExim Auth failed2025-11-18 03:20:59 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:65094: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795je  -_) ossec13001iFExim Auth failed2025-11-18 03:20:52 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:55768: 535 Incorrect authentication data (set_id=contato)81.233.235.2032661886gd  -Y) ossec13001i:Exim Auth failed2025-11-18 03:20:40 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:40017: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)61.150.123.1061814991c W' ossec9708i2Dovecot Aborted Login with empty userNov 18 03:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5ZUFdthDCsexV3kv>177.87.121.4734690347b  eE' ossec9710iFDovecot Auth failed on disconnected session.Nov 18 03:20:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001ha  -[) ossec13001i.Exim Auth failed2025-11-18 03:20:28 dovecot_login authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:56706: 535 Incorrect authentication data (set_id=financeiro)110.25.104.1011668284 / pOi/6  e?+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:23:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001b~  -S% ossec13001iExim Auth failed2025-11-18 03:24:04 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:34156: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)203.82.40.341694008.}  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:24:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<3YVjgthD9MqkXLll>164.92.185.1012921044k|  -a) ossec13001iExim Auth failed2025-11-18 03:23:55 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:39576: 535 Incorrect authentication data (set_id=info@89fmjoinville.com.br)14.139.107.1461269750.{  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:23:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001z W' ossec9708iDovecot Aborted Login with empty userNov 18 03:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.y  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:23:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044x  ;) ossec13008iMail Recipient rejected2025-11-18 03:22:47 H=([158.94.209.169]) [158.94.209.169]:53245 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : "JunkMail rejected - ([158.94.209.169]) [158.94.209.169]:53245 is in an RBL: Listed by SBL, see https://check.spamhaus.org/sbl/query/SBL686264"158.94.209.1692750405w W' ossec9708iDovecot Aborted Login with empty userNov 18 03:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343v e9) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:22:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<33yoe9hDwLGkXLll>164.92.185.1012921044u  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`t  -M' ossec13001iExim Auth failed2025-11-18 03:21:59 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:64387: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.7218197302s  e9) ossec9710irDovecot Auth failed on disconnected session.Nov 18 03:21:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387wr  -{) ossec13001iXExim Auth failed2025-11-18 03:21:11 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:58709: 535 Incorrect authentication data (set_id=alex.vendas)195.142.25.183298795 ; s ^;OEaya;"  e) ossec9710iNDovecot Auth failed on disconnected session.Nov 18 03:25:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044#  e!# ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 03:26:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730m  -g' ossec13001iExim Auth failed2025-11-18 03:24:26 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:34918: 535 Incorrect authentication data (set_id=eleicoes)122.185.187.21269750d -S' ossec13001iExim Auth failed2025-11-18 03:24:08 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:37372: 535 Incorrect authentication data (set_id=info)103.51.26.1981269750`  -K) ossec13001iBExim Auth failed2025-11-18 03:25:05 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:40506: 535 Incorrect authentication data (set_id=xavier)46.212.127.1283144096  -' ossec13001i8Exim Auth failed2025-11-18 03:24:54 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:39058: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)187.51.219.263469034h  -_% ossec13001i8Exim Auth failed2025-11-18 03:24:54 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:48366: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)111.26.63.871814991  k' ossec9709i"Multiple Dovecot Aborted Logins with empty userNov 18 03:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/ e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:24:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001^  -G) ossec13001iBExim Auth failed2025-11-18 03:25:04 dovecot_login authenticator failed for (p186-137.samaralan.ru) [85.236.186.137]:43466: 535 Incorrect authentication data (set_id=rodrigo)85.236.186.1372017370  W' ossec9708i>Dovecot Aborted Login with empty userNov 18 03:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}  -+ ossec13001i0Exim Auth failed2025-11-18 03:24:48 dovecot_login authenticator failed for (nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:35376: 535 Incorrect authentication data (set_id=info@deproi.com.br)122.187.229.14912697507  eA+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:23:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.20562520014  e;+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:24:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822   > $ klb  -S% ossec13001iExim Auth failed2025-11-18 03:28:04 dovecot_login authenticator failed for ([213.234.0.90]) [213.234.0.90]:40826: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)213.234.0.902017370{  -# ossec13001iExim Auth failed2025-11-18 03:28:00 dovecot_login authenticator failed for (062079146001.mbb.telenor.dk) [62.79.146.1]:44248: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)62.79.146.126230325  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:26:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<5G+pi9hDDMGWXx+e>150.95.31.1581605651*  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:26:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044k  -c' ossec13001iExim Auth failed2025-11-18 03:26:19 dovecot_login authenticator failed for ([119.29.137.49]) [119.29.137.49]:59974: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)119.29.137.491814991z  -) ossec13001iExim Auth failed2025-11-18 03:26:17 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:55327: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)90.161.217.2282510769&  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:26:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841(  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:26:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001Y  -=) ossec13001iExim Auth failed2025-11-18 03:26:38 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:59904: 535 Incorrect authentication data (set_id=contato)113.140.95.2501814991.  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -;% ossec13001iExim Auth failed2025-11-18 03:26:25 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:41066: 535 Incorrect authentication data (set_id=marialuiza)117.135.6.101814991\  -C) ossec13001ivExim Auth failed2025-11-18 03:25:56 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:56038: 535 Incorrect authentication data (set_id=assessoria)152.52.246.1781269750j  -e# ossec13001ifExim Auth failed2025-11-18 03:25:41 dovecot_login authenticator failed for ([46.44.24.40]) [46.44.24.40]:55357: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)46.44.24.402017370 W' ossec9708i\Dovecot Aborted Login with empty userNov 18 03:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 z*4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f  \ R >  4 * H&lbXNvD:0r@6^ThJ|,"xndF<2 Z(P`VLB8~t.j$zf4\RH>p | r h ^ T J @ 6 , "    x n d Z Pz*  vlbXND:0& i i i i i i i i i i i i i i i i i i i i i i i i i i is i_ i_ iY iU i iy iw iw ii ie i5 i- i- i i iK iG iA i5 i- i i i i i i i i i i i i io ik i i i ix iD i< i2 i, i] iU i i i i i i i i i i i i i i i i i i i iv iv i i^ iZ iR iL i@ ib i` iB i i. i( i i i  i i i i( i i i i i i i i i i i i i i i i i i i i i i i~ iv if i\ iN iB iB i> i8 i8 i0 i" i i i i~ i i} i| i{ iz i i iy ix iw iv iu it ik irs inq ihp ibo ibn iXr iXm iXl iNg iLf iL_ i7 i i  i  i  i i  i  i= i < i; i: i9 i1 i0 i7 i/ i. i4 i6 i3 i2 i5 i# i" i* i) i( i& i% i' i- i, i$ i+ iy! ii iY iK iK iK iC iA i; i3 i+ i+ iFe iFb i:d i2c i.a i&` ij ii ih iW iZ iY i^ i[ iX i] i\ iT iQ iP iO iN iV iU iS iR iM iI iH iL i~K i|G ixJ ixF iQA iEE iA@ i?? i=D i5C i/B i->( i-8 i$; i= i< i: i9 i8 i7 i6 i5 i4 i3 i2 i1 i0 i, i/ i+ i. i* i) iy- iu( iq$ io# io im" ig! iW' iW iQ iO iI iC& i9%  -)+  e%+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:28:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822]*  -E) ossec13001iExim Auth failed2025-11-18 03:28:18 dovecot_login authenticator failed for ([221.10.221.104]) [221.10.221.104]:50594: 535 Incorrect authentication data (set_id=aureovieira)221.10.221.1041814991Y)  -=) ossec13001iExim Auth failed2025-11-18 03:28:16 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:34011: 535 Incorrect authentication data (set_id=adriana)200.202.250.463469034)(  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:28:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841]'  -E) ossec13001i(Exim Auth failed2025-11-18 03:28:56 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:53706: 535 Incorrect authentication data (set_id=aureovieira)175.206.113.911835841&  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d%  -U' ossec13001iExim Auth failed2025-11-18 03:27:30 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:40470: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)123.209.76.172077456m$  -e) ossec13001iExim Auth failed2025-11-18 03:27:22 dovecot_login authenticator failed for (nhavuivn.com) [210.245.33.154]:48896: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)210.245.33.1541562822n#  -g) ossec13001iExim Auth failed2025-11-18 03:27:17 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:56866: 535 Incorrect authentication data (set_id=marialuiza)76.136.164.1576252001p"  -o% ossec13001iExim Auth failed2025-11-18 03:27:07 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:38815: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)111.70.32.101668284S!  -7# ossec13001iExim Auth failed2025-11-18 03:27:47 dovecot_login authenticator failed for ([110.16.40.3]) [110.16.40.3]:32202: 535 Incorrect authentication data (set_id=marialuiza)110.16.40.31814991  -%) ossec13001iExim Auth failed2025-11-18 03:27:59 dovecot_login authenticator failed for (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:31860: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)122.163.127.1412697501  e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:27:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<+SVVkNhDFpd2wSaf>118.193.38.1591819730j  -]+ ossec13001iExim Auth failed2025-11-18 03:27:34 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54909: 535 Incorrect authentication data (set_id=junior.gomes)207.200.180.1746252001 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 =8  qIl=+:  e-' ossec9710ivDovecot Auth failed on disconnected session.Nov 18 03:30:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991Y9  -A' ossec13001iExim Auth failed2025-11-18 03:30:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:16573: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758$8  e) ossec9710i^Dovecot Auth failed on disconnected session.Nov 18 03:29:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750.7  e1) ossec9710iZDovecot Auth failed on disconnected session.Nov 18 03:29:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750u6  -y% ossec13001iRExim Auth failed2025-11-18 03:29:38 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:35050: 535 Incorrect authentication data (set_id=envios@comercial.art.br)71.229.1.18662520015 W' ossec9708iLDovecot Aborted Login with empty userNov 18 03:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*4  e)) ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 03:29:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001^3  -M# ossec13001ibExim Auth failed2025-11-18 03:29:54 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:55373: 535 Incorrect authentication data (set_id=envios)111.70.32.516682842  W% ossec9708i`Dovecot Aborted Login with empty userNov 18 03:29:51 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.233, lip=200.150.196.245, TLS, session=71.6.134.2336252001-1  e1' ossec9710iBDovecot Auth failed on disconnected session.Nov 18 03:29:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001\0  -I% ossec13001iExim Auth failed2025-11-18 03:28:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64598: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758/  W' ossec9708i.Dovecot Aborted Login with empty userNov 18 03:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(.  e+# ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 03:28:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001`-  -I+ ossec13001iExim Auth failed2025-11-18 03:28:42 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:50274: 535 Incorrect authentication data (set_id=aureovieira)125.139.124.1201835841`,  -K) ossec13001iExim Auth failed2025-11-18 03:28:31 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:46678: 535 Incorrect authentication data (set_id=edna)116.98.104.1381562822 sV  zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    G- wj]CfLcV:T}p% reXK>$ {naTG:- wj]PC6)sf~qdWJ= sY2?1 f Y L ? 2 & 7)P1655842 1668284N  1668284N 1668284. 16682842 1668284 1668284 1668284 1668284 1694008 1668284 1668284l 1668284T 1694008R 174982 1668284 1668284 1668284 1668284^ 1694008r 1694008 1668284< 1694008 1668284 1668284t 1668284q 1668284- 1694008F 1668284 1668284 1668284/ 1668284. 1814991; 1668284) 1668284 1814991l 1814991` 1668284 1814991r 1668284 1668284 1668284 1668284O 1668284 1814991 1814991 1668284 1814991 1668284N 1668284a 1668284 1668284{ 1668284v 1668284 1668284S 1668284m 1668284+ 1668284+B 1668284* 1668284*y 1668284)d 1668284) 1668284(g 1668284(M 1668284' 1668284'p 1668284'9 1668284& 1668284& 1668284& 1668284&m 1668284&g 1668284& 1668284% 1668284$ 1668284$ 1668284$ 1668284$h 1668284$P 1668284$ 1668284# 1668284# 1733045# 1668284" 1668284" 1668284"f 1668284!P 1668284!& 1668284 1733045  1668284 1668284 1668284 1668284 1668284F 1668284) 1668284 1668284 1668284? 1668284 1668284 1668284 1668284 1668284X 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1694008~ 1668284a 1668284G 16682840 1668284 1668284# 1733045 1668284 1668284 1668284 1668284 1668284W 1694008 1668284 1668284 16682849 1668284 1814991$ 1814991 1733045 1733045  1733045 1733045 1733045 1694008 1694008 1694008n 1668284 1668284 1668284 1668284  1668284 w 1668284 V 1668284  1668284  1668284 1668284 G 1668284 * 1668284 1668284 ' 1668284  1668284  1668284 1668284 1668284 1668284 1668284 > 1668284 1668284G 1668284= 1668284: 1668284) 1668284 1668284 1668284 1668284 1668284 1668284f 1668284 1668284 1668284w 1668284L 1668284) 1668284 1668284V 1668284 1668284 1668284 1668284a 1668284Z 1668284 1668284> 1668284 1668284 1668284! 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284~ 1668284s 1668284r 1668284m 1668284l 1668284j 1668284d 1668284Y 1668284V 1668284R 1668284D 1668284B 1668284A 1668284> 1668284= 16682846 16682842 16682841 16682840 1668284" 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284/ 1668284/W 1668284. 1668284.X 1668284./ 1668284.& 1668284-k 1668284-c 1668284-@ 1668284-' 1668284, 1668284, 1668284, 1668284,e 1668284,M  g {k|K(VH  -9' ossec13001iExim Auth failed2025-11-18 03:31:13 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:46080: 535 Incorrect authentication data (set_id=contato)222.117.0.2531835841-G  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:31:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<5S8PnNhDHOdxoZB3>113.161.144.1191562822F  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034E  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-D  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:31:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<9PnTnNhDwqd9gnHM>125.130.113.2041835841kC  -c' ossec13001iExim Auth failed2025-11-18 03:31:35 dovecot_login authenticator failed for ([31.173.67.146]) [31.173.67.146]:44078: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)31.173.67.14620173705B  eC% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:31:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382SA  -3' ossec13001iExim Auth failed2025-11-18 03:32:06 dovecot_login authenticator failed for ([94.102.122.20]) [94.102.122.20]:58316: 535 Incorrect authentication data (set_id=info)94.102.122.202017370h@  -[) ossec13001iExim Auth failed2025-11-18 03:31:48 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62173: 535 Incorrect authentication data (set_id=info)50.149.161.1316252001? W' ossec9708iDovecot Aborted Login with empty userNov 18 03:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034">  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:30:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060w=  -}% ossec13001iExim Auth failed2025-11-18 03:30:27 dovecot_login authenticator failed for 221-120-4-49.emome-ip.hinet.net [221.120.4.49]:54403: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)221.120.4.4916682840<  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:30:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001&;  e%% ossec9710ivDovecot Auth failed on disconnected session.Nov 18 03:30:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060  L W  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:35:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<75HrqdhD6rGxV3kv>177.87.121.473469034VV  -7) ossec13001iExim Auth failed2025-11-18 03:34:52 dovecot_login authenticator failed for ([24.149.120.254]) [24.149.120.254]:45004: 535 Incorrect authentication data (set_id=info)24.149.120.2546252001U  k' ossec9709ixMultiple Dovecot Aborted Logins with empty userNov 18 03:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_T  -G+ ossec13001iDExim Auth failed2025-11-18 03:33:39 dovecot_login authenticator failed for ([218.203.179.228]) [218.203.179.228]:60088: 535 Incorrect authentication data (set_id=mariacarla)218.203.179.2281814991S W' ossec9708i<Dovecot Aborted Login with empty userNov 18 03:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5QiDpNhDKJOxV3kv>177.87.121.473469034oR  -m% ossec13001i2Exim Auth failed2025-11-18 03:33:22 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:54601: 535 Incorrect authentication data (set_id=mariacarla@transoltransportes.com.br)61.72.58.2421835841$Q  e## ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 03:33:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001vP  -u+ ossec13001i]Exim Auth failed2025-11-18 03:34:03 dovecot_login authenticator failed for ([222.173.138.250]) [222.173.138.250]:41374: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)222.173.138.2501814991'O  e#) ossec9710iUDovecot Auth failed on disconnected session.Nov 18 03:33:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750#N  3K) ossec11301iNew FTP connection.Nov 18 03:32:18 hosting pure-ftpd: (?@146.190.29.141) [INFO] New connection from 146.190.29.141146.190.29.1412750405&M  3O+ ossec11301iNew FTP connection.Nov 18 03:32:59 hosting pure-ftpd: (?@148.113.210.228) [INFO] New connection from 148.113.210.228148.113.210.22862519992L  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:32:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001-K  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:32:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841J W' ossec9708iDovecot Aborted Login with empty userNov 18 03:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/I  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:32:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841 duh[NA4' ~qd v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+~qdWJ=0# zm`SF9,G 6252001 6252001 6252001 6252001 6252001 | 6252001 o 6252001 e 6252001 ] 6252001 \ 6252001 V 6252001 : 6252001 8 6252001 5 6252001 4 6252001 1 6252001 - 6252001 6252001 6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001v 6252001' 6252001' 6252001' 6252001't 6252001'k 6252001'j 6252001'I 6252001'F 6252001'< 6252001'6 6252001' 6252001' 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001&| 6252001&v 6252001&u 6252001&s 6252001&r 6252001&n 6252001&f 6252001&[ 6252001&T 6252001&G 6252001&E 6252001&B 6252001&> 6252001&/ 6252001&& 6252001& 6252001& 6252001& 6252001& 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001%z 6252001%r 6252001%V 6252001%N 6252001%K 6252001%: 6252001%2 6252001%( 6252001%! 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$} 6252001$X 6252001$W 6252001$L 6252001$7 6252001$ 6252001$ 6252001$ 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001#~ 6252001#} 6252001#| 6252001#x 6252001#q 6252001#p 6252001#k 6252001#j 6252001#T 6252001#K 6252001#A 6252001#4 6252001#' 6252001#! 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001"z 6252001"o 6252001"l 6252001"h 6252001"e 6252001"` 6252001"] 6252001"\ 6252001"Y 6252001"L 6252001"> 6252001"6 6252001"0 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001!U 6252001!E 6252001!' 6252001!# 6252001! 6252001! 6252001! 6252001! 6252001! 6252001 6252001 6252001 6252001 6252001 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001 6252001 6252001 6252001 6252001 ^0 N t Z o J0^2f  e=% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:36:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.16518149911e  e9' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:36:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730Yd  -=) ossec13001iExim Auth failed2025-11-18 03:36:16 dovecot_login authenticator failed for ([222.99.237.249]) [222.99.237.249]:40849: 535 Incorrect authentication data (set_id=eliezer)222.99.237.2491835841'c  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:36:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<0EBUsNhD9N8kMrBu>36.50.176.1101562822.b  e3' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:36:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991)a  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:36:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841` W' ossec9708iDovecot Aborted Login with empty userNov 18 03:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342_  e9) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:36:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730k^  -g% ossec13001iExim Auth failed2025-11-18 03:36:50 dovecot_plain authenticator failed for (hq76b7pu078bo3b5zh9xz0awqw) [45.144.52.96]:49850: 535 Incorrect authentication data (set_id=design@inovasite.com)45.144.52.96660013g]  -Y) ossec13001iExim Auth failed2025-11-18 03:35:35 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:57344: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)177.174.95.2453469034\ W' ossec9708iDovecot Aborted Login with empty userNov 18 03:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3Suvq9hD9rmxV3kv>177.87.121.473469034V[  -7) ossec13001iExim Auth failed2025-11-18 03:35:28 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:53738: 535 Incorrect authentication data (set_id=info)220.180.204.321814991^Z  -O! ossec13001ioExim Auth failed2025-11-18 03:34:22 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:52184: 535 Incorrect authentication data (set_id=info@globalmedica.com.br)61.2.44.541269750aY  -Q% ossec13001ikExim Auth failed2025-11-18 03:34:17 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:46786: 535 Incorrect authentication data (set_id=cpfnc2)111.70.32.101668284gX  -[' ossec13001iExim Auth failed2025-11-18 03:35:06 dovecot_login authenticator failed for ([111.26.69.160]) [111.26.69.160]:54630: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)111.26.69.1601814991  y[u  -A+ ossec13001iyExim Auth failed2025-11-18 03:38:48 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:48734: 535 Incorrect authentication data (set_id=contato)196.190.220.168337996Tt  -9# ossec13001iwExim Auth failed2025-11-18 03:38:45 dovecot_login authenticator failed for ([58.115.14.2]) [58.115.14.2]:57072: 535 Incorrect authentication data (set_id=presidencia)58.115.14.21668284's  e#) ossec9710iwDovecot Auth failed on disconnected session.Nov 18 03:38:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044r W' ossec9708iiDovecot Aborted Login with empty userNov 18 03:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  -' ossec13001ieExim Auth failed2025-11-18 03:38:28 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:20075: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)187.218.57.503996063Wp  -A# ossec13001i5Exim Auth failed2025-11-18 03:37:40 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:38020: 535 Incorrect authentication data (set_id=marialuiza)77.78.13.13732800o  k' ossec9709i-Multiple Dovecot Aborted Logins with empty userNov 18 03:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+n  e1# ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 03:37:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750jm  -]+ ossec13001iExim Auth failed2025-11-18 03:37:15 dovecot_login authenticator failed for ([176.100.124.153]) [176.100.124.153]:51906: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)176.100.124.1532017370gl  -a# ossec13001iExim Auth failed2025-11-18 03:37:12 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:48943: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)5.30.196.79290557k  W' ossec9708iKDovecot Aborted Login with empty userNov 18 03:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034aj  -K+ ossec13001iGExim Auth failed2025-11-18 03:37:57 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52170: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034i  -% ossec13001iAExim Auth failed2025-11-18 03:37:51 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:49865: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)111.70.32.101668284-h  e1' ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 03:37:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867|g  -+ ossec13001i-Exim Auth failed2025-11-18 03:37:31 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:49469: 535 Incorrect authentication data (set_id=junior.gomes)212.120.163.1102017370 p n9S^pp  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001iExim Auth failed2025-11-18 03:40:10 dovecot_login authenticator failed for ([223.70.149.210]) [223.70.149.210]:48989: 535 Incorrect authentication data (set_id=adriana)223.70.149.2101814991j  -c) ossec13001iExim Auth failed2025-11-18 03:41:07 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:52130: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)185.255.47.19099237q  -s' ossec13001iExim Auth failed2025-11-18 03:39:31 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:53786: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)65.20.250.16399237b  -M+ ossec13001iExim Auth failed2025-11-18 03:39:25 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51789: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.14134690341  e=# ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:39:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483'~  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:39:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084} W' ossec9708iDovecot Aborted Login with empty userNov 18 03:39:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$|  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:38:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991h{  -]' ossec13001isExim Auth failed2025-11-18 03:38:41 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:35416: 535 Incorrect authentication data (set_id=paulinho.vendas)103.148.92.571168579xz  -y+ ossec13001i_Exim Auth failed2025-11-18 03:38:22 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:64492: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)211.169.212.2061835841'y  e#) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 03:38:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251yx  -}) ossec13001iYExim Auth failed2025-11-18 03:38:15 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:49133: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)177.135.67.1893469034ew  -S+ ossec13001iUExim Auth failed2025-11-18 03:38:12 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:35788: 535 Incorrect authentication data (set_id=andre.nascimento)121.135.188.1251835841(v  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:38:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<8NG4t9hDJO2B4rs4>129.226.187.561819730  ;  &   n  -e+ ossec13001iExim Auth failed2025-11-18 03:41:30 dovecot_login authenticator failed for (201.173.216.121-clientes-izzi.mx) [201.173.216.121]:59212: 535 Incorrect authentication data (set_id=financeiro)201.173.216.1213996063]  -G' ossec13001iExim Auth failed2025-11-18 03:41:29 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:37204: 535 Incorrect authentication data (set_id=info)152.231.25.643686110a  -K+ ossec13001iExim Auth failed2025-11-18 03:41:21 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:48336: 535 Incorrect authentication data (set_id=atualizacoes)103.158.138.1791269750d  -S) ossec13001iExim Auth failed2025-11-18 03:41:10 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:57358: 535 Incorrect authentication data (set_id=contato)192.46.237.1332921044  -%' ossec13001iExim Auth failed2025-11-18 03:41:32 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:59972: 535 Incorrect authentication data (set_id=thalisson.mota@fourps.com.br)189.31.138.383469034c  -S' ossec13001iExim Auth failed2025-11-18 03:40:31 dovecot_login authenticator failed for (p187-43.samaralan.ru) [85.236.187.43]:38336: 535 Incorrect authentication data (set_id=administrativo1)85.236.187.432017370{  -% ossec13001iExim Auth failed2025-11-18 03:40:21 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:34822: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)103.90.27.831643084)  e+% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:40:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:41:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:40:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822  -% ossec13001iExim Auth failed2025-11-18 03:40:41 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:48277: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)23.30.11.2536252001i  -_' ossec13001iExim Auth failed2025-11-18 03:40:59 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:56108: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)121.73.163.192186224$  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:40:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822Y  -?' ossec13001iExim Auth failed2025-11-18 03:41:00 dovecot_login authenticator failed for ([89.175.253.50]) [89.175.253.50]:44686: 535 Incorrect authentication data (set_id=financeiro)89.175.253.502017370d  -Q+ ossec13001iExim Auth failed2025-11-18 03:41:00 dovecot_login authenticator failed for ([218.154.54.1]) [222.108.177.110]:59903: 535 Incorrect authentication data (set_id=info@inovasite.com)222.108.177.1101835841 w   w"  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:44:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'!  e'% ossec9710iyDovecot Auth failed on disconnected session.Nov 18 03:43:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991e  -W' ossec13001iiExim Auth failed2025-11-18 03:42:48 dovecot_login authenticator failed for (223-25-94-211.myrepublic.com.sg) [223.25.94.211]:64088: 535 Incorrect authentication data (set_id=rafael)223.25.94.2111880251~  -+ ossec13001iKExim Auth failed2025-11-18 03:42:18 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:53804: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)201.173.216.1333996063/  e1+ ossec9710iKDovecot Auth failed on disconnected session.Nov 18 03:42:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001q  -o' ossec13001iAExim Auth failed2025-11-18 03:42:08 dovecot_login authenticator failed for 47-185-98-251.fdr03.kllr.tx.ip.frontiernet.net [47.185.98.251]:13531: 535 Incorrect authentication data (set_id=lucas)47.185.98.2516252001 W' ossec9708iYDovecot Aborted Login with empty userNov 18 03:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d -Q) ossec13001iKExim Auth failed2025-11-18 03:42:19 dovecot_plain authenticator failed for (4ONOTEBOOK-rHiE) [104.225.142.58]:21523: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)104.225.142.586251999i  -a% ossec13001iCExim Auth failed2025-11-18 03:42:10 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:55200: 535 Incorrect authentication data (set_id=isabellylisboa)201.172.26.33996063)  e+% ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 03:42:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991   e# ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 03:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001p  -q# ossec13001i+Exim Auth failed2025-11-18 03:41:47 dovecot_login authenticator failed for ([101.13.5.34]) [101.13.5.34]:43306: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)101.13.5.341668284i  -_' ossec13001i+Exim Auth failed2025-11-18 03:41:46 dovecot_login authenticator failed for ([183.69.133.54]) [183.69.133.54]:6239: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)183.69.133.541814991s  -q) ossec13001iExim Auth failed2025-11-18 03:41:19 dovecot_login authenticator failed for ([128.185.223.220]) [27.123.111.118]:51934: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)27.123.111.1181269750 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 k luk1  -) ossec13001iExim Auth failed2025-11-18 03:45:07 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:44668: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)34.146.217.1051861060.0  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:45:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387Y/  -C% ossec13001iExim Auth failed2025-11-18 03:44:40 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64139: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758d.  -W% ossec13001iExim Auth failed2025-11-18 03:44:40 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:55655: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)78.81.209.762017370#-  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:43:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001h,  -_% ossec13001iExim Auth failed2025-11-18 03:43:28 dovecot_login authenticator failed for ([220.67.139.254]) [221.145.5.14]:53504: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)221.145.5.141835841-+  e3% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:43:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841g*  -]% ossec13001iExim Auth failed2025-11-18 03:43:54 dovecot_login authenticator failed for ([111.26.62.38]) [111.26.62.39]:33176: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)111.26.62.391814991+)  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:43:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758S(  -5% ossec13001iExim Auth failed2025-11-18 03:43:50 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:49860: 535 Incorrect authentication data (set_id=contato)45.142.132.93175395'  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-&  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:43:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730d%  -Q+ ossec13001iExim Auth failed2025-11-18 03:43:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62225: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651.$  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:43:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991m#  -c+ ossec13001iExim Auth failed2025-11-18 03:44:07 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:39706: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)178.178.194.1352017370 7&; " >NfLaro74@  e?' ossec9710iODovecot Auth failed on disconnected session.Nov 18 03:46:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991?  - ) ossec13001iMExim Auth failed2025-11-18 03:46:36 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:36432: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)177.135.67.1893469034k>  -a) ossec13001iAExim Auth failed2025-11-18 03:46:25 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:4231: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)223.167.203.561814991g=  -Y) ossec13001iExim Auth failed2025-11-18 03:45:48 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:42942: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)112.161.26.1251835841< W' ossec9708i Dovecot Aborted Login with empty userNov 18 03:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d;  -Q+ ossec13001iExim Auth failed2025-11-18 03:45:22 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:35604: 535 Incorrect authentication data (set_id=flavio.oliveira)122.224.154.1661814991l:  -c) ossec13001iExim Auth failed2025-11-18 03:45:11 dovecot_login authenticator failed for ([111.26.106.115]) [111.26.106.115]:37898: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)111.26.106.1151814991S9  -5% ossec13001iExim Auth failed2025-11-18 03:45:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:59920: 535 Incorrect authentication data (set_id=contato)38.226.118.03469034S8  -5% ossec13001i-Exim Auth failed2025-11-18 03:46:05 dovecot_login authenticator failed for ([111.26.63.88]) [111.26.63.89]:32822: 535 Incorrect authentication data (set_id=eliezer)111.26.63.891814991i7  -a% ossec13001iExim Auth failed2025-11-18 03:44:58 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:38404: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)87.31.17.13131753956 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+5  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:44:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.4712697504  -3+ ossec13001iExim Auth failed2025-11-18 03:44:34 dovecot_login authenticator failed for (164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [222.222.124.164]:42737: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)222.222.124.1641814991g3  -[' ossec13001iExim Auth failed2025-11-18 03:44:25 dovecot_login authenticator failed for ([116.233.83.90]) [116.233.83.90]:58552: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)116.233.83.901814991V2  -9' ossec13001iExim Auth failed2025-11-18 03:44:16 dovecot_login authenticator failed for ([218.22.187.69]) [218.22.187.66]:51150: 535 Incorrect authentication data (set_id=contato)218.22.187.661814991 Z L ){a4ZVN  -9' ossec13001imExim Auth failed2025-11-18 03:47:08 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:42790: 535 Incorrect authentication data (set_id=contato)182.95.57.1581269750)M  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:47:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387L W' ossec9708iDovecot Aborted Login with empty userNov 18 03:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(K  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:47:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084lJ  -a+ ossec13001i}Exim Auth failed2025-11-18 03:47:24 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56689: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651+I  e/% ossec9710iuDovecot Auth failed on disconnected session.Nov 18 03:47:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841eH  -W' ossec13001iqExim Auth failed2025-11-18 03:47:13 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:58497: 535 Incorrect authentication data (set_id=atualizacoes)217.29.30.13515277479G  eG) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:47:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697509F  eG) ossec9710igDovecot Auth failed on disconnected session.Nov 18 03:47:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.251814991E  k' ossec9709iIMultiple Dovecot Aborted Logins with empty userNov 18 03:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344D  e?' ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 03:46:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651)C  e%+ ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 03:46:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<4AL/0dhDmpJrhr+5>107.134.191.1856252001B  W' ossec9708igDovecot Aborted Login with empty userNov 18 03:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342A  e7+ ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 03:46:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 .  > ]  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:49:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y\  -}) ossec13001iExim Auth failed2025-11-18 03:49:24 dovecot_login authenticator failed for ([178.178.222.61]) [178.178.222.61]:44802: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)178.178.222.612017370$[  e## ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:49:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483|Z  -' ossec13001iExim Auth failed2025-11-18 03:50:03 dovecot_login authenticator failed for (mail.jimsmithcenters.com) [38.87.177.252]:60270: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)38.87.177.2526252001Y  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lX  -e' ossec13001i Exim Auth failed2025-11-18 03:49:48 dovecot_login authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:39805: 535 Incorrect authentication data (set_id=isabellylisboa)111.70.49.1821668284{W  -+ ossec13001iExim Auth failed2025-11-18 03:50:06 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:57784: 535 Incorrect authentication data (set_id=info@adlondrina.com.br)119.160.166.2371820814+V  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:49:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001IU  -'! ossec13001iExim Auth failed2025-11-18 03:49:24 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:60790: 535 Incorrect authentication data (set_id=info)5.32.107.6290557wT  -w+ ossec13001iExim Auth failed2025-11-18 03:48:51 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:60077: 535 Incorrect authentication data (set_id=info@deproi.com.br)223.197.145.1411819730\S  -C) ossec13001iExim Auth failed2025-11-18 03:48:34 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:41940: 535 Incorrect authentication data (set_id=financeiro)61.150.123.1061814991R W' ossec9708iDovecot Aborted Login with empty userNov 18 03:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*Q  e)) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:48:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044mP  -g' ossec13001iExim Auth failed2025-11-18 03:47:52 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:52313: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)112.27.30.2531814991]O  -G) ossec13001iExim Auth failed2025-11-18 03:47:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:44992: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549 } ~u}'l  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:52:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<7fxt59hDpJ8tPZWl>45.61.149.1656252001kk  -c' ossec13001iExim Auth failed2025-11-18 03:53:06 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:47700: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)121.73.163.192186224Zj  -A' ossec13001i|Exim Auth failed2025-11-18 03:51:38 dovecot_login authenticator failed for ([223.210.0.110]) [111.48.77.157]:15307: 535 Incorrect authentication data (set_id=presidencia)111.48.77.1571814991i W' ossec9708ivDovecot Aborted Login with empty userNov 18 03:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(h  e#+ ossec9710ilDovecot Auth failed on disconnected session.Nov 18 03:51:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<4dIy5NhD0tiElIx5>132.148.140.1216252001_g  -G+ ossec13001idExim Auth failed2025-11-18 03:51:14 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52331: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034mf  S=+ ossec11000iLogin failed on the cpanel service.[2025-11-18 03:51:45 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect124.198.131.1076252001ke  -_+ ossec13001i,Exim Auth failed2025-11-18 03:50:18 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:43735: 535 Incorrect authentication data (set_id=info)203.198.173.14518197303d  e9+ ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 03:50:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<1Xxz4NhDDp9ns7yS>103.179.188.1461562822mc  -g' ossec13001iJExim Auth failed2025-11-18 03:50:49 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:41877: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)216.126.65.716251999ab  -S% ossec13001i>Exim Auth failed2025-11-18 03:50:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:58529: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758a W' ossec9708i:Dovecot Aborted Login with empty userNov 18 03:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k`  -a) ossec13001i0Exim Auth failed2025-11-18 03:50:23 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:62451: 535 Incorrect authentication data (set_id=adriana)116.48.149.12318197308_  eG' ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 03:50:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822,^  e/' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 03:49:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867 M m E n U2F2AYyGMv{  -y' ossec13001iExim Auth failed2025-11-18 03:53:21 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:56448: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)125.20.251.661269750.z  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:53:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750\y  -I% ossec13001iExim Auth failed2025-11-18 03:53:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63545: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758dx  -S+ ossec13001iExim Auth failed2025-11-18 03:53:38 dovecot_login authenticator failed for (ADMIN) [217.199.146.204]:56863: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)217.199.146.204192950mw  -g' ossec13001iExim Auth failed2025-11-18 03:53:35 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:38590: 535 Incorrect authentication data (set_id=paulinho.vendas)201.173.97.343996063]v  -E) ossec13001iExim Auth failed2025-11-18 03:53:03 dovecot_login authenticator failed for (User) [177.74.174.120]:59609: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)177.74.174.1203469034/u  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:52:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730ht  -]' ossec13001iExim Auth failed2025-11-18 03:52:44 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:53790: 535 Incorrect authentication data (set_id=info@calcautomacao.com.br)92.100.39.1802017370s  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Sq  -3' ossec13001iExim Auth failed2025-11-18 03:52:59 dovecot_login authenticator failed for ([211.253.10.61]) [211.253.10.61]:55537: 535 Incorrect authentication data (set_id=info)211.253.10.611835841$p  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:52:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841&o  e!+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:52:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758-n e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<7hPK6NhDdsYrmxBp>43.155.16.10518197304m  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:52:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9UVb6NhDSpFn9M4G>103.244.206.61643084  /,  e3# ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 03:54:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730 W' ossec9708i*Dovecot Aborted Login with empty userNov 18 03:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3NGl79hD9KexV3kv>177.87.121.473469034*  e/# ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 03:54:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001.  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:54:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001b  -Q' ossec13001iFExim Auth failed2025-11-18 03:55:01 dovecot_login authenticator failed for (cm-46.212.101.69.get.no) [46.212.101.69]:59311: 535 Incorrect authentication data (set_id=alex.vendas)46.212.101.693144096j  -]+ ossec13001i*Exim Auth failed2025-11-18 03:54:32 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:52794: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)103.146.233.2001269750r  -o) ossec13001i Exim Auth failed2025-11-18 03:54:22 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:43428: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)125.20.245.1821269750   -!) ossec13001iExim Auth failed2025-11-18 03:53:20 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:56750: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)178.140.212.922017370^ -E) ossec13001iExim Auth failed2025-11-18 03:53:09 dovecot_login authenticator failed for (User) [177.74.174.120]:59609: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)177.74.174.1203469034a  -M) ossec13001iExim Auth failed2025-11-18 03:53:33 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:40938: 535 Incorrect authentication data (set_id=administrativo1)121.134.31.1931835841_  -K' ossec13001iExim Auth failed2025-11-18 03:53:24 dovecot_login authenticator failed for 110-25-93-213.adsl.fetnet.net [110.25.93.213]:53134: 535 Incorrect authentication data (set_id=info)110.25.93.2131668284 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/~  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:53:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841Q}  -/' ossec13001iExim Auth failed2025-11-18 03:54:04 dovecot_login authenticator failed for p83212-obmd01.osaka.ocn.ne.jp [180.7.154.211]:37744: 535 Incorrect authentication data180.7.154.2111861060(|  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:53:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822 e4XK>1$ { n a T G : -   w j ] P C 6 )    s4~qdJ=0#  f Y L ? 2 %  W { o c W K ? 3 '     s g [ O C 7 +   wk_SG;/# {obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA210410 2750405. 2921044 2921044/ 2921044' 2921044 2921044 2921044 2921044 2921044 2921044 2921044w 2921044o 2921044L 2921044 2921044 2921044 2921044 2921044< 2921044" 2921044 2921044 2921044 2921044 2921044 2921044 2921044} 2921044| 2921044u 2921044i 2921044b 2921044U 2921044K 2921044@ 2921044; 2921044+ 2921044 2921044o 2921044> 2921044! 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044i 2921044' 2921044 2921044 2921044 2921044Z 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044~ 2921044{ 2921044W 2921044 2921044 2921044 2921044 2921044 ^ 2921044 ' 2921044 } 2921044 M 2921044 2921044 ^ 2921044 2921044 O 2921044 Z 2921044  2921044p 2921044h 2921044% 2921044 2921044n 2921044& 2921044o 2921044. 2921044 2921044U 2921044" 2921044n 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044u 2921044h 2921044[ 2921044D 2921044= 29210440 2921044% 2921044 290557-U 290557, 290557+ 290557* 290557(F 290557'S 290557&4 290557$$ 290557# 290557#` 290557#Q 290557# 290557" 290557" 290557! 290557 290557 290557 290557 290557 290557U 290557 290557 290557U 2905577 290557 290557 290557 290557s 290557 290557 290557 290557 290557 290557X 290557> 290557 290557 290557C 290557B 290557 290557S 290557) 290557a 290557 290557 290557  290557 j 290557 E 290557  290557 290557 290557 7 290557 ] 290557 290557; 290557c 290557 290557 289688( 289688& 289688 289688 289688 289688 289688O 285570,k 285570\ 285570L 2802361, 2802361* 2802361* 2802361) 2802361)z 2802361 2802361 2802361 2750405. 2750405. 2750405.x 2750405- 2750405- 2750405) 2750405) 2750405) 2750405) 2750405( 2750405( 2750405(P 2750405(' 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405( 2750405' 2750405' 2750405' 2750405' 2750405' 2750405' 2750405' 2750405% 2750405%X 2750405# 2750405! 2750405 2750405 2750405 2750405x 2750405+ 2750405$ 2750405 2750405O 2750405 2750405 2750405: 2750405 2750405j 2750405Y 2750405; 27504054 2750405+ 2750405( 2750405 2750405 " 2750405/ 2750405/V 2921044 2921044 2921044 2921044f 2921044c 2921044B 2921044/ 2921044 2750405/ 2750405. 2750405. 2750405. 2750405. 2750405. 2802361. 2750405. 2750405. 2750405. 2750405. 2750405. 2750405. 2750405. 2750405. 2750405. 2750405. 2802361. 2750405. V 0 S +  yPg4VZ  -A' ossec13001iExim Auth failed2025-11-18 03:56:53 dovecot_login authenticator failed for ([189.80.204.17]) [189.80.146.46]:39935: 535 Incorrect authentication data (set_id=aureovieira)189.80.146.463469034/  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:56:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001e  -W' ossec13001iExim Auth failed2025-11-18 03:56:35 dovecot_login authenticator failed for ([111.53.121.99]) [111.53.121.99]:52252: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)111.53.121.991814991%  e%# ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 03:55:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<+QGV9NhDmtxCYSpH>66.97.42.7138654833  e;) ossec9710ipDovecot Auth failed on disconnected session.Nov 18 03:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044'  e%' ossec9710ihDovecot Auth failed on disconnected session.Nov 18 03:55:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<+EhI89hDGsov+yzS>47.251.44.2106252001  k' ossec9709ifMultiple Dovecot Aborted Logins with empty userNov 18 03:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  W' ossec9708iDovecot Aborted Login with empty userNov 18 03:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -_% ossec13001iExim Auth failed2025-11-18 03:56:02 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:53720: 535 Incorrect authentication data (set_id=vinicius.costa@deproi.com.br)183.99.89.741835841$  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758$  e!% ossec9710inDovecot Auth failed on disconnected session.Nov 18 03:55:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370Y  -=) ossec13001iFExim Auth failed2025-11-18 03:55:02 dovecot_login authenticator failed for ([197.255.134.56]) [197.255.134.56]:46401: 535 Incorrect authentication data (set_id=contato)197.255.134.563374766W  -?' ossec13001i:Exim Auth failed2025-11-18 03:54:49 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:32847: 535 Incorrect authentication data (set_id=financeiro)65.20.136.18399237q  -m) ossec13001i8Exim Auth failed2025-11-18 03:54:47 dovecot_login authenticator failed for ([113.137.31.134]) [113.137.31.134]:52593: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)113.137.31.1341814991  $ xR'  -3% ossec13001i:Exim Auth failed2025-11-18 03:59:06 dovecot_login authenticator failed for ([27.45.232.11]) [27.45.232.11]:43067: 535 Incorrect authentication data (set_id=xavier)27.45.232.111814991j&  -a' ossec13001iExim Auth failed2025-11-18 03:58:15 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:57372: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)125.19.188.981269750X%  -A# ossec13001iExim Auth failed2025-11-18 03:58:12 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:59312: 535 Incorrect authentication data (set_id=flavio.oliveira)46.8.245.342017370u$  -s+ ossec13001i(Exim Auth failed2025-11-18 03:58:47 dovecot_login authenticator failed for ([218.75.123.109]) [183.247.171.186]:36675: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)183.247.171.1861814991,#  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:57:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<15BP+dhDmOF2wSaf>118.193.38.1591819730."  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:57:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841~!  -) ossec13001iExim Auth failed2025-11-18 03:58:00 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:63824: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)116.48.151.2491819730*  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:57:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034S  -5% ossec13001iExim Auth failed2025-11-18 03:56:32 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contato)152.52.93.841269750`  -K) ossec13001iExim Auth failed2025-11-18 03:56:11 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:54510: 535 Incorrect authentication data (set_id=vinicius.costa)220.80.223.1441835841 W' ossec9708iDovecot Aborted Login with empty userNov 18 03:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b -S% ossec13001iExim Auth failed2025-11-18 03:56:25 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59615: 535 Incorrect authentication data (set_id=postamster@maringasoldas.com.br)62.60.131.40130758g  -Y) ossec13001iExim Auth failed2025-11-18 03:56:17 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:58192: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)188.170.40.23120173702  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 03:57:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758     ^6 -E) ossec13001iFExim Auth failed2025-11-18 03:59:18 dovecot_login authenticator failed for (User) [177.74.174.120]:62159: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)177.74.174.1203469034(5  e%) ossec9710ilDovecot Auth failed on disconnected session.Nov 18 03:59:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456*4  e-% ossec9710iJDovecot Auth failed on disconnected session.Nov 18 03:59:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358413  - ' ossec13001iDExim Auth failed2025-11-18 03:59:15 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:49798: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)177.174.15.693469034^2  -E+ ossec13001iBExim Auth failed2025-11-18 03:59:14 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51630: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.14134690341  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 03:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^0 -C+ ossec13001iExim Auth failed2025-11-18 03:58:21 dovecot_login authenticator failed for (brilhometal.com.br) [111.122.211.212]:27932: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991i/  -_' ossec13001i:Exim Auth failed2025-11-18 03:59:06 dovecot_login authenticator failed for ([111.50.73.130]) [111.50.73.130]:60052: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)111.50.73.1301814991\.  -C) ossec13001i8Exim Auth failed2025-11-18 03:59:03 dovecot_login authenticator failed for ([201.173.250.31]) [201.173.250.31]:34491: 535 Incorrect authentication data (set_id=assessoria)201.173.250.313996063(-  e#+ ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 03:58:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001,  e# ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 03:58:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750x+  -}' ossec13001iExim Auth failed2025-11-18 03:58:36 dovecot_login authenticator failed for 111-70-33-227.emome-ip.hinet.net [111.70.33.227]:55078: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)111.70.33.2271668284*  W' ossec9708i6Dovecot Aborted Login with empty userNov 18 03:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p)  -m' ossec13001iExim Auth failed2025-11-18 03:58:10 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:55574: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)125.20.253.861269750o(  -i) ossec13001i&Exim Auth failed2025-11-18 03:58:46 dovecot_login authenticator failed for ([211.141.56.184]) [211.141.56.185]:40686: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)211.141.56.1851814991 +&A ' K 1  jw^+/E  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044D  W' ossec9708iDovecot Aborted Login with empty userNov 18 04:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6rNyCtlDrtqxV3kv>177.87.121.473469034oC  -i) ossec13001iExim Auth failed2025-11-18 04:01:49 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:36886: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)113.219.177.951814991)B  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<8AqVCNlDkg2vfiX3>175.126.37.2471835841/A  e3) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:00:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730$@  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:00:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387k?  -a) ossec13001iExim Auth failed2025-11-18 04:00:17 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:33602: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)218.22.237.10818149911>  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758h=  -]' ossec13001iExim Auth failed2025-11-18 04:00:45 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:42413: 535 Incorrect authentication data (set_id=cpanel)220.246.40.631819730+<  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:00:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001; W' ossec9708iDovecot Aborted Login with empty userNov 18 04:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X:  -A# ossec13001i^Exim Auth failed2025-11-18 03:59:41 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:56876: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.7062519999 W' ossec9708iVDovecot Aborted Login with empty userNov 18 03:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a8  -Q% ossec13001iRExim Auth failed2025-11-18 03:59:30 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:35240: 535 Incorrect authentication data (set_id=faturamento)103.90.27.831643084V7  -9' ossec13001iHExim Auth failed2025-11-18 03:59:19 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:34336: 535 Incorrect authentication data (set_id=compras)182.95.115.701269750 z*4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p > 4 * f \ R H    vl&bXND:0|J,r@"h^T6xZPFnd2( <~j`VLB8t.$z\R4H>pf | r h ^ T J @ 6 , "    x n d Z Pz*  vlbXND:0& i@ iA i> i= i< iC iB i9 i8 i7 i6 i5 i4 i3 i2 i1 i0 i/ i. i- i, i+ ia* iU) i( io' i5& i%% i$ i# i" i ! iG i i i i i i i i i i i i i i i i i i i i iy iq im i i i5 i# iS iO iK iG i i i i i i i i i i i iw im i io ik i i i io ik i i i i{ im i i i iX iH i- i[ iR iP iH iF i0 ic iT iP i@ i6 i4 i/ i i+ i i i  i i i i i i i i i i i i i i i i i i i i il i^ iV iR iJ iH iF iD iB i: i: i8 i6 i, i* i( i& i i i i i i i i i i i i i i i i i i i i i i i igF igB i]A iO@ iM? iIE iA> i;D ihm ihi ifh iJd iBc i4b i#^ ia i` i_ i] i\ i[ iZ iX iW iV iY iP iO iU iT iS iwR iwQ ioI imN iaH i_M i]L iQK iOJ i=G i;F i+E iD i; i: i? i~ ip in ih if iF iF i: i8 i2 i* i* i& i  i i} i| ix iw i i i i~ i{ i iz iy i ik iv ir iq iu it ip io in is im il if i|j( ivn ivi ilh idg iJc i>b i:a i0` i._ i,e i,d iW iZ iY i X i ^ i] iV i\ iU i[ iT iS iR iQ iP iG iM iO iL iK i}J iuI iqH imN  U #gg:eS  -W' ossec13001iExim Auth failed2025-11-18 04:02:14 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:37252: 535 Incorrect authentication data (set_id=xavier)188.122.151.62661886 R  3G' ossec11301i+New FTP connection.Nov 18 04:03:05 hosting pure-ftpd: (?@47.76.240.198) [INFO] New connection from 47.76.240.19847.76.240.1981819730)Q  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:02:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991|P  -) ossec13001iExim Auth failed2025-11-18 04:02:43 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:45152: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)201.173.250.313996063O W' ossec9708i Dovecot Aborted Login with empty userNov 18 04:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345N  e?) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:02:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.20222333872M  e7+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:02:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001/L e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:02:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001.K  e3' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822-J  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730I  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 04:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343H  e=' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001,G  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:01:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750lF  -e' ossec13001iExim Auth failed2025-11-18 04:02:05 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:54667: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)103.174.34.491269750 4L )  . =~Qh]4Oe  S! ossec11321iActive Response. FTP brute force attack (Port 21 is protected)Nov 18 04:04:32 hosting pure-ftpd: (?@2.58.84.67) [WARNING] Authentication failed for user [1075fm]2.58.84.672921044d  S! ossec211321iPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 2.58.84.672.58.84.672921044:c  gG' ossec11307iXMultiple connection attempts from same sourceNov 18 04:03:51 hosting pure-ftpd: (?@47.76.240.198) [INFO] New connection from 47.76.240.19847.76.240.1981819730$b  e## ossec9710iHDovecot Auth failed on disconnected session.Nov 18 04:03:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750_a  -G+ ossec13001i-Exim Auth failed2025-11-18 04:03:08 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51426: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034+` AS! ossec11302i[FTP Authentication failed.Nov 18 04:03:53 hosting pure-ftpd: (?@2.58.84.67) [WARNING] Authentication failed for user [1075fm]2.58.84.672921044_ 3;! ossec11301iRNew FTP connection.Nov 18 04:03:46 hosting pure-ftpd: (?@2.58.84.67) [INFO] New connection from 2.58.84.672.58.84.672921044^  S' ossec211321iPPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 47.76.240.19847.76.240.1981819730)] e+% ossec9710iHDovecot Auth failed on disconnected session.Nov 18 04:03:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103\ W' ossec9708iFDovecot Aborted Login with empty userNov 18 04:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+9bXD9lD9IuxV3kv>177.87.121.473469034![ 3G' ossec11301i0New FTP connection.Nov 18 04:03:11 hosting pure-ftpd: (?@47.76.240.198) [INFO] New connection from 47.76.240.19847.76.240.19818197303Z  IW' ossec11331ic Stealth FTP brute force attackNov 18 04:04:02 hosting pure-ftpd: (?@47.76.240.198) [WARNING] Authentication failed for user [iemif]47.76.240.19818197306Y  eA) ossec9710iTDovecot Auth failed on disconnected session.Nov 18 04:03:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=173.25.186.130, lip=200.150.196.245, TLS, session=<3V+kD9lDBOytGbqC>173.25.186.1306252001TX  W' ossec11321iPActive Response. FTP brute force attack (Port 21 is protected)Nov 18 04:03:43 hosting pure-ftpd: (?@47.76.240.198) [WARNING] Authentication failed for user [iemif]47.76.240.1981819730W W+ ossec9708i@Dovecot Aborted Login with empty userNov 18 04:03:28 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034oV  -k' ossec13001i6Exim Auth failed2025-11-18 04:03:17 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:60425: 535 Incorrect authentication data (set_id=contato)71.191.70.1266252001,U  e-) ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 04:03:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.5562520010T AW' ossec11302i/FTP Authentication failed.Nov 18 04:03:10 hosting pure-ftpd: (?@47.76.240.198) [WARNING] Authentication failed for user [iemif]47.76.240.1981819730 n | Y  f(eGWneu  -[# ossec13001iwExim Auth failed2025-11-18 04:04:21 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:39782: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)182.78.87.21269750:t  eG+ ossec9710imDovecot Auth failed on disconnected session.Nov 18 04:04:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001.s  IS! ossec11331i Stealth FTP brute force attackNov 18 04:04:47 hosting pure-ftpd: (?@2.58.84.67) [WARNING] Authentication failed for user [1075fm]2.58.84.672921044r  e ' ossec9710ioDovecot Auth failed on disconnected session.Nov 18 04:04:13 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.103.53.44, lip=200.150.196.245, session=103.103.53.441269750+q AS! ossec11302ikFTP Authentication failed.Nov 18 04:04:10 hosting pure-ftpd: (?@2.58.84.67) [WARNING] Authentication failed for user [1075fm]2.58.84.672921044`p  -O% ossec13001iExim Auth failed2025-11-18 04:04:47 dovecot_login authenticator failed for (l5-128-93-196.novotelecom.ru) [5.128.93.196]:38996: 535 Incorrect authentication data (set_id=envios)5.128.93.1962017370,o  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:04:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.20729210441n  g;! ossec11307iMultiple connection attempts from same sourceNov 18 04:04:32 hosting pure-ftpd: (?@2.58.84.67) [INFO] New connection from 2.58.84.672.58.84.672921044im  -]) ossec13001ioExim Auth failed2025-11-18 04:04:13 dovecot_login authenticator failed for ([58.221.208.214]) [58.221.208.214]:46708: 535 Incorrect authentication data (set_id=envios@comercial.art.br)58.221.208.2141814991l 3;! ossec11301ikNew FTP connection.Nov 18 04:04:10 hosting pure-ftpd: (?@2.58.84.67) [INFO] New connection from 2.58.84.672.58.84.672921044k  W' ossec9708iDovecot Aborted Login with empty userNov 18 04:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vj  -9' ossec13001iExim Auth failed2025-11-18 04:04:44 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:46556: 535 Incorrect authentication data (set_id=contato)121.73.163.612186224i  e' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:04:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=213.167.45.70, lip=200.150.196.245, TLS, session=213.167.45.7020173706h  e?+ ossec9710i{Dovecot Auth failed on disconnected session.Nov 18 04:04:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822#g  e) ossec9710imDovecot Auth failed on disconnected session.Nov 18 04:04:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<4b//EdlDiM+YNbyQ>152.53.188.1442921044f  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 04:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0  3469034(6 3469034(0 3469034(* 3469034(% 3469034(! 3469034( 3469034( 3469034( 3469034( 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034'| 3469034'y 3469034'w 3469034'r 3469034'q 3469034'n 3469034'c 3469034'_ 3469034'[ 3469034'Z 3469034'X 3469034'O 3469034'J 3469034'8 3469034'1 3469034'- 3469034'$ 3469034' 3469034' 3469034' 3469034' 3469034' 3469034' 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034&q 3469034&h 3469034&d 3469034&` 3469034&W 3469034&Q 3469034&K 3469034&J 3469034&H 3469034&= 3469034&; 3469034&: 3469034&5 3469034&2 3469034&* 3469034&# 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034%w 3469034%q 3469034%m 3469034%h 3469034%e 3469034%b 3469034%` 3469034%] 3469034%U 3469034%S 3469034%M 3469034%J 3469034%H 3469034%F 3469034%> 3469034%7 3469034%, 3469034%+ 3469034%' 3469034% 3469034% 3469034% 3469034% 3469034% 3469034% 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034${ 3469034$t 3469034$o 3469034$g 3469034$b 3469034$] 3469034$U 3469034$N 3469034$F 3469034$D 3469034$= 3469034$8 3469034$1 3469034$. 3469034$& 3469034$ 3469034$ 3469034$ 3469034$ 3469034$ 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034# 3469034#{ 3469034#y 3469034#r 3469034#l 3469034#f 3469034#d 3469034#b  0    W' ossec9708iSDovecot Aborted Login with empty userNov 18 04:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u  -u) ossec13001iOExim Auth failed2025-11-18 04:07:58 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:37544: 535 Incorrect authentication data (set_id=rsimoesdiretoria)123.193.152.641668284a  -O' ossec13001iKExim Auth failed2025-11-18 04:07:54 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49906: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.721819730  - ' ossec13001iGExim Auth failed2025-11-18 04:07:49 dovecot_login authenticator failed for 111-70-25-161.emome-ip.hinet.net [111.70.25.161]:41678: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)111.70.25.1611668284p  -o% ossec13001iExim Auth failed2025-11-18 04:06:57 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:41971: 535 Incorrect authentication data (set_id=marcelo.pinheiro)74.62.20.1706252001&  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:06:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730~ W' ossec9708iDovecot Aborted Login with empty userNov 18 04:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j} S;% ossec11000iLogin failed on the cpanel service.[2025-11-18 04:06:27 -0300] info [cpaneld] 103.82.65.48 - 1075fm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified103.82.65.482077456|  -' ossec13001iExim Auth failed2025-11-18 04:06:25 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:37466: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)179.189.85.663469034f{  -U+ ossec13001iExim Auth failed2025-11-18 04:06:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51548: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034-z  e3% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:06:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001y 3C% ossec11301iNew FTP connection.Nov 18 04:05:29 hosting pure-ftpd: (?@20.163.15.93) [INFO] New connection from 20.163.15.9320.163.15.936252001&x  e'# ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:05:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<2g2bFtlDQpUrZDwA>43.100.60.01819730fw  -U+ ossec13001iExim Auth failed2025-11-18 04:05:20 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51965: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034v W' ossec9708iDovecot Aborted Login with empty userNov 18 04:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  X/& Gp&  3O+ ossec11301iNew FTP connection.Nov 18 04:10:24 hosting pure-ftpd: (?@185.247.137.214) [INFO] New connection from 185.247.137.214185.247.137.2142635167[  -A) ossec13001iExim Auth failed2025-11-18 04:10:02 dovecot_login authenticator failed for ([183.220.243.62]) [183.220.243.62]:55614: 535 Incorrect authentication data (set_id=comercial)183.220.243.621814991S  -7% ossec13001iExim Auth failed2025-11-18 04:09:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:49786: 535 Incorrect authentication data (set_id=info@conut.org.br)62.60.131.17130758Q  -3% ossec13001iExim Auth failed2025-11-18 04:09:37 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:60494: 535 Incorrect authentication data (set_id=envios)195.43.5.222357994l  -c) ossec13001iExim Auth failed2025-11-18 04:09:34 dovecot_login authenticator failed for ([58.121.175.167]) [58.121.175.167]:50330: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)58.121.175.1671835841 W' ossec9708iDovecot Aborted Login with empty userNov 18 04:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -+ ossec13001iExim Auth failed2025-11-18 04:09:16 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:53970: 535 Incorrect authentication data (set_id=envios@comercial.art.br)201.183.225.1563658394%  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:10:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.22818610607  eE' ossec9710iyDovecot Auth failed on disconnected session.Nov 18 04:08:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<9cvwIdlDGt+WXx+e>150.95.31.1581605651 W' ossec9708iqDovecot Aborted Login with empty userNov 18 04:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  -u+ ossec13001imExim Auth failed2025-11-18 04:08:29 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51436: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)181.191.136.1413469034Y  -C% ossec13001iExim Auth failed2025-11-18 04:08:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56604: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758(  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:08:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<8OR4ItlD4M+KxX03>138.197.125.556252001  k' ossec9709i5Multiple Dovecot Aborted Logins with empty userNov 18 04:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3AshHtlD3N2xV3kv>177.87.121.473469034)  e)' ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:07:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001 ~ k 2  ~0!  e3+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:11:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001/  e5' ossec9710iGDovecot Auth failed on disconnected session.Nov 18 04:12:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001%  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:10:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841  - ) ossec13001iExim Auth failed2025-11-18 04:10:56 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:37678: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)94.124.225.1592017370Y  -A' ossec13001iExim Auth failed2025-11-18 04:10:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:27513: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758p  -o% ossec13001iExim Auth failed2025-11-18 04:10:53 dovecot_login authenticator failed for (210.241.51.119.adsl-pool.jlccptt.net.cn) [58.244.98.11]:58062: 535 Incorrect authentication data (set_id=aureovieira)58.244.98.111814991'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:10:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<12iOKdlDAJs7GIXF>59.24.133.1971835841p  -k) ossec13001iExim Auth failed2025-11-18 04:10:37 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:45821: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)46.212.117.1313144096-  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:10:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697505  eC% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:10:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382  W' ossec9708iDovecot Aborted Login with empty userNov 18 04:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 04:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:11:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001%  e%# ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:10:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001}wqke_YSMGA;5/)# {uoic]WQKE?93-'!   y s m g a [ U O I C = 7 1 + %      } w q k e _ Y S M G A ; 5 / ) #     { u o i c ] W Q K E ? 9 3 - ' !      y s m g a [ U O I C = 7 1 + %      } w q k e _ Y S M G A ; 5 / ) #    {uoic]WQKE?93-'! ysmga[UOIC=71+% }wqke_YSMGA;5/)# {uoic]WQKE?93-'! ysmga[UOIC=71+% ǭ1ƭ#ŭĭ¬xj]M?1"tdUF9) ~paRD6( zk]N@2"vgXI:+ ~pbSD6( {l^OA2#x~h}X|Jz=y/x!wvuwthsXqHp8o)ml k}jni_hPgAf2e$dcbwah`Y_K^=]/\"[ZYxWiV[UMT=S.R QONqMcLTKFJ8I)HG F~DpCbBS@D?5>'=< ;|:m9^8O7@615#432w1h0Z/K.<-,,*)(q'b&S%D$5#&" yjZK<-paQC3$   u f VG7&xj[L=.oaRC4%xiZK;, ~n_PB4$ߕޕݔvܔg۔XڔIٔ;ؔ+ה֔ ԓ}ғnѓ_ГNϓ?Γ/͓ ̓˓ʒrɒcȒTǒEƒ5Œ&ĒÒvhZL=.sdVG7' yj[L=/ rdUF6'yj[L=/ rbSD5%whYK<-q~a}R|Cy4x%wvuwthsXrIq9p)on m|llk\jMh=g.fdcboa^`M_=^.]\[~ZoY_WOV?U/T SRQsPdORMCL3K#JIHsGcFSECC4B%A@?u>e=U 8 2 , &      ~ x r l f ` Z T N H B < 6 0 * $     | v p j d ^ X R L F @ : 4 . ( "    ztnhb\VPJD>82,& ~xrlf`ZTNHB<60*$ |vpjd^XRLF@:4.(" ztnhb\VPJD>82,& ~xrlf`ZTNHB<60*$ |vpjd^XRLF@:4.(" c*ba `}_m^^]N[?Z0Y!XWVtUdTUSER3Q%PONxMhLYKIJ;I,FE ussrcqTpCo3m$lkjvighXfIe9c*ba `}_m^^]N[?Z0Y!XWVtUdTUSER3Q%PONxMhLYKIJ;I,FE D~CoB`@Q?B>3=$<;:x9j7Z6K5<4.321/r.d-U,G+7*()( '{&m%^$N"?!0 "whYJ;, }m^PB4%   x i [K;+ |m^O?0!tfWH9*qbQB4& zk\M?0"ufWH:+ ~o`QB3$vgYK=/ seVF6( |m_PA2#wgYK<,rdUF7'yj[L=.sdUF7) yj[L>0~!|{zqyaxRwDv5u&tsryqjp[oMn?m0l!kjhsgefUeFd6c'ba `{_l^]]N\?[0X!WVTuSeRSPEO6N'MK J{IlH]GNF@E1D"CBAu@f>W=H;::+87 65q4`3Q2C140%/.-w,h+Y*I);(-'&%#s"c!U G8* }n_QC4$xi[L = .   vhYJ<-qcTF7) }n_P@1#zl^PA2#v߯hޯZܯJۯ<گ-ٯدׯ֮sծdԮVӮHҮ:Ѯ,ЮϮ ͭ~̭n˭^ʭO=.rbRB3$ueUE5&whXG7( zj[K;+~ }||l{]zOy@x1w!v   *0  e+' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991 /  -' ossec13001iExim Auth failed2025-11-18 04:13:59 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br ([179.184.33.97]) [179.184.33.86]:49006: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)179.184.33.863469034Y.  -=) ossec13001iExim Auth failed2025-11-18 04:13:39 dovecot_login authenticator failed for ([122.176.21.104]) [122.176.21.104]:56661: 535 Incorrect authentication data (set_id=eduardo)122.176.21.1041269750-  - ' ossec13001iExim Auth failed2025-11-18 04:13:32 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:51110: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)77.37.162.1172017370Z,  -A' ossec13001iExim Auth failed2025-11-18 04:13:21 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:41408: 535 Incorrect authentication data (set_id=aureovieira)177.239.160.33996063h+  -a# ossec13001iExim Auth failed2025-11-18 04:13:18 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:39428: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)59.7.79.1461835841* W' ossec9708iaDovecot Aborted Login with empty userNov 18 04:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,)  e++ ossec9710iUDovecot Auth failed on disconnected session.Nov 18 04:12:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841Y(  -=) ossec13001iExim Auth failed2025-11-18 04:13:06 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:37174: 535 Incorrect authentication data (set_id=contato)175.205.191.271835841'  - ' ossec13001ioExim Auth failed2025-11-18 04:12:46 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:53075: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)202.156.16.911880251i&  -_' ossec13001i5Exim Auth failed2025-11-18 04:11:48 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:36860: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)60.166.31.1981814991% W' ossec9708i%Dovecot Aborted Login with empty userNov 18 04:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p$  -i+ ossec13001iExim Auth failed2025-11-18 04:11:27 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:49238: 535 Incorrect authentication data (set_id=contato)188.219.104.2103175395n#  -g) ossec13001iExim Auth failed2025-11-18 04:11:15 dovecot_login authenticator failed for ([183.104.220.84]) [183.104.220.84]:34762: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)183.104.220.841835841-"  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:11:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822   +- 3?  e=' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:14:41 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=220.130.18.21, lip=200.150.196.245, TLS, session=220.130.18.2116682845>  e?) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:14:21 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=57.132.150.162, lip=200.150.196.245, TLS, session=57.132.150.1626252001q=  -o' ossec13001iExim Auth failed2025-11-18 04:14:09 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:54603: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)202.156.16.911880251z<  -}+ ossec13001iExim Auth failed2025-11-18 04:14:08 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:42564: 535 Incorrect authentication data (set_id=desenvolvimento2)128.185.201.1701269750Y;  -A' ossec13001iExim Auth failed2025-11-18 04:14:55 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:43926: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758#:  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:14:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.187.229.194, lip=200.150.196.245, TLS, session=122.187.229.19412697509  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 04:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6eaXM9lDAICxV3kv>177.87.121.473469034z8  -) ossec13001iExim Auth failed2025-11-18 04:14:03 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:39039: 535 Incorrect authentication data (set_id=bqtz@iemif.com)177.22.122.1543469034m7  -i' ossec13001iExim Auth failed2025-11-18 04:13:47 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3683: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)213.55.85.202337996Y6  -A' ossec13001iExim Auth failed2025-11-18 04:13:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:51082: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758h5  -[) ossec13001iExim Auth failed2025-11-18 04:13:09 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:36657: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)86.102.254.1982017370a4  -M) ossec13001iExim Auth failed2025-11-18 04:14:06 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:44551: 535 Incorrect authentication data (set_id=info)196.47.172.25322877813  W' ossec9708iDovecot Aborted Login with empty userNov 18 04:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903412  e5+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:13:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822d1  -W% ossec13001iExim Auth failed2025-11-18 04:13:24 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:58548: 535 Incorrect authentication data (set_id=info@sulindustrial.com)61.72.59.1061835841 - I a G - 8 )JaH`=V#-rN  -o+ ossec13001imExim Auth failed2025-11-18 04:17:01 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:45660: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)151.237.115.206732800/M  e7% ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 04:16:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=71.62.34.216, lip=200.150.196.245, TLS, session=71.62.34.2166252001cL  ;E' ossec13008i]Mail Recipient rejected2025-11-18 04:16:44 H=(localhost) [179.0.178.104]:52565 F= rejected RCPT : Unrouteable address179.0.178.1043469034K  k' ossec9709iQMultiple Dovecot Aborted Logins with empty userNov 18 04:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dJ  -S) ossec13001iOExim Auth failed2025-11-18 04:16:31 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:49082: 535 Incorrect authentication data (set_id=andressa.financeiro)125.19.194.1661269750I  W' ossec9708ioDovecot Aborted Login with empty userNov 18 04:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1/4SQNlDwsyxV3kv>177.87.121.473469034eH  -S+ ossec13001iaExim Auth failed2025-11-18 04:16:49 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62024: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651[G  -A) ossec13001i=Exim Auth failed2025-11-18 04:16:12 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:45902: 535 Incorrect authentication data (set_id=sec.geral)49.206.201.2531269750 F  -!) ossec13001i;Exim Auth failed2025-11-18 04:16:11 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:60798: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)200.141.211.583469034qE  -k+ ossec13001i+Exim Auth failed2025-11-18 04:15:54 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:47864: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)111.170.146.1771814991D W' ossec9708iDovecot Aborted Login with empty userNov 18 04:15:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034C W' ossec9708iDovecot Aborted Login with empty userNov 18 04:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0WkrN9lDgpaxV3kv>177.87.121.473469034dB  -Y# ossec13001iExim Auth failed2025-11-18 04:14:31 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:52906: 535 Incorrect authentication data (set_id=bqtz)47.24.76.306252001SA  -7# ossec13001iExim Auth failed2025-11-18 04:14:28 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:52331: 535 Incorrect authentication data (set_id=marialuiza)218.76.73.41814991\@  -A+ ossec13001iExim Auth failed2025-11-18 04:14:20 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:45984: 535 Incorrect authentication data (set_id=compras)119.160.166.2371820814  +]  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:18:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991[\  -A+ ossec13001iExim Auth failed2025-11-18 04:18:43 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12028: 535 Incorrect authentication data (set_id=compras)195.142.106.177298795)[  e-# ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:18:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001Z W' ossec9708iDovecot Aborted Login with empty userNov 18 04:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nY  -e+ ossec13001iExim Auth failed2025-11-18 04:18:17 dovecot_plain authenticator failed for (w3e1qpmamxyyvjt6) [116.104.232.202]:59897: 535 Incorrect authentication data (set_id=marcos@louvoreterno.com.br)116.104.232.2021562822YX  -A' ossec13001iExim Auth failed2025-11-18 04:18:32 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:36713: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758pW  -k) ossec13001iExim Auth failed2025-11-18 04:18:19 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:56580: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)128.185.218.181269750V  Ss) ossec11000iLogin failed on the cpanel service.[2025-11-18 04:18:19 -0300] info [cpaneld] 196.251.100.18 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password196.251.100.18241170U W' ossec9708iDovecot Aborted Login with empty userNov 18 04:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YT  -A' ossec13001iExim Auth failed2025-11-18 04:17:29 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:62011: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758(S  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:17:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<4mxLQdlDhJd9gnHM>125.130.113.2041835841ZR  -?) ossec13001iwExim Auth failed2025-11-18 04:17:10 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:36074: 535 Incorrect authentication data (set_id=anderson)101.251.197.461814991!Q  e+ ossec9710iwDovecot Auth failed on disconnected session.Nov 18 04:17:11 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.187.229.194, lip=200.150.196.245, TLS, session=122.187.229.1941269750\P  -I% ossec13001iExim Auth failed2025-11-18 04:18:07 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49920: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758-O  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:17:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<5AX5QdlDmEuvfiX3>175.126.37.2471835841 B t kt}Oa?Byl  -}) ossec13001iExim Auth failed2025-11-18 04:22:07 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:44064: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)24.105.160.1006252001k  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:21:56 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=200.106.49.149, lip=200.150.196.245, TLS, session=200.106.49.1493932488jj  -_+ ossec13001iExim Auth failed2025-11-18 04:21:40 dovecot_login authenticator failed for ([185.205.184.169]) [185.205.184.169]:50298: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)185.205.184.169146669*i  e+' ossec9710ihDovecot Auth failed on disconnected session.Nov 18 04:21:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822+h  e)+ ossec9710ifDovecot Auth failed on disconnected session.Nov 18 04:21:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<1AmoTtlDtulns7yS>103.179.188.1461562822Sg  -9# ossec13001iExim Auth failed2025-11-18 04:22:02 dovecot_login authenticator failed for ([31.41.84.60]) [31.41.84.60]:36818: 535 Incorrect authentication data (set_id=aureovieira)31.41.84.60798544mf  -i% ossec13001iExim Auth failed2025-11-18 04:22:01 dovecot_login authenticator failed for ([58.58.130.22]) [58.58.130.22]:45044: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)58.58.130.221814991e W' ossec9708i~Dovecot Aborted Login with empty userNov 18 04:21:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Yd  -A' ossec13001iJExim Auth failed2025-11-18 04:20:40 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:40194: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758c W' ossec9708iBDovecot Aborted Login with empty userNov 18 04:20:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kb  -_+ ossec13001i4Exim Auth failed2025-11-18 04:20:19 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55383: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651'a  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:19:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084`  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 04:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034!_  e# ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:19:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001^  W' ossec9708i#Dovecot Aborted Login with empty userNov 18 04:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 b tpb-{  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:23:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<2+RXVtlDEuSGx8nN>134.199.201.2056252001Yz  -A% ossec13001iExim Auth failed2025-11-18 04:23:17 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:40323: 535 Incorrect authentication data (set_id=atualizacoes1)88.215.1.2012635167&y  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:23:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991Vx  -7) ossec13001iExim Auth failed2025-11-18 04:23:35 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:57810: 535 Incorrect authentication data (set_id=jobs)192.34.128.2026252001w W' ossec9708iDovecot Aborted Login with empty userNov 18 04:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6yRdV9lDRuuxV3kv>177.87.121.4734690342v e7) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:23:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044gu  -[' ossec13001iExim Auth failed2025-11-18 04:23:17 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:54977: 535 Incorrect authentication data (set_id=jobs@globalmedica.com.br)101.58.144.503175395bt  -W% ossec13001iExim Auth failed2025-11-18 04:23:44 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:57184: 535 Incorrect authentication data (set_id=jobs@louvoreterno.com.br)46.161.196.599237's  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:23:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<28CjV9lDGtQkMrGr>36.50.177.1711562822r  W' ossec9708iDovecot Aborted Login with empty userNov 18 04:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 04:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034vp  -u+ ossec13001iExim Auth failed2025-11-18 04:22:14 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:44912: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)121.142.165.1111835841o  -' ossec13001iExim Auth failed2025-11-18 04:23:03 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:34690: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)189.56.202.863469034Yn  -A' ossec13001ivExim Auth failed2025-11-18 04:21:25 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:43969: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758!m  e' ossec9710ihDovecot Auth failed on disconnected session.Nov 18 04:21:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991 5 ] -  7 Idtm<\  -A+ ossec13001i|Exim Auth failed2025-11-18 04:25:48 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:43454: 535 Incorrect authentication data (set_id=contato)121.131.220.1441835841  k' ossec9709inMultiple Dovecot Aborted Logins with empty userNov 18 04:25:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e)) ossec9710ijDovecot Auth failed on disconnected session.Nov 18 04:25:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750"  e% ossec9710ifDovecot Auth failed on disconnected session.Nov 18 04:25:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001-  e/) ossec9710i^Dovecot Auth failed on disconnected session.Nov 18 04:25:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044  -) ossec13001iXExim Auth failed2025-11-18 04:25:10 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:53186: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)176.10.197.1682661886l  -c) ossec13001iVExim Auth failed2025-11-18 04:25:08 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:59408: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)190.114.243.873625428a  -S% ossec13001i~Exim Auth failed2025-11-18 04:25:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64776: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758j  -e' ossec13001ilExim Auth failed2025-11-18 04:25:32 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:60074: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)65.20.250.18099237X  -;) ossec13001ifExim Auth failed2025-11-18 04:25:25 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:45020: 535 Incorrect authentication data (set_id=rafael)122.184.124.461269750 W' ossec9708i0Dovecot Aborted Login with empty userNov 18 04:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8JLkWtlDcJGxV3kv>177.87.121.473469034,  e1% ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:24:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841T~  -3) ossec13001iExim Auth failed2025-11-18 04:24:14 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:52814: 535 Incorrect authentication data (set_id=jobs)125.23.202.1941269750X}  -;) ossec13001iFExim Auth failed2025-11-18 04:24:52 dovecot_login authenticator failed for ([120.238.23.168]) [120.238.23.168]:44439: 535 Incorrect authentication data (set_id=cpanel)120.238.23.1681814991k|  -a) ossec13001i0Exim Auth failed2025-11-18 04:24:30 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:41628: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)121.73.163.1432186224 '  D  3  '^  -E+ ossec13001i Exim Auth failed2025-11-18 04:28:03 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:60846: 535 Incorrect authentication data (set_id=alex.vendas)128.185.254.1621269750]  -E) ossec13001i Exim Auth failed2025-11-18 04:27:59 dovecot_login authenticator failed for ([202.108.14.226]) [202.108.14.226]:40194: 535 Incorrect authentication data (set_id=faturamento)202.108.14.2261814991q  -m) ossec13001iExim Auth failed2025-11-18 04:27:41 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:51700: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)190.67.106.2213686110 W' ossec9708iDovecot Aborted Login with empty userNov 18 04:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -U+ ossec13001iExim Auth failed2025-11-18 04:27:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:52373: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795[  -E% ossec13001iExim Auth failed2025-11-18 04:26:51 dovecot_login authenticator failed for (mail.iemif.org) [60.2.243.174]:37100: 535 Incorrect authentication data (set_id=admin@iemif.org)60.2.243.1741814991 W' ossec9708iDovecot Aborted Login with empty userNov 18 04:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:26:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001$  e!' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:26:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758Z -A' ossec13001iExim Auth failed2025-11-18 04:26:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:43869: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758/  e1+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<7aWlY9lDOKNns7yS>103.179.188.1461562822W  -;' ossec13001iExim Auth failed2025-11-18 04:26:42 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:35438: 535 Incorrect authentication data (set_id=eduardo)182.95.51.1661269750m  -e) ossec13001iExim Auth failed2025-11-18 04:26:20 dovecot_login authenticator failed for ([211.141.56.185]) [211.141.56.185]:46416: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)211.141.56.1851814991S  -5% ossec13001iExim Auth failed2025-11-18 04:26:02 dovecot_login authenticator failed for (mail.iemif.org) [60.2.243.174]:35884: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991  W' ossec9708iDovecot Aborted Login with empty userNov 18 04:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  _jQ''  W' ossec9708i &Dovecot Aborted Login with empty userNov 18 04:28:38 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=93.174.95.106, lip=186.233.225.118, session=93.174.95.10627504057&  eC) ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:28:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750,%  e-) ossec9710i &Dovecot Auth failed on disconnected session.Nov 18 04:28:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387$  k' ossec9709i "Multiple Dovecot Aborted Logins with empty userNov 18 04:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&#  e%% ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:28:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991"  W' ossec9708i @Dovecot Aborted Login with empty userNov 18 04:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1aEDa9lDGoSxV3kv>177.87.121.473469034q!  -m) ossec13001iExim Auth failed2025-11-18 04:27:30 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:44282: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)125.154.62.2291835841+  e+) ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:27:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044  So) ossec11000i Login failed on the cpanel service.[2025-11-18 04:28:05 -0300] info [cpaneld] 119.28.107.251 - deproi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deproi (has_cpuser_file failed)119.28.107.25118802517  eE' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:28:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651P  -1# ossec13001iExim Auth failed2025-11-18 04:27:58 dovecot_login authenticator failed for ([1.24.210.27]) [1.24.210.27]:44156: 535 Incorrect authentication data (set_id=adriana)1.24.210.271814991v  -w) ossec13001iExim Auth failed2025-11-18 04:27:43 dovecot_login authenticator failed for ([175.208.142.26]) [175.208.142.26]:49216: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)175.208.142.261835841(  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:27:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<7CpUZdlDQsln9M4G>103.244.206.616430840  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 18 04:27:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841 B RrX.FapB*6  e'+ ossec9710i |Dovecot Auth failed on disconnected session.Nov 18 04:30:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991m5  -g' ossec13001i rExim Auth failed2025-11-18 04:29:54 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:56996: 535 Incorrect authentication data (set_id=financeiro)117.211.15.931269750a4  -M) ossec13001i pExim Auth failed2025-11-18 04:29:52 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:33869: 535 Incorrect authentication data (set_id=administrativo1)103.168.241.321269750d3  -S) ossec13001i nExim Auth failed2025-11-18 04:29:50 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:44726: 535 Incorrect authentication data (set_id=jobs)42.200.196.1411819730&2  e+ ossec9710i dDovecot Auth failed on disconnected session.Nov 18 04:29:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.12162520011 W' ossec9708i ^Dovecot Aborted Login with empty userNov 18 04:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\0  -K% ossec13001i ZExim Auth failed2025-11-18 04:29:30 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:45029: 535 Incorrect authentication data (set_id=jobs@inovasite.com)65.20.130.95992373/  e=' ossec9710i pDovecot Auth failed on disconnected session.Nov 18 04:29:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991z.  -}+ ossec13001i ZExim Auth failed2025-11-18 04:29:30 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:54506: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)218.149.235.1521835841~-  - ' ossec13001i ZExim Auth failed2025-11-18 04:29:29 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:33716: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)95.31.209.1022017370#,  e!# ossec9710i RDovecot Auth failed on disconnected session.Nov 18 04:29:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<9P0QbNlDCOhCYSpH>66.97.42.713865483(+  e'' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:28:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001* Ss) ossec11000i Login failed on the cpanel service.[2025-11-18 04:28:06 -0300] info [cpaneld] 119.28.107.251 - deproico "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password119.28.107.2511880251/)  e1+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:28:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841a(  -K+ ossec13001i >Exim Auth failed2025-11-18 04:29:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52067: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034 5 5 X . 2[kF W' ossec9708i Dovecot Aborted Login with empty userNov 18 04:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iE  -_' ossec13001i Exim Auth failed2025-11-18 04:30:18 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:42936: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)125.20.251.661269750VD  -9' ossec13001i Exim Auth failed2025-11-18 04:30:39 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:47780: 535 Incorrect authentication data (set_id=compras)119.192.59.801835841kC  -a) ossec13001i Exim Auth failed2025-11-18 04:30:28 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:33814: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)177.61.176.1103469034\B  -A+ ossec13001i Exim Auth failed2025-11-18 04:30:24 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:57916: 535 Incorrect authentication data (set_id=compras)154.146.240.1232542007YA  -A' ossec13001i Exim Auth failed2025-11-18 04:30:15 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:51673: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758l@  -g% ossec13001i Exim Auth failed2025-11-18 04:30:54 dovecot_login authenticator failed for ([218.13.47.83]) [218.13.47.83]:54448: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)218.13.47.831814991S?  -5% ossec13001i Exim Auth failed2025-11-18 04:30:47 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:14295: 535 Incorrect authentication data (set_id=contato)203.252.10.31835841a>  -K+ ossec13001i Exim Auth failed2025-11-18 04:30:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52038: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034_=  -O% ossec13001i Exim Auth failed2025-11-18 04:30:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57540: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)62.60.131.171307580<  e3+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:30:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822&;  e%% ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:30:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001Y:  -=) ossec13001i |Exim Auth failed2025-11-18 04:30:04 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:59404: 535 Incorrect authentication data (set_id=compras)220.67.122.2301835841|9 -) ossec13001i hExim Auth failed2025-11-18 04:29:44 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:39880: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)94.255.208.1692661886Y8  -A' ossec13001i ZExim Auth failed2025-11-18 04:29:29 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:26414: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758j7  -a' ossec13001i RExim Auth failed2025-11-18 04:29:21 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:48388: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)182.95.115.701269750 ,J ' P \ / U W' ossec9708i!Dovecot Aborted Login with empty userNov 18 04:32:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fT  -[% ossec13001i!Exim Auth failed2025-11-18 04:32:32 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:52894: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)12.26.236.1062520012S  e9) ossec9710i! Dovecot Auth failed on disconnected session.Nov 18 04:32:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197300R e5' ossec9710i!*Dovecot Auth failed on disconnected session.Nov 18 04:32:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<0oDceNlDMr8rmxBp>43.155.16.1051819730~Q  -) ossec13001i!Exim Auth failed2025-11-18 04:32:45 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:51525: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)35.130.111.1466252001YP  -?' ossec13001i Exim Auth failed2025-11-18 04:31:25 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:53146: 535 Incorrect authentication data (set_id=financeiro)222.100.159.21835841O  -+ ossec13001i Exim Auth failed2025-11-18 04:31:23 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.100]:1558: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)186.179.100.1003686110.N  e1+ ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:32:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758M  W' ossec9708i Dovecot Aborted Login with empty userNov 18 04:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)L  e+' ossec9710i Dovecot Auth failed on disconnected session.Nov 18 04:31:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758pK  -q# ossec13001i Exim Auth failed2025-11-18 04:31:51 dovecot_login authenticator failed for ([59.23.3.146]) [59.23.3.146]:43130: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)59.23.3.1461835841SJ  -7% ossec13001i Exim Auth failed2025-11-18 04:31:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:56736: 535 Incorrect authentication data (set_id=info@conut.org.br)62.60.131.17130758I  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 04:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^H  -G) ossec13001i Exim Auth failed2025-11-18 04:30:40 dovecot_login authenticator failed for ([102.207.152.72]) [102.207.152.72]:32839: 535 Incorrect authentication data (set_id=atualizacoes)102.207.152.723374766PG  -1# ossec13001i Exim Auth failed2025-11-18 04:30:40 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:21372: 535 Incorrect authentication data (set_id=contato)218.76.73.41814991 ;$   % * E 3:C2;Ye  -A' ossec13001i!^Exim Auth failed2025-11-18 04:33:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:42847: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758d W' ossec9708i!NDovecot Aborted Login with empty userNov 18 04:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Yc  -C% ossec13001i!<Exim Auth failed2025-11-18 04:33:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62129: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.401307580b  e5) ossec9710i!hDovecot Auth failed on disconnected session.Nov 18 04:34:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<9ZmafNlDAOud5hjP>157.230.24.2072921044sa  -o+ ossec13001i!dExim Auth failed2025-11-18 04:33:56 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:49176: 535 Incorrect authentication data (set_id=anderson)122.187.230.1411269750u`  -u) ossec13001i!dExim Auth failed2025-11-18 04:33:55 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:58638: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)50.223.176.1716252001\_  -E' ossec13001i!ZExim Auth failed2025-11-18 04:33:46 dovecot_login authenticator failed for ([60.186.172.37]) [60.186.172.37]:57166: 535 Incorrect authentication data (set_id=atualizacoes1)60.186.172.371814991v^  -}# ossec13001i!ZExim Auth failed2025-11-18 04:33:46 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61819: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)70.120.1.7462520014]  e?' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:32:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084a\  -S% ossec13001i!Exim Auth failed2025-11-18 04:32:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57526: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758w[  -w+ ossec13001i!,Exim Auth failed2025-11-18 04:33:00 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:42386: 535 Incorrect authentication data (set_id=exclusiverxstore)190.121.193.1263595528[Z  -A) ossec13001i!(Exim Auth failed2025-11-18 04:32:55 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:43170: 535 Incorrect authentication data (set_id=comercial)152.52.199.1261269750Y -+' ossec13001i!"Exim Auth failed2025-11-18 04:32:50 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:63101: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)189.31.138.383469034X  -' ossec13001i!Exim Auth failed2025-11-18 04:32:44 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:62736: 535 Incorrect authentication data (set_id=exclusiverxstore@inovasiteweb.com.br)34.84.162.1771861060hW  -_' ossec13001i!.Exim Auth failed2025-11-18 04:33:01 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:37034: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)31.135.26.217798544lV  -g% ossec13001i!*Exim Auth failed2025-11-18 04:32:57 dovecot_login authenticator failed for (210.241.51.119.adsl-pool.jlccptt.net.cn) [58.244.98.11]:27738: 535 Incorrect authentication data (set_id=contato)58.244.98.111814991  Z "EZdvJ'6$s  e) ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:34:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<+mTvf9lDDuvSchJs>210.114.18.1081835841mr  -e) ossec13001i!Exim Auth failed2025-11-18 04:34:46 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:34274: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)182.95.176.2061269750q  k' ossec9709i!Multiple Dovecot Aborted Logins with empty userNov 18 04:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4MCtftlDUI2xV3kv>177.87.121.473469034(p  e%) ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822jo  -c% ossec13001i!rExim Auth failed2025-11-18 04:34:10 dovecot_login authenticator failed for host94.sub-63-47-182.myvzw.com [63.47.182.94]:29774: 535 Incorrect authentication data (set_id=marcelo.pinheiro)63.47.182.946252001rn  -o) ossec13001i!Exim Auth failed2025-11-18 04:35:01 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:59852: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)125.19.182.1181269750gm  -[' ossec13001i!Exim Auth failed2025-11-18 04:35:00 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:37298: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)182.78.144.341269750Yl  -A' ossec13001i!Exim Auth failed2025-11-18 04:34:56 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:62710: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.1191307584k  e?' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:35:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822$j  e' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:34:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.21062520011i  e5+ ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001'h  e%' ossec9710i!\Dovecot Auth failed on disconnected session.Nov 18 04:33:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001gg  -]% ossec13001i!DExim Auth failed2025-11-18 04:33:23 dovecot_login authenticator failed for ([59.12.100.16]) [59.12.100.16]:51229: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)59.12.100.161835841/f  e9# ossec9710i!jDovecot Auth failed on disconnected session.Nov 18 04:34:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=43.100.60.01819730 z*4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    R z p f \ H  > *  4vlbX&DN:0|rh@6^,"TJZxnd<2(PF ~LB8t.j$V`\R4zH>pf | r h ^ T J @ 6 , "    x n d Z Pz*  vlbXND:0& i$Mk i$Ye i$Sl i$Ih i$Eg i$_i i$_f i$Od i$c i$b i$a i$ ` i$_ i$^ i$)] i$\ i#[ i#Z i#Y i#X i#W i#V i#U i#T i#S i#R i#Q i#P i#O i#N i#M i#L i#K i#J i#I i#sH i#iG i#iF i#iE i#]D i#[C i#WB i#uA i#3@ i#-? i##> i#M= i#I< i#9; i#5: i#79 i#%8 i#7 i#C6 i#=5 i"4 i"3 i"2 i"1 i"0 i"/ i". i"- i#, i# + i#* i") i"( i#' i"& i"% i"$ i"# i#" i"! i" i" i" i" i" i" i" i" i"y i"m i"= i"] i"[ i"O i"M i"I i"= i! i"  i" i! i" i" i" i! i! i! i"" i" i" i" i! i! i! i! i! i! i! i! i! i! i! i! i! i! i! i! i! i! i!r i! i! i! i! i! i! i!\ i!j i!h i!d i!d i!^ i!Z i!Z i!N i!D i!< i!. i!, i!* i!* i!( i!" i! i! i! i! i! i! i!  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  i  io iq ip il ig if ik ij i% i% i% i% i% i%i i%g i%[ i%S i%Q i%N i%I i%; i%9 i%7 i%+ i%+ i% i%} i% i% | i% i%{ i$~ i$y i$x i$w i$v i$u i$z i$t i$r i$q i$p i$o i$n i$m i$s i$wj i  i  i  i | i | i r i p i p i n i h i d i ^ i Z i Z i Z i Z i R i R i @ i > i & i & i " i  i  i  i  i  i  i  i  i  i i i i i i i i i i( i% i i i i i i i i i i~ i| in il ij if if i^ iX iV iF} i0 i0| i& i~ iy it is ix iw iv i{ iz iu ir  V  -7) ossec13001i"Exim Auth failed2025-11-18 04:36:45 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:57092: 535 Incorrect authentication data (set_id=bqtz)125.154.62.2291835841$  e## ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:35:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483}  -+ ossec13001i!Exim Auth failed2025-11-18 04:35:21 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:46324: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)188.219.104.2103175395Z  -A' ossec13001i!Exim Auth failed2025-11-18 04:35:16 dovecot_login authenticator failed for ([223.75.231.193]) [58.49.113.138]:19222: 535 Incorrect authentication data (set_id=formula316)58.49.113.1381814991\~  -A+ ossec13001i!Exim Auth failed2025-11-18 04:35:14 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:56290: 535 Incorrect authentication data (set_id=contato)220.180.107.19318149912}  e=% ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:35:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001y|  -% ossec13001i!Exim Auth failed2025-11-18 04:35:45 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:64134: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)92.189.80.732510769`{  -O% ossec13001i!Exim Auth failed2025-11-18 04:35:37 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:41220: 535 Incorrect authentication data (set_id=design@inovasite.com)102.88.10.102328926Uz  -7' ossec13001i!Exim Auth failed2025-11-18 04:35:33 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:38880: 535 Incorrect authentication data (set_id=mecati)111.61.97.1081814991.y  e1) ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:36:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730bx  -Q' ossec13001i!Exim Auth failed2025-11-18 04:35:43 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:59071: 535 Incorrect authentication data (set_id=design)69.123.219.826252001w W' ossec9708i!Dovecot Aborted Login with empty userNov 18 04:35:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2uVIgtlDpJ6xV3kv>177.87.121.473469034(v  e)% ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 04:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370pu  -k) ossec13001i!Exim Auth failed2025-11-18 04:35:15 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:48644: 535 Incorrect authentication data (set_id=assessoria)184.152.99.2446252001t  W' ossec9708i!Dovecot Aborted Login with empty userNov 18 04:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 r /?U\z{r(  e#+ ossec9710i"MDovecot Auth failed on disconnected session.Nov 18 04:37:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001Y  -A' ossec13001i"IExim Auth failed2025-11-18 04:37:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:58428: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758{  -) ossec13001i"=Exim Auth failed2025-11-18 04:37:32 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:53566: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)110.25.112.1511668284^  -G) ossec13001i!Exim Auth failed2025-11-18 04:36:30 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:56686: 535 Incorrect authentication data (set_id=sandromiguel)120.157.223.132077456u  -y' ossec13001i" Exim Auth failed2025-11-18 04:36:41 dovecot_plain authenticator failed for (v190l2o81hw9v08wa34mk8tykun2) [91.195.86.147]:64248: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)91.195.86.147690791f  -_# ossec13001i"Exim Auth failed2025-11-18 04:36:35 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:38966: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)5.32.22.218290557l  -i# ossec13001i!Exim Auth failed2025-11-18 04:36:16 dovecot_login authenticator failed for 99-48-39-66.lightspeed.brfrct.sbcglobal.net [99.48.39.66]:50709: 535 Incorrect authentication data (set_id=contato)99.48.39.666252001c  -W# ossec13001i"Exim Auth failed2025-11-18 04:36:49 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:55189: 535 Incorrect authentication data (set_id=presidencia)111.70.32.51668284S  -3' ossec13001i"Exim Auth failed2025-11-18 04:36:32 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:52999: 535 Incorrect authentication data (set_id=info)77.211.31.2222510769c  -O+ ossec13001i"Exim Auth failed2025-11-18 04:36:31 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:43256: 535 Incorrect authentication data (set_id=bqtz@iemif.com)220.201.218.1461814991h  -_% ossec13001i!Exim Auth failed2025-11-18 04:36:19 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:42674: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)218.22.0.2001814991Y  -=) ossec13001i!Exim Auth failed2025-11-18 04:36:18 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:34286: 535 Incorrect authentication data (set_id=contato)129.80.228.2316252001j  -]+ ossec13001i!Exim Auth failed2025-11-18 04:36:13 dovecot_login authenticator failed for ([218.154.54.1]) [222.108.177.110]:40081: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)222.108.177.1101835841#  e' ossec9710i""Dovecot Auth failed on disconnected session.Nov 18 04:37:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.1371307580  e5) ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 04:37:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<2lRlh9lDBNqnR+bm>167.71.230.2301269750 W' ossec9708i"Dovecot Aborted Login with empty userNov 18 04:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034    &!  e!) ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 04:39:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044u  -{# ossec13001i"Exim Auth failed2025-11-18 04:39:55 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:46960: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)177.174.0.33469034g -U+ ossec13001i"Exim Auth failed2025-11-18 04:39:41 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51876: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034  e# ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 04:39:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750 W' ossec9708i"Dovecot Aborted Login with empty userNov 18 04:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -O% ossec13001i"Exim Auth failed2025-11-18 04:40:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:60811: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)62.60.131.17130758n  -i' ossec13001i"Exim Auth failed2025-11-18 04:39:57 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:56026: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)152.231.25.643686110q  -k+ ossec13001i"Exim Auth failed2025-11-18 04:39:41 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:49934: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)121.131.220.1521835841.  e1) ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 04:39:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841 W' ossec9708i"yDovecot Aborted Login with empty userNov 18 04:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -S% ossec13001i"mExim Auth failed2025-11-18 04:38:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57906: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758  k' ossec9709i"=Multiple Dovecot Aborted Logins with empty userNov 18 04:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034S  -7% ossec13001i"]Exim Auth failed2025-11-18 04:38:04 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:59915: 535 Incorrect authentication data (set_id=info@conut.org.br)62.60.131.17130758  W' ossec9708i"[Dovecot Aborted Login with empty userNov 18 04:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|  -) ossec13001i"OExim Auth failed2025-11-18 04:37:50 dovecot_login authenticator failed for (abts-mum-dynamic-062.142.179.122.airtelbroadband.in) [122.179.142.62]:36356: 535 Incorrect authentication data (set_id=contato)122.179.142.621269750  v0  -w) ossec13001i"Exim Auth failed2025-11-18 04:40:15 dovecot_login authenticator failed for ([218.238.15.224]) [218.238.15.224]:32938: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)218.238.15.2241835841P/  -/% ossec13001i"Exim Auth failed2025-11-18 04:40:12 dovecot_login authenticator failed for ([59.12.100.16]) [59.12.100.16]:51676: 535 Incorrect authentication data (set_id=info)59.12.100.161835841Y.  -=) ossec13001i"Exim Auth failed2025-11-18 04:40:09 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:3244: 535 Incorrect authentication data (set_id=atualizacoes)218.28.168.1901814991Y-  -A' ossec13001i"Exim Auth failed2025-11-18 04:40:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:20790: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758,  W' ossec9708i#Dovecot Aborted Login with empty userNov 18 04:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#+  e+ ossec9710i# Dovecot Auth failed on disconnected session.Nov 18 04:40:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<7xNkldlDQtjBl4nP>193.151.137.207130758a*  -S% ossec13001i#Exim Auth failed2025-11-18 04:40:54 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:53895: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758e)  -U) ossec13001i"Exim Auth failed2025-11-18 04:40:21 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:56084: 535 Incorrect authentication data (set_id=compras)110.25.112.1511668284k(  -i% ossec13001i"Exim Auth failed2025-11-18 04:40:17 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:43991: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)65.20.211.9699237/'  e3) ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:40:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<1vosldlDEOaYNbyQ>152.53.188.14429210443& e=% ossec9710i"Dovecot Auth failed on disconnected session.Nov 18 04:40:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<07TMlNlDIrYv+wDY>47.251.0.2166252001W% -9' ossec13001i"Exim Auth failed2025-11-18 04:40:30 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:39804: 535 Incorrect authentication data (set_id=contato)222.120.176.61835841R$  -1' ossec13001i"Exim Auth failed2025-11-18 04:40:19 dovecot_login authenticator failed for ([117.133.35.58]) [117.133.35.58]:51374: 535 Incorrect authentication data (set_id=adm)117.133.35.581814991#  k' ossec9709i"Multiple Dovecot Aborted Logins with empty userNov 18 04:40:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342"  e7+ ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:41:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001 Z# @ O ! I l50OxmtZ? W' ossec9708i#-Dovecot Aborted Login with empty userNov 18 04:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5oO5l9lDCrixV3kv>177.87.121.473469034u>  -u) ossec13001i##Exim Auth failed2025-11-18 04:41:22 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:48080: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)152.52.246.1781269750+=  e-' ossec9710i#MDovecot Auth failed on disconnected session.Nov 18 04:42:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001X<  -=) ossec13001i#IExim Auth failed2025-11-18 04:42:00 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:42930: 535 Incorrect authentication data (set_id=adriana)196.190.43.167337996S;  -7% ossec13001i#9Exim Auth failed2025-11-18 04:41:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:51472: 535 Incorrect authentication data (set_id=info@conut.org.br)62.60.131.17130758]:  -G) ossec13001i#5Exim Auth failed2025-11-18 04:41:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:50544: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.2267985499  -' ossec13001i#7Exim Auth failed2025-11-18 04:41:41 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:45550: 535 Incorrect authentication data (set_id=jobs@calcautomacao.com.br)187.218.57.50399606338  e;) ossec9710i#%Dovecot Auth failed on disconnected session.Nov 18 04:41:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730Y7  -A' ossec13001i#Exim Auth failed2025-11-18 04:41:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:13745: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758T6  -3) ossec13001i#CExim Auth failed2025-11-18 04:41:54 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.227]:34298: 535 Incorrect authentication data (set_id=jobs)185.137.75.2273017382*5  e)) ossec9710i#=Dovecot Auth failed on disconnected session.Nov 18 04:41:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750m4  -g' ossec13001i"Exim Auth failed2025-11-18 04:40:07 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:33888: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)182.95.115.381269750_3  -M% ossec13001i"Exim Auth failed2025-11-18 04:40:33 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:59974: 535 Incorrect authentication data (set_id=andressa.financeiro)160.25.58.191643084Y2  -?' ossec13001i"Exim Auth failed2025-11-18 04:40:33 dovecot_login authenticator failed for ([112.98.177.66]) [112.98.177.66]:46961: 535 Incorrect authentication data (set_id=assessoria)112.98.177.661814991|1  -+ ossec13001i"Exim Auth failed2025-11-18 04:40:18 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:60190: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)211.247.127.2501835841  c Ic_S&)M  e-# ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:44:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001L  k' ossec9709i#Multiple Dovecot Aborted Logins with empty userNov 18 04:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-K  e3% ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:43:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841)J  e') ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:42:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044I  -+ ossec13001i#Exim Auth failed2025-11-18 04:42:55 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:45960: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)128.185.201.1701269750#H  e) ossec9710i#sDovecot Auth failed on disconnected session.Nov 18 04:42:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387YG  -;+ ossec13001i#iExim Auth failed2025-11-18 04:42:33 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:55210: 535 Incorrect authentication data (set_id=jobs)177.236.145.1883996063bF  -S% ossec13001i#iExim Auth failed2025-11-18 04:42:32 dovecot_login authenticator failed for 221-120-4-33.emome-ip.hinet.net [221.120.4.33]:57731: 535 Incorrect authentication data (set_id=rodrigo)221.120.4.331668284E W' ossec9708i#iDovecot Aborted Login with empty userNov 18 04:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-D  e/) ossec9710i#]Dovecot Auth failed on disconnected session.Nov 18 04:42:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730C  -)) ossec13001i#[Exim Auth failed2025-11-18 04:42:18 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br ([187.126.105.145]) [187.126.105.42]:46814: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)187.126.105.423469034nB  -g) ossec13001i#WExim Auth failed2025-11-18 04:42:14 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:23696: 535 Incorrect authentication data (set_id=jobs@lixadoracuritiba.com.br)112.162.18.1501835841+A  e+) ossec9710i#uDovecot Auth failed on disconnected session.Nov 18 04:42:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.5562520014@  e?' ossec9710i#3Dovecot Auth failed on disconnected session.Nov 18 04:41:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001  z cygp9[ W' ossec9708i#Dovecot Aborted Login with empty userNov 18 04:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343Z  e9+ ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:44:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822$Y  e## ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:44:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<+mh/odlDPsSUcQQF>148.113.4.51269750fX  -U+ ossec13001i#Exim Auth failed2025-11-18 04:44:15 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52387: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034aW  -S% ossec13001i#Exim Auth failed2025-11-18 04:44:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:52089: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758V  -') ossec13001i#Exim Auth failed2025-11-18 04:44:59 dovecot_login authenticator failed for (ip-189-97-236-201.user.vivozap.com.br) [189.97.236.201]:38029: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)189.97.236.2013469034fU  -U+ ossec13001i#Exim Auth failed2025-11-18 04:43:58 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51998: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.14134690343T  e;) ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:43:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730\S  -C) ossec13001i#Exim Auth failed2025-11-18 04:43:31 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:58552: 535 Incorrect authentication data (set_id=financeiro)131.161.184.463865483)R  e') ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:43:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456\Q  -I% ossec13001i#Exim Auth failed2025-11-18 04:43:23 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51274: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.401307585P  e?) ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:43:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387#O  e) ossec9710i#Dovecot Auth failed on disconnected session.Nov 18 04:43:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044N  W' ossec9708i#Dovecot Aborted Login with empty userNov 18 04:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 O eBewBhOj  W' ossec9708i$wDovecot Aborted Login with empty userNov 18 04:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vi  -9' ossec13001i$_Exim Auth failed2025-11-18 04:46:38 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:56581: 535 Incorrect authentication data (set_id=adriana)178.68.91.11920173701h  e9' ossec9710i$IDovecot Auth failed on disconnected session.Nov 18 04:46:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822jg  -_) ossec13001i$EExim Auth failed2025-11-18 04:46:12 dovecot_login authenticator failed for (92.84.8.221.adsl-pool.jlccptt.net.cn) [222.169.71.110]:49011: 535 Incorrect authentication data (set_id=info)222.169.71.1101814991Yf  -A' ossec13001i$_Exim Auth failed2025-11-18 04:46:39 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:44811: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758e  k' ossec9709i$YMultiple Dovecot Aborted Logins with empty userNov 18 04:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)d  e') ossec9710i$ODovecot Auth failed on disconnected session.Nov 18 04:46:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358418c  eC+ ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:45:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<3gqQpNlDaKaGx8nN>134.199.201.20562520010b  e9% ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:45:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001ka  -c' ossec13001i$Exim Auth failed2025-11-18 04:45:25 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:32988: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)121.73.167.152186224Y`  -A' ossec13001i$ Exim Auth failed2025-11-18 04:45:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:30282: 535 Incorrect authentication data (set_id=info@ufadville.com.br)62.60.131.119130758`_  -Q# ossec13001i$Exim Auth failed2025-11-18 04:45:11 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:55891: 535 Incorrect authentication data (set_id=isabellylisboa)46.44.24.402017370/^  e3+ ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:45:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758}]  -) ossec13001i$)Exim Auth failed2025-11-18 04:45:44 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:35229: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)201.173.216.163996063\ W' ossec9708i$Dovecot Aborted Login with empty userNov 18 04:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 (. J l R # ,3y  e?% ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:49:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<9Q+istlD+M0zTY0d>51.77.141.293017382Vx  -7) ossec13001i$Exim Auth failed2025-11-18 04:49:04 dovecot_login authenticator failed for ([218.80.238.162]) [218.80.238.162]:53591: 535 Incorrect authentication data (set_id=info)218.80.238.1621814991w W' ossec9708i$Dovecot Aborted Login with empty userNov 18 04:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%v  e%# ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:48:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<86ayr9lDaH2nYwhf>167.99.8.956252001^u  -K' ossec13001i$Exim Auth failed2025-11-18 04:48:15 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:57973: 535 Incorrect authentication data (set_id=cpfnc2)84.43.254.214732800't  e#) ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:48:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001hs  -[) ossec13001i$Exim Auth failed2025-11-18 04:47:14 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:45727: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)190.223.53.2343932488.r  e1) ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:48:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<+Wm3rtlDzs92wSaf>118.193.38.1591819730sq  -q) ossec13001i$Exim Auth failed2025-11-18 04:47:58 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:42923: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)222.101.241.441835841+p  e-' ossec9710i$Dovecot Auth failed on disconnected session.Nov 18 04:47:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001o W' ossec9708i$Dovecot Aborted Login with empty userNov 18 04:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Zn  -?) ossec13001i$Exim Auth failed2025-11-18 04:47:23 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.238]:15334: 535 Incorrect authentication data (set_id=anderson)210.206.24.2381835841`m -O% ossec13001i$Exim Auth failed2025-11-18 04:47:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:50525: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)62.60.131.17130758vl  -w) ossec13001i$SExim Auth failed2025-11-18 04:46:27 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:35584: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)220.179.120.261814991Tk -7% ossec13001i$MExim Auth failed2025-11-18 04:46:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:56496: 535 Incorrect authentication data (set_id=info@conut.org.br)62.60.131.17130758  +  e+) ossec9710i%iDovecot Auth failed on disconnected session.Nov 18 04:51:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750]  -E) ossec13001i%gExim Auth failed2025-11-18 04:51:03 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:52398: 535 Incorrect authentication data (set_id=vendas.luiz)182.95.223.1141269750n  -k% ossec13001i%[Exim Auth failed2025-11-18 04:50:51 dovecot_login authenticator failed for (37.61.176.53.svttk.ru) [37.61.176.53]:60532: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)37.61.176.532017370d  -Q+ ossec13001i%QExim Auth failed2025-11-18 04:50:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55965: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651 W' ossec9708i%IDovecot Aborted Login with empty userNov 18 04:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342  e7+ ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:49:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<32CPs9lDit+ElIx5>132.148.140.1216252001  W' ossec9708i%+Dovecot Aborted Login with empty userNov 18 04:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -S% ossec13001i%+Exim Auth failed2025-11-18 04:50:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:49302: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758_  -O# ossec13001i%Exim Auth failed2025-11-18 04:49:50 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:43264: 535 Incorrect authentication data (set_id=contato)58.27.253.61168579Z -A' ossec13001i%Exim Auth failed2025-11-18 04:49:43 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:49522: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)62.60.131.119130758g~  -]' ossec13001i$Exim Auth failed2025-11-18 04:49:08 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3684: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)213.55.85.202337996)}  e%+ ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:49:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991|  k' ossec9709i% Multiple Dovecot Aborted Logins with empty userNov 18 04:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9ztStNlDQu6xV3kv>177.87.121.473469034#{  e% ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:49:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060nz  -g) ossec13001i$Exim Auth failed2025-11-18 04:48:11 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:59250: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)221.167.21.1481835841  x{  - ' ossec13001i%Exim Auth failed2025-11-18 04:52:48 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:41190: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)179.184.33.863469034  k' ossec9709i%Multiple Dovecot Aborted Logins with empty userNov 18 04:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034K  -+ ossec13001i%Exim Auth failed2025-11-18 04:51:41 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:60914: 535 Incorrect authentication data211.198.128.1241835841 W' ossec9708i%Dovecot Aborted Login with empty userNov 18 04:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -O% ossec13001i%Exim Auth failed2025-11-18 04:51:27 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:63302: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)62.60.131.17130758*  e+' ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:52:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841j  -_) ossec13001i%Exim Auth failed2025-11-18 04:51:58 dovecot_login authenticator failed for (hn.kd.ny.adsl) [218.29.231.106]:51122: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)218.29.231.1061814991+  e/% ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:51:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841,  e/' ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001|  -+ ossec13001i%Exim Auth failed2025-11-18 04:52:05 dovecot_login authenticator failed for 182-155-213-175.veetime.com [182.155.213.175]:52432: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)182.155.213.1751668284v  -u+ ossec13001i%NExim Auth failed2025-11-18 04:50:36 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:8579: 535 Incorrect authentication data (set_id=cpfnc2)107.135.117.2456252001|  -% ossec13001i%9Exim Auth failed2025-11-18 04:50:16 dovecot_login authenticator failed for 111-70-48-26.emome-ip.hinet.net [111.70.48.26]:43723: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)111.70.48.261668284  - ' ossec13001i%SExim Auth failed2025-11-18 04:50:42 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:39772: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)95.31.209.1022017370S  -7% ossec13001i%;Exim Auth failed2025-11-18 04:50:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64151: 535 Incorrect authentication data (set_id=info@conut.org.br)62.60.131.171307584  e?' ossec9710i%7Dovecot Auth failed on disconnected session.Nov 18 04:50:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651    /& W' ossec9708i%Dovecot Aborted Login with empty userNov 18 04:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y%  -?' ossec13001i%Exim Auth failed2025-11-18 04:53:28 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:53560: 535 Incorrect authentication data (set_id=financeiro)222.76.248.541814991_$  -M% ossec13001i&Exim Auth failed2025-11-18 04:54:04 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:48680: 535 Incorrect authentication data (set_id=contato)117.2.123.191562822q#  -o' ossec13001i%Exim Auth failed2025-11-18 04:52:24 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:34107: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)187.6.121.2463469034k"  -a) ossec13001i%Exim Auth failed2025-11-18 04:53:04 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:37144: 535 Incorrect authentication data (set_id=ferramentaria)110.25.112.1511668284,!  e++ ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:53:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841}  - ' ossec13001i%Exim Auth failed2025-11-18 04:52:13 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:54377: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)85.29.246.199453733  -5+ ossec13001i%Exim Auth failed2025-11-18 04:53:06 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:40538: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)122.170.111.1401269750t  -s) ossec13001i%Exim Auth failed2025-11-18 04:52:39 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:37946: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)182.95.176.2061269750\  -E) ossec13001i%Exim Auth failed2025-11-18 04:52:28 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:48679: 535 Incorrect authentication data (set_id=alex.vendas)94.204.236.202290557`  -M' ossec13001i%Exim Auth failed2025-11-18 04:52:21 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:59439: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730q  -q% ossec13001i%Exim Auth failed2025-11-18 04:52:19 dovecot_login authenticator failed for ([58.20.76.243]) [58.20.87.113]:54884: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)58.20.87.1131814991a  -M) ossec13001i%Exim Auth failed2025-11-18 04:52:50 dovecot_login authenticator failed for ([46.151.242.210]) [46.151.242.210]:51182: 535 Incorrect authentication data (set_id=administrativo1)46.151.242.2102017370/  e5' ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:52:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001  W' ossec9708i%Dovecot Aborted Login with empty userNov 18 04:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034    ~no5  -i) ossec13001i&nExim Auth failed2025-11-18 04:55:25 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:57961: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)175.43.184.2021814991]4  -E) ossec13001i&Exim Auth failed2025-11-18 04:56:05 dovecot_login authenticator failed for ([110.227.215.90]) [110.227.215.90]:57213: 535 Incorrect authentication data (set_id=vendas.luiz)110.227.215.9012697503  W' ossec9708i&Dovecot Aborted Login with empty userNov 18 04:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342  - + ossec13001i&Exim Auth failed2025-11-18 04:55:48 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:51196: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)185.183.103.1212635167m1  -c+ ossec13001i&zExim Auth failed2025-11-18 04:55:37 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:34848: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)178.178.194.19220173700  k' ossec9709i&vMultiple Dovecot Aborted Logins with empty userNov 18 04:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o/  -k' ossec13001i&FExim Auth failed2025-11-18 04:54:44 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:34410: 535 Incorrect authentication data (set_id=alex.vendas)71.12.241.2256252001.  --) ossec13001i&<Exim Auth failed2025-11-18 04:54:34 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:35188: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)201.15.149.2543469034- W' ossec9708i&:Dovecot Aborted Login with empty userNov 18 04:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#,  e% ossec9710i&ZDovecot Auth failed on disconnected session.Nov 18 04:55:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060(+  e)% ossec9710i&PDovecot Auth failed on disconnected session.Nov 18 04:54:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841k*  -_+ ossec13001i&Exim Auth failed2025-11-18 04:53:57 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64468: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651d)  -U' ossec13001i&Exim Auth failed2025-11-18 04:53:50 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:58786: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)95.181.244.442017370b( -S% ossec13001i& Exim Auth failed2025-11-18 04:53:46 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:65184: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)62.60.131.17130758)'  e%+ ossec9710i%Dovecot Auth failed on disconnected session.Nov 18 04:53:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822  !D W' ossec9708i&Dovecot Aborted Login with empty userNov 18 04:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0XP20NlDgsOxV3kv>177.87.121.473469034!C  e# ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:56:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<0auXztlDlPKnYwhf>167.99.8.956252001uB  -w' ossec13001i&Exim Auth failed2025-11-18 04:56:45 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:46658: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)202.53.54.1912077456YA  -C% ossec13001i&Exim Auth failed2025-11-18 04:56:38 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63919: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758@ W' ossec9708i&Dovecot Aborted Login with empty userNov 18 04:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3n1dzdlDKq2xV3kv>177.87.121.473469034-?  e-+ ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:56:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822i>  -a% ossec13001i&Exim Auth failed2025-11-18 04:56:50 dovecot_login authenticator failed for ([203.252.10.5]) [203.252.10.3]:34030: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)203.252.10.31835841'=  e%' ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:56:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991&<  e!) ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:56:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750Z;  -?) ossec13001i&Exim Auth failed2025-11-18 04:56:13 dovecot_login authenticator failed for ([152.52.234.4]) [152.52.231.202]:55732: 535 Incorrect authentication data (set_id=formula316)152.52.231.2021269750e:  -W' ossec13001i&Exim Auth failed2025-11-18 04:56:12 dovecot_login authenticator failed for (20.127.208.26) [20.127.208.26]:51253: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)20.127.208.266252001V9  -9' ossec13001i&Exim Auth failed2025-11-18 04:57:01 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:56958: 535 Incorrect authentication data (set_id=contato)120.157.6.147207745648  e?' ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:57:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730N7  -/% ossec13001i&zExim Auth failed2025-11-18 04:55:36 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:60419: 535 Incorrect authentication data (set_id=info)65.20.149.269923706  e7' ossec9710i&zDovecot Auth failed on disconnected session.Nov 18 04:55:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867  w ^g|MVR  -;% ossec13001i'dExim Auth failed2025-11-18 04:59:31 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:55962: 535 Incorrect authentication data (set_id=contato)125.19.156.21269750Q W' ossec9708i'dDovecot Aborted Login with empty userNov 18 04:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8N8R2NlDWOuxV3kv>177.87.121.4734690340P  e;# ossec9710i'bDovecot Auth failed on disconnected session.Nov 18 04:59:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483aO  -Q% ossec13001i'Exim Auth failed2025-11-18 05:00:06 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:51797: 535 Incorrect authentication data (set_id=eliezer)5.128.123.342017370VN  ;-% ossec13008i'Mail Recipient rejected2025-11-18 05:00:04 H=(195.3.134.135) [179.0.178.53]:53658 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:53658 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034+M  e-' ossec9710i'|Dovecot Auth failed on disconnected session.Nov 18 04:59:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084gL  -Y) ossec13001i'tExim Auth failed2025-11-18 04:59:46 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:37524: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)152.52.236.1221269750sK  -s' ossec13001i'NExim Auth failed2025-11-18 04:59:08 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:48136: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)182.156.80.111269750J  W' ossec9708i'HDovecot Aborted Login with empty userNov 18 04:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034I  k' ossec9709i'*Multiple Dovecot Aborted Logins with empty userNov 18 04:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<56GG1NlD8NOxV3kv>177.87.121.473469034(H  e#+ ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 04:58:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841bG -K+ ossec13001i&Exim Auth failed2025-11-18 04:57:23 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51811: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034$F  e) ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:57:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750(E  e%) ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 04:57:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251 q * rv\sCfMqXa  -=' ossec13001i'Exim Auth failed2025-11-18 05:01:37 dovecot_login authenticator failed for ([78.81.213.111]) [78.81.213.111]:42688: 535 Incorrect authentication data (set_id=comercial)78.81.213.1112017370`  W' ossec9708i'Dovecot Aborted Login with empty userNov 18 05:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<18AK4dlDSsuxV3kv>177.87.121.473469034Y_  -;+ ossec13001i'Exim Auth failed2025-11-18 05:01:03 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:33414: 535 Incorrect authentication data (set_id=info)154.144.255.2082542007,^  e++ ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:01:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<9QBJ3dlDorNns7yS>103.179.188.1461562822e]  -W' ossec13001i'Exim Auth failed2025-11-18 05:00:42 dovecot_login authenticator failed for ([218.156.2.230]) [218.156.2.229]:53579: 535 Incorrect authentication data (set_id=info@adlondrina.com.br)218.156.2.2291835841\ W' ossec9708i'Dovecot Aborted Login with empty userNov 18 05:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+[  e-' ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:00:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991IZ  -'! ossec13001i'Exim Auth failed2025-11-18 05:00:37 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:55832: 535 Incorrect authentication data (set_id=info)5.32.99.14290557.Y  e5% ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:00:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<1QOb29lDLIpvAEul>111.0.75.1651814991(X  e+# ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:00:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750*W  e-% ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:00:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841(V  e%) ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:00:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730aU  -M) ossec13001i'Exim Auth failed2025-11-18 05:00:12 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:58522: 535 Incorrect authentication data (set_id=info@8it.com.br)220.178.39.1061814991\T  -C) ossec13001i'Exim Auth failed2025-11-18 05:00:11 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:58713: 535 Incorrect authentication data (set_id=marialuiza)115.141.143.581835841 S  -'' ossec13001i'|Exim Auth failed2025-11-18 04:59:56 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:57115: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)179.184.33.863469034 A  )  2Amq  -k# ossec13001i(Exim Auth failed2025-11-18 05:02:09 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:46675: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)187.8.64.943469034Up  -7) ossec13001i(0Exim Auth failed2025-11-18 05:02:56 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:59532: 535 Incorrect authentication data (set_id=info)80.227.102.242290557\o  -A+ ossec13001i(.Exim Auth failed2025-11-18 05:02:54 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:58106: 535 Incorrect authentication data (set_id=contato)197.219.228.2421036973n  -' ossec13001i(,Exim Auth failed2025-11-18 05:02:52 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:55495: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)103.83.130.801269750mm  -k% ossec13001i(*Exim Auth failed2025-11-18 05:02:49 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:36232: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)77.85.43.156732800al  -Q% ossec13001i(Exim Auth failed2025-11-18 05:02:35 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:42731: 535 Incorrect authentication data (set_id=cpfnc2)111.70.32.491668284lk  -g% ossec13001i(Exim Auth failed2025-11-18 05:02:34 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@educacionalevangelico.com.br)8.243.166.663686110-j  e/) ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 05:02:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841hi  -[) ossec13001i(4Exim Auth failed2025-11-18 05:03:00 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:36654: 535 Incorrect authentication data (set_id=cpfnc2)175.156.80.1661880251,h  e++ ossec9710i($Dovecot Auth failed on disconnected session.Nov 18 05:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841g  k' ossec9709i'Multiple Dovecot Aborted Logins with empty userNov 18 05:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2Ys939lDrrGxV3kv>177.87.121.473469034ff  -[% ossec13001i'Exim Auth failed2025-11-18 05:01:26 dovecot_login authenticator failed for ([58.34.76.204]) [58.34.76.204]:54573: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)58.34.76.2041814991\e  -E' ossec13001i'Exim Auth failed2025-11-18 05:01:20 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:60420: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001gd  -[' ossec13001i'Exim Auth failed2025-11-18 05:01:53 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:33302: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)47.247.80.2271269750mc  -e) ossec13001i'Exim Auth failed2025-11-18 05:01:52 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:60654: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)121.188.248.311835841-b  e/) ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 05:01:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730 U + 2 =RS^DisNUu  -{# ossec13001i(YExim Auth failed2025-11-18 05:03:36 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:36311: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)42.200.73.31819730!  e' ossec9710i(wDovecot Auth failed on disconnected session.Nov 18 05:03:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991   -) ossec13001i(qExim Auth failed2025-11-18 05:04:00 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:38127: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)187.40.215.1623469034e~  -W' ossec13001i(]Exim Auth failed2025-11-18 05:03:37 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:65123: 535 Incorrect authentication data (set_id=postmaster)87.103.126.542264397W}  -?# ossec13001i(YExim Auth failed2025-11-18 05:03:35 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:45932: 535 Incorrect authentication data (set_id=postmaster)59.7.79.1461835841| W' ossec9708i(wDovecot Aborted Login with empty userNov 18 05:03:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0bSh5NlD+t+xV3kv>177.87.121.473469034q{  -q% ossec13001i(lExim Auth failed2025-11-18 05:03:47 dovecot_login authenticator failed for ([27.39.128.68]) [27.39.128.68]:37652: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)27.39.128.681814991{z  -+ ossec13001i(VExim Auth failed2025-11-18 05:03:28 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:49317: 535 Incorrect authentication data (set_id=cpfnc2)122.166.253.2261269750gy  -[' ossec13001i(RExim Auth failed2025-11-18 05:03:27 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:35758: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)27.24.141.1121814991qx  -q% ossec13001i(RExim Auth failed2025-11-18 05:03:27 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:36286: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)102.88.10.102328926uw  -u) ossec13001i(Exim Auth failed2025-11-18 05:02:28 dovecot_login authenticator failed for ([218.156.93.206]) [218.156.93.206]:51804: 535 Incorrect authentication data (set_id=postmaster@hosting.inovasite.com.br)218.156.93.2061835841\v  -A+ ossec13001i(Exim Auth failed2025-11-18 05:02:13 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:60297: 535 Incorrect authentication data (set_id=contato)180.104.103.1461814991ju  -a' ossec13001i(Exim Auth failed2025-11-18 05:02:09 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:51392: 535 Incorrect authentication data (set_id=eduardo)117.211.15.931269750t  -+ ossec13001i( Exim Auth failed2025-11-18 05:02:40 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:56776: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)185.183.103.1212635167s  W' ossec9708i(Dovecot Aborted Login with empty userNov 18 05:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gr -U+ ossec13001i(Exim Auth failed2025-11-18 05:02:25 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51909: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034    46HU}  - ' ossec13001i(}Exim Auth failed2025-11-18 05:04:13 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:36276: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)94.255.255.262661886h  -]' ossec13001i(Exim Auth failed2025-11-18 05:04:58 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:42160: 535 Incorrect authentication data (set_id=rafael)59.144.79.1021269750x  -}' ossec13001i(Exim Auth failed2025-11-18 05:04:33 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:57136: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)51.68.226.1713017382T  -;% ossec13001i(Exim Auth failed2025-11-18 05:04:27 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:51315: 535 Incorrect authentication data (set_id=financeiro)65.20.150.3699237o  -k' ossec13001i(Exim Auth failed2025-11-18 05:04:15 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:37892: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)38.87.177.2526252001j  -c% ossec13001i(}Exim Auth failed2025-11-18 05:04:13 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:35890: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)111.26.63.831814991`  -K) ossec13001i(}Exim Auth failed2025-11-18 05:04:12 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:42784: 535 Incorrect authentication data (set_id=isabellylisboa)121.189.198.601835841f  -[% ossec13001i(Exim Auth failed2025-11-18 05:04:38 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:49036: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)61.72.58.2421835841,  e++ ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 05:04:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001g  -[' ossec13001i(wExim Auth failed2025-11-18 05:04:07 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:39316: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)152.89.135.302017370}  - % ossec13001i(oExim Auth failed2025-11-18 05:03:59 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:45834: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)103.90.27.831643084g  -[' ossec13001i(oExim Auth failed2025-11-18 05:03:56 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:54951: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)106.0.165.2191605651o  -k' ossec13001i(GExim Auth failed2025-11-18 05:03:16 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:48562: 535 Incorrect authentication data (set_id=adriana)108.30.14.2216252001  S) ossec11000i(uLogin failed on the cpanel service.[2025-11-18 05:04:03 -0300] info [cpaneld] 183.81.184.164 - mecanicodeelite "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mecanicodeelite (has_cpuser_file failed)183.81.184.1641831722o  -k' ossec13001i(oExim Auth failed2025-11-18 05:03:59 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:33077: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)51.162.194.941733045p  -k) ossec13001i(oExim Auth failed2025-11-18 05:03:55 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:64250: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)182.79.218.1641269750 * n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    4 * z p f R H \ >   lbXNvD:0&J|rh^T@6,"xF<2 n(dZP~tj.$LB`8Vzpf \RH>4* | r h ^ T J @ 6 , "    x vlbXND:0& i+T i+p i+n i+f i+b i+b i+X i+F i+B i+" i+4 i+4 i+0 i+ i+ i+ i+F i+& i+" i+ i+ i* i+ i+ i+ i*  i* ~ i* } i+ | i* { i* z i+ y i* x i* w i* v i* u i* t i* s i* r i* q i* p i* o i* n i* m i* l i* k i* j i* i i*z h i*q g i*c f i*a e i*z d i*e c i*[ b i*Y a i* ` i*~ _ i*| ^ i*z ] i*V \ i*R [ i*N Z i*H Y i*6 X i*R W i*H V i*6 U i*( T i) S i* R i* Q i) P i) O i) N i) M i* L i* K i* J i) I i) H i) G i) F i) E i) D i) C i) B i) A i) @ i)q ? i)m > i) = i) < i) ; i)s : i)W 9 i)W 8 i)S 7 i)O 6 i)A 5 i)7 4 i)c 3 i)Q 2 i)O 1 i)E 0 i)9 / i)/ . i)% - i) , i) + i( * i)+ ) i)) ( i)# ' i) & i) % i( $ i( # i( " i( ! i( i(  i(  i(  i(  i(  i(  i(  i(  i(  i(}  i(  i(  i(  i(  i( i(  i(  i(  i( i( i(}  i(} i(} i(w  i(w i(w i(u  i(q i(o  i(o  i(o  i(o  i(l i(] i(Y  i(Y i(V i(R i(R i(G  i(4 i(0 i(. i(, i(* i($ i(  i( i( i( i( i( i( i( i( i% i% i% i% i% i% i% i% i% i% i% i% i,H i,F i,D i,B i,: i,6 i,6 i,4 i,* i,& i, i, i, i, i, i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+ i+z i+t i+t i( i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i' i'| i'| i't i'd i'd i'b i'N i'H i'* i' i& i& i& i& i& i& i& i& i&< i,N i& i& i& i& i& i& i& i& i& i& i&z i&z i&z i&v i&n i&Z i&P i&F i&< i&: i& i& i& i&  i% i% i% i% i% i% <  #C)>XuL!<a!  -M) ossec13001i(Exim Auth failed2025-11-18 05:05:13 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:38454: 535 Incorrect authentication data (set_id=andre.nascimento)160.251.121.701861060'  e%' ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 05:05:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822%  e#% ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 05:05:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991_  -I) ossec13001i(Exim Auth failed2025-11-18 05:05:44 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:38882: 535 Incorrect authentication data (set_id=ferramentaria)121.73.163.2502186224b  -O) ossec13001i(Exim Auth failed2025-11-18 05:05:30 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:46540: 535 Incorrect authentication data (set_id=andre.nascimento)218.22.237.1081814991g -U+ ossec13001i(Exim Auth failed2025-11-18 05:05:30 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52042: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034 W' ossec9708i(Dovecot Aborted Login with empty userNov 18 05:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -I% ossec13001i(Exim Auth failed2025-11-18 05:05:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55068: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758_  -I) ossec13001i(Exim Auth failed2025-11-18 05:05:14 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:58325: 535 Incorrect authentication data (set_id=ferramentaria)111.23.117.1081814991s  -u% ossec13001i(Exim Auth failed2025-11-18 05:04:19 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:44013: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)61.72.59.1061835841u  -u) ossec13001i(Exim Auth failed2025-11-18 05:04:17 dovecot_login authenticator failed for (217.pool90-160-135.dynamic.orange.es) [90.160.135.217]:45606: 535 Incorrect authentication data (set_id=administrativo1)90.160.135.2172510769o  -g+ ossec13001i(}Exim Auth failed2025-11-18 05:04:13 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:57200: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)115.247.159.1061269750  W' ossec9708i(Dovecot Aborted Login with empty userNov 18 05:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7vzH69lDrKaxV3kv>177.87.121.473469034w  -y) ossec13001i(Exim Auth failed2025-11-18 05:04:48 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:47642: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)121.171.95.1121835841\  -C) ossec13001i(Exim Auth failed2025-11-18 05:04:45 dovecot_login authenticator failed for ([218.80.238.162]) [218.80.238.162]:49044: 535 Incorrect authentication data (set_id=financeiro)218.80.238.1621814991  k' ossec9709i(Multiple Dovecot Aborted Logins with empty userNov 18 05:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 uh[NA4' ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+~qdWJ=0 1835841 1835841 1835841 1835841y 1835841V 1835841O 1835841< 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841y 1835841t 1835841o 1835841e 18358417 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841m 1835841h 1835841g 1835841^ 1835841? 18358411 1835841' 1835841% 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841w 1835841k 1835841Y 1835841. 1835841, 1835841% 1835841" 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841~ 1835841{ 1835841x 1835841w 1835841_ 1835841Z 1835841Y 1835841U 1835841C 18358412 18358410 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841~ 1835841n 1835841a 1835841P 1835841O 1835841M 1835841? 1835841< 18358410 1835841% 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841_ 1835841Q 1835841M 1835841* 1835841& 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 Z 1835841 N 1835841 B 1835841 A 1835841 > 1835841 " 1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 z 1835841 j 1835841 b 1835841 Y 1835841 P 1835841 ( 1835841  1835841  1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 g 1835841 f 1835841 B 1835841 A 1835841 0 1835841 - 1835841 , 1835841  1835841  1835841 1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 m 1835841 ` 1835841 5 1835841 . 1835841 & 1835841  1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 x 1835841 q 1835841 p 1835841 l 1835841 g 1835841 f 1835841 c 1835841 P 1835841 N 1835841 B 1835841 ( 1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 E _uP_hE0  k' ossec9709i)EMultiple Dovecot Aborted Logins with empty userNov 18 05:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s/  -u% ossec13001i)9Exim Auth failed2025-11-18 05:07:20 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:53841: 535 Incorrect authentication data (set_id=fabio.vendas)187.9.247.583469034m.  -g' ossec13001i)/Exim Auth failed2025-11-18 05:07:11 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:42048: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)120.157.6.1472077456,-  e++ ossec9710i)%Dovecot Auth failed on disconnected session.Nov 18 05:07:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001q,  -k+ ossec13001i)Exim Auth failed2025-11-18 05:06:53 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:42725: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)190.143.133.1263595528f+  -Y' ossec13001i)Exim Auth failed2025-11-18 05:06:42 dovecot_login authenticator failed for (pool-176-226-163-5.is74.ru) [176.226.163.5]:54378: 535 Incorrect authentication data (set_id=atualizacoes)176.226.163.52017370+*  e+) ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 05:06:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044*)  e)) ossec9710i)+Dovecot Auth failed on disconnected session.Nov 18 05:07:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750r(  -o) ossec13001i))Exim Auth failed2025-11-18 05:07:04 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:48952: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)121.73.169.19621862240'  e3+ ossec9710i)#Dovecot Auth failed on disconnected session.Nov 18 05:06:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<4gaS8tlDbNlns7yS>103.179.188.1461562822& W' ossec9708i) Dovecot Aborted Login with empty userNov 18 05:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k%  -a) ossec13001i)Exim Auth failed2025-11-18 05:06:30 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:38546: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.95.224.1021269750($  e'' ossec9710i(Dovecot Auth failed on disconnected session.Nov 18 05:06:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822a#  -Q% ossec13001i(Exim Auth failed2025-11-18 05:05:28 dovecot_login authenticator failed for (l5-128-93-196.novotelecom.ru) [5.128.93.196]:33014: 535 Incorrect authentication data (set_id=contato)5.128.93.1962017370|"  -) ossec13001i(Exim Auth failed2025-11-18 05:05:17 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:52522: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)151.192.57.1181880251 F ~yS9*F`>  -K) ossec13001i)mExim Auth failed2025-11-18 05:08:12 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:39151: 535 Incorrect authentication data (set_id=isabellylisboa)196.28.226.1241036973d=  -Q+ ossec13001i)Exim Auth failed2025-11-18 05:09:03 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51818: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034#<  e!# ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:08:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483; W' ossec9708i)Dovecot Aborted Login with empty userNov 18 05:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(:  e+# ossec9710i)sDovecot Auth failed on disconnected session.Nov 18 05:08:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001v9  -y' ossec13001i)WExim Auth failed2025-11-18 05:07:50 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:60704: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)125.20.253.861269750(8  e#+ ossec9710i)WDovecot Auth failed on disconnected session.Nov 18 05:07:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001U7  -;# ossec13001i)SExim Auth failed2025-11-18 05:07:46 dovecot_login authenticator failed for ([92.55.3.238]) [92.55.3.238]:49860: 535 Incorrect authentication data (set_id=fabio.vendas)92.55.3.2382017370,6  e/' ossec9710i)ODovecot Auth failed on disconnected session.Nov 18 05:07:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084k5  -c' ossec13001i)AExim Auth failed2025-11-18 05:07:29 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:47946: 535 Incorrect authentication data (set_id=financeiro)98.220.97.1886252001j4  -_) ossec13001i)7Exim Auth failed2025-11-18 05:07:18 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:63075: 535 Incorrect authentication data (set_id=sec.geral)173.25.186.13062520013  W' ossec9708i)cDovecot Aborted Login with empty userNov 18 05:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7C179tlDPOmxV3kv>177.87.121.473469034,2  e/' ossec9710i)QDovecot Auth failed on disconnected session.Nov 18 05:07:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<51tR9dlDhKJSczCz>82.115.48.1791522867(1  e'' ossec9710i)ODovecot Auth failed on disconnected session.Nov 18 05:07:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001   t Z ! * lL  -c) ossec13001i* Exim Auth failed2025-11-18 05:10:52 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:31739: 535 Incorrect authentication data (set_id=alex.vendas)75.152.225.1546251999WK  -?' ossec13001i*Exim Auth failed2025-11-18 05:10:42 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:39947: 535 Incorrect authentication data (set_id=financeiro)65.20.250.18099237nJ  -i' ossec13001i*Exim Auth failed2025-11-18 05:10:41 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:47352: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)203.190.150.41269750I  k' ossec9709i)Multiple Dovecot Aborted Logins with empty userNov 18 05:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034cH  -Y# ossec13001i)Exim Auth failed2025-11-18 05:10:07 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:46413: 535 Incorrect authentication data (set_id=administrativo1)89.67.5.135798544:G  eI) ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:09:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750bF  -U# ossec13001i)Exim Auth failed2025-11-18 05:10:03 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:56948: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)182.95.47.212697500E  e5) ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:09:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387sD  -u' ossec13001i)Exim Auth failed2025-11-18 05:09:57 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:37424: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)146.19.200.636600135C  eA' ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:09:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651B W' ossec9708i)Dovecot Aborted Login with empty userNov 18 05:09:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,A  e-) ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:09:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<2xeE+9lD/oKl0xnK>165.211.25.2022233387'@ e'% ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:09:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103-?  e3% ossec9710i)qDovecot Auth failed on disconnected session.Nov 18 05:08:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841 i1\OB5(reXK>1  r e X K > 1 $  { n a T G|obUH;.xk^QD7*tgZM@3& ! s f Y L ? 2 %  ~qdWJ=0# zm`SF9,~qdWJ=0# zm`SF9, v i \ O B 5 (    : -   w j ] P C 6 )    1562822! 15 1562822! 1562822! 1562822! 1562822!t 1562822!s 1562822!T 1562822!) 1562822 1562822 1562822 1562822 1562822 1562822 M 1562822 ' 1562822 $ 1562822 1562822 1562822 1562822 1562822 1562822h 1562822Z 1562822 1562822[ 1562822/Q 1562822. 1562822. 1562822.g 1562822- 1562822- 1562822- 1605651 1605651 1605651 ~ 1605651 1605651} 1605651x 1605651 1605651 1605651j 1605651 1605651 1605651} 1605651i 1605651] 1605651? 1605651 1605651 1605651O 1605651C 1605651 1605651 1605651 1605651D 1605651- 1605651+ 1605651 1605651r 1605651: 1605651 1605651 1605651[ 1605651* 1605651 1605651 1605651[ 1605651Z 1562822* 1562822* 1562822*U 1562822*6 1562822*2 1562822*& 1562822* 1562822* 1562822) 1562822) 1562822) 1562822)y 1562822)i 1562822) 1562822( 1562822( 1562822( 1562822( 1562822( 1562822( 1562822* 1562822( 1562822( 1562822* 1562822' 1562822' 1562822' 1562822' 1562822'm 1562822'f 1562822'b 1562822'] 1562822'T 1562822'D 1562822'2 1562822'! 1562822' 1562822* 1562822& 1562822+ 1562822+^ 1562822* 1562822& 1562822+ 1562822&l 1562822&i 1562822&] 1562822&? 1562822& 1562822& 1562822% 1562822% 1562822% 1562822% 1562822% 1562822%' 1562822%[ 1562822%4 1562822-T 1562822-# 1562822- 1562822- 1562822, 1562822, 1562822,] 1562822,P 1562822,A 1562822+ 1605651$ 1605651$; 1605651$+ 1605651$ 1605651#[ 1605651# 1605651" 1605651" 1605651"q 1605651" 1605651! 1605651! 1605651!, 1605651 1605651 1605651 C 1605651  1605651 1605651 1605651 1605651 1605651b 1605651H 1605651 1605651J 1605651D 1605651% 1605651 16056516 1605651 1605651 1605651% 1605651 1605651 1562822%. 1562822% 1562822$ 1562822$ 1562822$ 1562822$ 1562822$a 1562822$T 1562822$B 1562822$6 1562822$ 1562822# 1562822# 1562822# 1562822# 1562822#e 1562822#] 1562822#5 1562822" 1562822" 1562822" 1562822" 1562822" 1562822" 1562822"g 1562822"Q 1562822"I 1562822"E 1562822"3 1562822" 1562822" 1562822! 1562822! 1562822! 1605651y 1605651 1605651 1605651 1605651' 1605651 1605651 1605651 1605651 1605651 1605651 16056516 1605651 1605651 16056511 1605651 1605651i 1605651| 1605651` 1605651; 1605651' 1605651z 16056514 1605651 1605651 1605651 1605651D 1605651 1605651 1605651A 1605651 1605651 1605651 1605651= 1605651; 1605651 1605651 1605651 1605651X 1605651= 1605651 1605651 1605651] 16056515 1605651$ 1605651 1605651 s 1605651 1605651 1605651 1605651 G 1605651 1605651 1605651 1605651 ` 1605651 1605651 1605651  1562822!   j[  -a' ossec13001i*RExim Auth failed2025-11-18 05:12:01 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:59072: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)49.246.68.22018358410Z  e5) ossec9710i*NDovecot Auth failed on disconnected session.Nov 18 05:11:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044wY  -y) ossec13001i*HExim Auth failed2025-11-18 05:11:50 dovecot_login authenticator failed for (95.105.113.109.dynamic.o56.ru) [95.105.113.109]:57142: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)95.105.113.1092017370'X  e#) ossec9710i*6Dovecot Auth failed on disconnected session.Nov 18 05:11:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730VW  -9' ossec13001i*RExim Auth failed2025-11-18 05:12:00 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:48776: 535 Incorrect authentication data (set_id=sociais)222.120.176.61835841ZV  -A' ossec13001i*HExim Auth failed2025-11-18 05:11:51 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:52117: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001U W' ossec9708i*6Dovecot Aborted Login with empty userNov 18 05:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341T  e;% ossec9710i*(Dovecot Auth failed on disconnected session.Nov 18 05:11:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841`S  -I+ ossec13001i)Exim Auth failed2025-11-18 05:10:18 dovecot_login authenticator failed for ([220.119.153.105]) [220.119.153.105]:47654: 535 Incorrect authentication data (set_id=aureovieira)220.119.153.1051835841R  W' ossec9708i*Dovecot Aborted Login with empty userNov 18 05:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]Q  -E) ossec13001i* Exim Auth failed2025-11-18 05:10:48 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:46932: 535 Incorrect authentication data (set_id=vendas.luiz)125.154.62.2291835841cP  -U' ossec13001i)Exim Auth failed2025-11-18 05:10:30 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:61538: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795rO  -o) ossec13001i)Exim Auth failed2025-11-18 05:10:31 dovecot_login authenticator failed for ([221.159.174.17]) [221.159.174.17]:34714: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)221.159.174.171835841rN  -o) ossec13001i)Exim Auth failed2025-11-18 05:10:22 dovecot_login authenticator failed for ([220.179.87.204]) [220.179.87.204]:32927: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)220.179.87.20418149911M  e5+ ossec9710i)Dovecot Auth failed on disconnected session.Nov 18 05:10:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822  { z\j  -C) ossec13001i*Exim Auth failed2025-11-18 05:12:58 dovecot_login authenticator failed for ([197.219.210.86]) [197.219.210.86]:39086: 535 Incorrect authentication data (set_id=marialuiza)197.219.210.861036973#i  e% ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 05:13:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<8RAjCNpDeNMIiXsk>8.137.123.361814991rh  -o) ossec13001i*zExim Auth failed2025-11-18 05:12:40 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:51220: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)120.157.65.1082077456g W' ossec9708i*qDovecot Aborted Login with empty userNov 18 05:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<16iNBtpDWt2xV3kv>177.87.121.473469034gf  -Y) ossec13001i*cExim Auth failed2025-11-18 05:12:18 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:55268: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)189.108.215.393469034e  -' ossec13001i*aExim Auth failed2025-11-18 05:12:16 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:36042: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)24.97.253.2466252001nd  -g) ossec13001i*zExim Auth failed2025-11-18 05:12:41 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:60129: 535 Incorrect authentication data (set_id=marialuiza)220.246.66.2091819730_c  -I) ossec13001i*eExim Auth failed2025-11-18 05:12:21 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:37050: 535 Incorrect authentication data (set_id=jotadeschamps)222.75.179.1061814991ob  -i) ossec13001i*[Exim Auth failed2025-11-18 05:12:11 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:57276: 535 Incorrect authentication data (set_id=gerson)122.143.115.181814991}a  -) ossec13001i*YExim Auth failed2025-11-18 05:12:09 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:43533: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)178.150.135.19690791 `  -!% ossec13001i*Exim Auth failed2025-11-18 05:13:00 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:55532: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)83.221.15.7620173708_  eG' ossec9710i*~Dovecot Auth failed on disconnected session.Nov 18 05:12:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084_^  -G+ ossec13001i*|Exim Auth failed2025-11-18 05:12:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51969: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034+]  e-' ossec9710i*zDovecot Auth failed on disconnected session.Nov 18 05:12:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001&\  e%% ossec9710i*VDovecot Auth failed on disconnected session.Nov 18 05:12:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001  ! 'y  e'% ossec9710i+ Dovecot Auth failed on disconnected session.Nov 18 05:15:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370xx  -! ossec13001i*Exim Auth failed2025-11-18 05:14:50 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:30748: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)121.7.7.221880251yw  -}) ossec13001i*Exim Auth failed2025-11-18 05:13:50 dovecot_login authenticator failed for (201.173.97.119-clientes-izzi.mx) [201.173.97.119]:38653: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)201.173.97.1193996063nv  -g) ossec13001i*Exim Auth failed2025-11-18 05:13:44 dovecot_login authenticator failed for ([39.153.168.211]) [39.153.168.211]:38240: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)39.153.168.2111814991u  k' ossec9709i*Multiple Dovecot Aborted Logins with empty userNov 18 05:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ht  -[) ossec13001i*Exim Auth failed2025-11-18 05:14:00 dovecot_login authenticator failed for ([178.178.222.60]) [178.178.222.60]:39432: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)178.178.222.602017370Ts  -7' ossec13001i*Exim Auth failed2025-11-18 05:13:23 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:40804: 535 Incorrect authentication data (set_id=xavier)91.239.23.1494582580r e5' ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 05:13:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730iq  -a% ossec13001i*Exim Auth failed2025-11-18 05:13:09 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:56650: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)14.97.77.18212697500p  e7' ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 05:13:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<0IutCdpDiu1SnOdL>82.156.231.751814991$o  e' ossec9710i*Dovecot Auth failed on disconnected session.Nov 18 05:13:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001Vn  -9' ossec13001i*Exim Auth failed2025-11-18 05:13:34 dovecot_login authenticator failed for ([36.135.107.56]) [36.135.107.57]:56006: 535 Incorrect authentication data (set_id=eduardo)36.135.107.571814991m -+ ossec13001i*Exim Auth failed2025-11-18 05:13:19 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:37609: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)177.223.133.1043469034`l  -O' ossec13001i*Exim Auth failed2025-11-18 05:14:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:49350: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795k  W' ossec9708i*Dovecot Aborted Login with empty userNov 18 05:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 E  " C*8 &5+Eb  -Q) ossec13001i+Exim Auth failed2025-11-18 05:15:12 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:59562: 535 Incorrect authentication data (set_id=andre.nascimento)185.101.16.250272103l  -c) ossec13001i+FExim Auth failed2025-11-18 05:16:05 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:40297: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)150.129.47.2141269750 W' ossec9708i+&Dovecot Aborted Login with empty userNov 18 05:15:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+n1WEdpDurCxV3kv>177.87.121.473469034m  -m% ossec13001i+"Exim Auth failed2025-11-18 05:15:28 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:56978: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)65.20.130.9599237_  -G+ ossec13001i+Exim Auth failed2025-11-18 05:15:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51899: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034+  e+) ossec9710i+ Dovecot Auth failed on disconnected session.Nov 18 05:15:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<32+kD9pDiNQO4dKR>14.225.210.1451562822n  -g) ossec13001i*Exim Auth failed2025-11-18 05:14:16 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:49104: 535 Incorrect authentication data (set_id=contato)170.233.29.1573865483m  -e) ossec13001i+ Exim Auth failed2025-11-18 05:15:05 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:44286: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)50.187.155.1306252001$  e## ossec9710i+Dovecot Auth failed on disconnected session.Nov 18 05:15:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483[  -A) ossec13001i+Exim Auth failed2025-11-18 05:14:59 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:19820: 535 Incorrect authentication data (set_id=sec.geral)171.244.61.1371562822]  -E) ossec13001i*Exim Auth failed2025-11-18 05:14:36 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:44281: 535 Incorrect authentication data (set_id=aureovieira)111.23.117.1081814991Z~  -?) ossec13001i*Exim Auth failed2025-11-18 05:14:20 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:41416: 535 Incorrect authentication data (set_id=salamuni)123.209.78.1312077456Z}  -A' ossec13001i*Exim Auth failed2025-11-18 05:14:18 dovecot_login authenticator failed for ([14.212.198.51]) [14.212.198.51]:51188: 535 Incorrect authentication data (set_id=aureovieira)14.212.198.5118149911|  e5+ ossec9710i+Dovecot Auth failed on disconnected session.Nov 18 05:14:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001n{  -g) ossec13001i*Exim Auth failed2025-11-18 05:14:32 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:55621: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)210.219.232.341835841z W' ossec9708i*Dovecot Aborted Login with empty userNov 18 05:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+0a6DdpDyJmxV3kv>177.87.121.473469034 " 4 1 - JPqEh@J[{a  -Q% ossec13001i+XExim Auth failed2025-11-18 05:16:22 dovecot_login authenticator failed for (46.48.22.251-FTTB.planeta.tc) [46.48.22.251]:43184: 535 Incorrect authentication data (set_id=compras)46.48.22.2512017370\  -C) ossec13001i+TExim Auth failed2025-11-18 05:16:19 dovecot_login authenticator failed for ([112.102.48.253]) [112.102.48.253]:50647: 535 Incorrect authentication data (set_id=assessoria)112.102.48.2531814991k  -c' ossec13001i+zExim Auth failed2025-11-18 05:16:58 dovecot_login authenticator failed for host.46-183-135-88.broadband.redcom.ru [46.183.135.88]:34364: 535 Incorrect authentication data (set_id=contato)46.183.135.882017370r  -o) ossec13001i+tExim Auth failed2025-11-18 05:16:52 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:34821: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)220.179.120.261814991$  e) ossec9710i+tDovecot Auth failed on disconnected session.Nov 18 05:16:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<437YFdpDJtfSchJs>210.114.18.1081835841Y  -?' ossec13001i+pExim Auth failed2025-11-18 05:16:47 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:39076: 535 Incorrect authentication data (set_id=assessoria)65.191.211.336252001(  e#+ ossec9710i+nDovecot Auth failed on disconnected session.Nov 18 05:16:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001[  -E% ossec13001i+bExim Auth failed2025-11-18 05:16:33 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:58555: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)84.54.33.2052750405v  -u+ ossec13001i+FExim Auth failed2025-11-18 05:16:05 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:58308: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)200.107.163.1953932488_  -K) ossec13001i+BExim Auth failed2025-11-18 05:16:01 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:62474: 535 Incorrect authentication data (set_id=info)178.150.135.19690791  - ) ossec13001i+"Exim Auth failed2025-11-18 05:15:29 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:42017: 535 Incorrect authentication data (set_id=envios@comercial.art.br)203.174.182.382077456  - ' ossec13001i+4Exim Auth failed2025-11-18 05:15:47 dovecot_login authenticator failed for (11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:43211: 535 Incorrect authentication data (set_id=paulinho.vendas)125.64.209.111814991U  -7' ossec13001i+4Exim Auth failed2025-11-18 05:15:47 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:51034: 535 Incorrect authentication data (set_id=envios)95.220.47.2422017370]  -I' ossec13001i+0Exim Auth failed2025-11-18 05:15:43 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:49163: 535 Incorrect authentication data (set_id=info@8it.com.br)91.72.153.1102905570  e9% ossec9710i+ Dovecot Auth failed on disconnected session.Nov 18 05:15:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001Z  -?) ossec13001i+Exim Auth failed2025-11-18 05:15:22 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:53410: 535 Incorrect authentication data (set_id=juridico)103.251.31.1541269750 6  CP6) W' ossec9708i+Dovecot Aborted Login with empty userNov 18 05:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o(  -i) ossec13001i+Exim Auth failed2025-11-18 05:17:49 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:53833: 535 Incorrect authentication data (set_id=faturamento)220.246.42.2171819730#'  3K) ossec11301i+New FTP connection.Nov 18 05:17:49 hosting pure-ftpd: (?@167.94.138.179) [INFO] New connection from 167.94.138.179167.94.138.1796252001&  -% ossec13001i+Exim Auth failed2025-11-18 05:17:34 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:37960: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)155.4.31.2152661886% W' ossec9708i+Dovecot Aborted Login with empty userNov 18 05:17:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Wp8GNpDftexV3kv>177.87.121.473469034k$  -e% ossec13001i+Exim Auth failed2025-11-18 05:17:30 dovecot_login authenticator failed for ([58.20.76.243]) [58.20.87.113]:58097: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)58.20.87.1131814991~#  - ' ossec13001i+Exim Auth failed2025-11-18 05:18:01 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:42847: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)177.174.16.553469034z"  -) ossec13001i+Exim Auth failed2025-11-18 05:17:51 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:44235: 535 Incorrect authentication data (set_id=marcelo.pinheiro)61.245.141.2252077456d!  -Q+ ossec13001i+Exim Auth failed2025-11-18 05:17:40 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52240: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034e  -Y% ossec13001i+Exim Auth failed2025-11-18 05:17:23 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:51928: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)102.88.10.102328926\  -A+ ossec13001i+Exim Auth failed2025-11-18 05:17:22 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:43416: 535 Incorrect authentication data (set_id=contato)111.170.146.1771814991Y  -C% ossec13001i+Exim Auth failed2025-11-18 05:17:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61163: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758  -+ ossec13001i+fExim Auth failed2025-11-18 05:16:37 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:49920: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)188.234.212.1012017370  k' ossec9709i+bMultiple Dovecot Aborted Logins with empty userNov 18 05:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-  e-+ ossec9710i+Dovecot Auth failed on disconnected session.Nov 18 05:17:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991  W' ossec9708i+Dovecot Aborted Login with empty userNov 18 05:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   < a97  W' ossec9708i,4Dovecot Aborted Login with empty userNov 18 05:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903446  e?' ossec9710i,&Dovecot Auth failed on disconnected session.Nov 18 05:19:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822$5  e!' ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:19:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.13713075824  e7+ ossec9710i,6Dovecot Auth failed on disconnected session.Nov 18 05:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001o3  -k' ossec13001i,*Exim Auth failed2025-11-18 05:19:53 dovecot_login authenticator failed for ([123.163.52.74]) [123.163.52.74]:49375: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)123.163.52.7418149912  k' ossec9709i,Multiple Dovecot Aborted Logins with empty userNov 18 05:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+1  e++ ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:19:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1fNiH9pDfJTBl4nP>193.151.137.20713075820  e9) ossec9710i, Dovecot Auth failed on disconnected session.Nov 18 05:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730&/  e%% ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:19:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001Z.  -?) ossec13001i+Exim Auth failed2025-11-18 05:18:19 dovecot_login authenticator failed for ([113.137.31.134]) [113.137.31.134]:40621: 535 Incorrect authentication data (set_id=recepcao)113.137.31.1341814991S-  -3' ossec13001i+Exim Auth failed2025-11-18 05:18:10 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:42254: 535 Incorrect authentication data (set_id=info)49.246.68.2201835841h,  -[) ossec13001i+Exim Auth failed2025-11-18 05:19:05 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:43177: 535 Incorrect authentication data (set_id=comercial)179.185.29.2333469034/+  e7% ossec9710i+Dovecot Auth failed on disconnected session.Nov 18 05:19:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<5p6XHdpDtukv+wDY>47.251.0.2166252001l*  -c) ossec13001i+Exim Auth failed2025-11-18 05:18:52 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:33798: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)191.59.214.1683469034 < o=MXZhrE<F  -) ossec13001i,Exim Auth failed2025-11-18 05:21:41 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:35522: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)201.173.216.683996063)E  e') ossec9710i,dDovecot Auth failed on disconnected session.Nov 18 05:20:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044rD  -o) ossec13001i,\Exim Auth failed2025-11-18 05:20:44 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:58058: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)27.212.198.2261814991nC  -g) ossec13001i,FExim Auth failed2025-11-18 05:20:21 dovecot_login authenticator failed for ([178.70.232.110]) [178.70.232.110]:49968: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)178.70.232.1102017370zB  -# ossec13001i,DExim Auth failed2025-11-18 05:20:19 dovecot_login authenticator failed for 58x80x71x87.ap58.ftth.ucom.ne.jp [58.80.71.87]:50010: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)58.80.71.871861060qA  -m) ossec13001i,:Exim Auth failed2025-11-18 05:20:10 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:63246: 535 Incorrect authentication data (set_id=vendas.luiz)107.175.76.1466252001l@  -e' ossec13001i,lExim Auth failed2025-11-18 05:21:00 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:39934: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)218.78.112.811814991.?  e1) ossec9710i,VDovecot Auth failed on disconnected session.Nov 18 05:20:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<6LVRI9pD3IynR+bm>167.71.230.2301269750/>  e5' ossec9710i,NDovecot Auth failed on disconnected session.Nov 18 05:20:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520011=  e;' ossec9710i,HDovecot Auth failed on disconnected session.Nov 18 05:20:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758X<  -?% ossec13001i,pExim Auth failed2025-11-18 05:21:04 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:48086: 535 Incorrect authentication data (set_id=fabio.vendas)102.88.10.102328926Y;  -=) ossec13001i,TExim Auth failed2025-11-18 05:20:35 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:49739: 535 Incorrect authentication data (set_id=rodrigo)103.171.12.1701269750: W' ossec9708i,PDovecot Aborted Login with empty userNov 18 05:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690349  e# ossec9710i,BDovecot Auth failed on disconnected session.Nov 18 05:20:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.5126975028  e9) ossec9710i,6Dovecot Auth failed on disconnected session.Nov 18 05:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044  ]ai U  -%' ossec13001i,Exim Auth failed2025-11-18 05:22:18 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:53720: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)93.85.230.107630336aT  -M) ossec13001i,Exim Auth failed2025-11-18 05:22:00 dovecot_login authenticator failed for ([111.38.136.211]) [111.38.136.211]:49369: 535 Incorrect authentication data (set_id=paulinho.vendas)111.38.136.2111814991ZS  -A' ossec13001i,Exim Auth failed2025-11-18 05:21:43 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:55319: 535 Incorrect authentication data (set_id=faturamento)125.142.39.131835841WR  -9) ossec13001i,Exim Auth failed2025-11-18 05:21:36 dovecot_login authenticator failed for ([1.15.123.146]) [175.11.231.177]:58952: 535 Incorrect authentication data (set_id=contato)175.11.231.1771814991 Q  e' ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:21:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.103.53.44, lip=200.150.196.245, TLS, session=103.103.53.441269750PP  -1# ossec13001i,Exim Auth failed2025-11-18 05:21:56 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:60336: 535 Incorrect authentication data (set_id=adriana)103.50.5.941269750xO  -y+ ossec13001i,Exim Auth failed2025-11-18 05:21:42 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:50192: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)122.225.203.1061814991-N  e/) ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:21:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044M W' ossec9708i,Dovecot Aborted Login with empty userNov 18 05:21:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.L  e1) ossec9710i,|Dovecot Auth failed on disconnected session.Nov 18 05:21:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841kK  -e% ossec13001i,vExim Auth failed2025-11-18 05:21:09 dovecot_login authenticator failed for ([111.26.63.89]) [111.26.63.89]:36552: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)111.26.63.8918149910J  e5) ossec9710i,tDovecot Auth failed on disconnected session.Nov 18 05:21:06 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.211.21.213, lip=200.150.196.245, TLS, session=<002rI9pDWd5n0xXV>103.211.21.2131269750kI  -a) ossec13001i,Exim Auth failed2025-11-18 05:21:58 dovecot_login authenticator failed for ([176.118.17.101]) [176.118.17.101]:46794: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)176.118.17.1012017370]H -C) ossec13001i,Exim Auth failed2025-11-18 05:21:53 dovecot_login authenticator failed for (User) [177.74.174.120]:62446: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)177.74.174.1203469034/G  e3) ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:21:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<37aCJ9pDutqKxX03>138.197.125.556252001   7 d  -) ossec13001i,Exim Auth failed2025-11-18 05:22:35 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:40078: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)122.186.202.101269750c  W' ossec9708i,Dovecot Aborted Login with empty userNov 18 05:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lb  -c) ossec13001i,Exim Auth failed2025-11-18 05:22:50 dovecot_login authenticator failed for ([118.69.133.140]) [118.69.133.140]:50264: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)118.69.133.1401562822Va  -;% ossec13001i,Exim Auth failed2025-11-18 05:22:46 dovecot_login authenticator failed for ([58.211.39.86]) [58.211.39.86]:55955: 535 Incorrect authentication data (set_id=financeiro)58.211.39.861814991-`  e/) ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:22:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750&_  e!) ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:22:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044U^  -7' ossec13001i,Exim Auth failed2025-11-18 05:22:10 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:52266: 535 Incorrect authentication data (set_id=cpanel)178.68.91.1192017370|]  -) ossec13001i,Exim Auth failed2025-11-18 05:23:03 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:57891: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)124.170.26.1692077456-\  e/) ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:23:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730[  - + ossec13001i,Exim Auth failed2025-11-18 05:22:29 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:47404: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)165.220.169.11326351676Z  eC' ossec9710i,Dovecot Auth failed on disconnected session.Nov 18 05:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<0b9jKdpDqJmkXF7M>164.92.94.2046252001]Y -C) ossec13001i,Exim Auth failed2025-11-18 05:22:09 dovecot_login authenticator failed for (User) [177.74.174.120]:62446: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)177.74.174.1203469034XX  -E! ossec13001i,Exim Auth failed2025-11-18 05:22:56 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:47391: 535 Incorrect authentication data (set_id=contato)89.67.37.2798544eW  -S+ ossec13001i,Exim Auth failed2025-11-18 05:22:38 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53426: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651V  k' ossec9709i,Multiple Dovecot Aborted Logins with empty userNov 18 05:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 ` ) ; N r |*kz`s W' ossec9708i-@Dovecot Aborted Login with empty userNov 18 05:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034mr  -e) ossec13001i-8Exim Auth failed2025-11-18 05:24:24 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:56919: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)167.250.118.533865483.q  e5% ossec9710i-bDovecot Auth failed on disconnected session.Nov 18 05:25:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<7BxaM9pDjppAF/Qn>64.23.244.3962520014p  e;+ ossec9710i-LDovecot Auth failed on disconnected session.Nov 18 05:24:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628226o  eA) ossec9710i-*Dovecot Auth failed on disconnected session.Nov 18 05:24:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<+Ln/L9pDGu2l0xnK>165.211.25.2022233387n  -9) ossec13001i,Exim Auth failed2025-11-18 05:23:17 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:46974: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)125.23.155.1101269750Nm  ;' ossec13008i-Mail Recipient rejected2025-11-18 05:23:35 H=(localhost) [179.0.178.104]:60329 F= rejected RCPT : "JunkMail rejected - (localhost) [179.0.178.104]:60329 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.104"179.0.178.1043469034l W' ossec9708i-Dovecot Aborted Login with empty userNov 18 05:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ik  -_' ossec13001i-Exim Auth failed2025-11-18 05:23:27 dovecot_login authenticator failed for ([178.35.150.58]) [178.35.150.58]:53956: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)178.35.150.582017370kj  -g% ossec13001i,Exim Auth failed2025-11-18 05:23:07 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:55736: 535 Incorrect authentication data (set_id=isabellylisboa)78.186.54.65298795Xi  -;) ossec13001i-Exim Auth failed2025-11-18 05:23:49 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:55082: 535 Incorrect authentication data (set_id=rafael)182.95.176.1301269750ih  -a% ossec13001i-Exim Auth failed2025-11-18 05:23:31 dovecot_login authenticator failed for broadband-37-110-40-20.ip.moscow.rt.ru [37.110.40.20]:58520: 535 Incorrect authentication data (set_id=adriana)37.110.40.202017370jg  -_) ossec13001i-Exim Auth failed2025-11-18 05:23:30 dovecot_login authenticator failed for 110-25-105-161.adsl.fetnet.net [110.25.105.161]:55822: 535 Incorrect authentication data (set_id=atualizacoes)110.25.105.1611668284\f  -C) ossec13001i-Exim Auth failed2025-11-18 05:23:29 dovecot_login authenticator failed for ([123.127.231.74]) [123.127.231.74]:54643: 535 Incorrect authentication data (set_id=financeiro)123.127.231.741814991se  -u% ossec13001i,Exim Auth failed2025-11-18 05:22:55 dovecot_login authenticator failed for ([183.94.220.9]) [183.94.220.9]:58694: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)183.94.220.91814991 w& vcIgwl  -c) ossec13001i-Exim Auth failed2025-11-18 05:26:16 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:43239: 535 Incorrect authentication data (set_id=atualizacoes)136.53.199.1606252001^  -I' ossec13001i-Exim Auth failed2025-11-18 05:27:02 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:36416: 535 Incorrect authentication data (set_id=recepcao)51.68.226.1713017382 W' ossec9708i-Dovecot Aborted Login with empty userNov 18 05:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690347  eA+ ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:26:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001n~  -k% ossec13001i-Exim Auth failed2025-11-18 05:26:07 dovecot_login authenticator failed for ([83.239.0.202]) [83.239.0.202]:55720: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)83.239.0.2022017370b}  -O) ossec13001i-Exim Auth failed2025-11-18 05:26:37 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:59056: 535 Incorrect authentication data (set_id=paulinho.vendas)182.95.222.2021269750|  k' ossec9709i-|Multiple Dovecot Aborted Logins with empty userNov 18 05:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&{  e!) ossec9710i-dDovecot Auth failed on disconnected session.Nov 18 05:25:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387oz  -g+ ossec13001i-Exim Auth failed2025-11-18 05:26:04 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:46581: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)115.144.115.1501835841y  W' ossec9708i-Dovecot Aborted Login with empty userNov 18 05:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1tTfNtpDeLKxV3kv>177.87.121.473469034x  -) ossec13001i-Exim Auth failed2025-11-18 05:26:02 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:34555: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)187.161.136.183996063$w  e## ossec9710i-`Dovecot Auth failed on disconnected session.Nov 18 05:25:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750lv  -a+ ossec13001i-TExim Auth failed2025-11-18 05:24:51 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59935: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.23116056513u e9) ossec9710i-TDovecot Auth failed on disconnected session.Nov 18 05:24:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044Vt  -9' ossec13001i-HExim Auth failed2025-11-18 05:24:39 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:38434: 535 Incorrect authentication data (set_id=contato)152.52.244.461269750  q sr_  -G+ ossec13001i-Exim Auth failed2025-11-18 05:27:33 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:56507: 535 Incorrect authentication data (set_id=financeiro)116.199.171.2461269750 W' ossec9708i-Dovecot Aborted Login with empty userNov 18 05:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T -3' ossec13001i-Exim Auth failed2025-11-18 05:27:22 dovecot_login authenticator failed for (conut.org.br) [112.122.54.54]:34045: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991.  e5% ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:27:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841Q  -3# ossec13001i.Exim Auth failed2025-11-18 05:28:04 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:55730: 535 Incorrect authentication data (set_id=bruno)182.95.47.21269750p  -q# ossec13001i.Exim Auth failed2025-11-18 05:27:58 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:41950: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)103.50.5.941269750r  -q' ossec13001i.Exim Auth failed2025-11-18 05:27:44 dovecot_login authenticator failed for ([116.230.66.81]) [116.233.6.238]:60064: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)116.233.6.2381814991b  -O) ossec13001i-Exim Auth failed2025-11-18 05:26:21 dovecot_login authenticator failed for ([109.63.237.243]) [109.63.237.243]:52628: 535 Incorrect authentication data (set_id=rsimoesdiretoria)109.63.237.2432017370}  -) ossec13001i-Exim Auth failed2025-11-18 05:26:48 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:36746: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)213.33.204.1302017370)  e') ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:26:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=170.64.193.1042077456\  -I% ossec13001i-Exim Auth failed2025-11-18 05:26:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49739: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758m  -g' ossec13001i-Exim Auth failed2025-11-18 05:27:02 dovecot_login authenticator failed for ([111.14.218.26]) [111.14.218.26]:57983: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)111.14.218.2618149910  e5) ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:27:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730.  e1) ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:26:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<5Rg6OdpD5oikXLll>164.92.185.1012921044%  e%# ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:26:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001  v O Q>%D!7y  -}) ossec13001i.YExim Auth failed2025-11-18 05:29:12 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:49658: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)195.159.217.713144096(  e'' ossec9710i."Dovecot Auth failed on disconnected session.Nov 18 05:28:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<1PjdPtpDwrKkXF7M>164.92.94.20462520013  e?% ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 05:28:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<6e4nPtpD+s0zTY0d>51.77.141.293017382f  -[' ossec13001i.?Exim Auth failed2025-11-18 05:28:46 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:39586: 535 Incorrect authentication data (set_id=isabellylisboa)85.29.246.199453733  k' ossec9709i.0Multiple Dovecot Aborted Logins with empty userNov 18 05:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034] -A+ ossec13001i.Exim Auth failed2025-11-18 05:28:08 dovecot_login authenticator failed for (89fmjoinville.com) [111.122.211.212]:19756: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991  W' ossec9708i.QDovecot Aborted Login with empty userNov 18 05:29:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  S) ossec11000i.ILogin failed on the cpanel service.[2025-11-18 05:28:55 -0300] info [cpaneld] 185.213.83.155 - adportobelo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adportobelo (has_cpuser_file failed)185.213.83.1551643084z  -) ossec13001i.AExim Auth failed2025-11-18 05:28:48 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:55786: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)91.102.231.1906290252#  e+ ossec9710i.:Dovecot Auth failed on disconnected session.Nov 18 05:28:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758"  e% ossec9710i.:Dovecot Auth failed on disconnected session.Nov 18 05:28:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060+  e+) ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:27:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001{  -' ossec13001i.Exim Auth failed2025-11-18 05:28:06 dovecot_plain authenticator failed for (4g4wp07bjofvn1w93bukitsp6v2rd5n) [147.75.34.103]:45567: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)147.75.34.10327504052  e7+ ossec9710i-Dovecot Auth failed on disconnected session.Nov 18 05:27:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<7oSHPNpDgrmElIx5>132.148.140.1216252001 #   ' !s}V.  -7) ossec13001i.Exim Auth failed2025-11-18 05:31:17 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:52220: 535 Incorrect authentication data (set_id=info)221.199.172.661814991r-  -o) ossec13001i.Exim Auth failed2025-11-18 05:31:08 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:59910: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)125.23.203.11412697505,  eA' ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 05:32:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651s+  -q) ossec13001i.Exim Auth failed2025-11-18 05:30:31 dovecot_login authenticator failed for ([188.231.51.202]) [188.231.51.202]:33102: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)188.231.51.2023017382* W' ossec9708i.Dovecot Aborted Login with empty userNov 18 05:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.)  e3' ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 05:30:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<8FnRRtpDKookMrBu>36.50.176.1101562822w(  -y) ossec13001i.Exim Auth failed2025-11-18 05:30:27 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:49010: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)195.222.57.19032776053'  e=' ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 05:31:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001&  -) ossec13001i.Exim Auth failed2025-11-18 05:31:02 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:54384: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)175.180.129.871668284f%  -U+ ossec13001i.Exim Auth failed2025-11-18 05:30:55 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51522: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034U$  -7' ossec13001i.Exim Auth failed2025-11-18 05:30:51 dovecot_login authenticator failed for ([89.188.123.61]) [89.188.123.61]:49606: 535 Incorrect authentication data (set_id=cpfnc2)89.188.123.6120173700#  e7' ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 05:30:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001g"  -]% ossec13001i.mExim Auth failed2025-11-18 05:29:31 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:39724: 535 Incorrect authentication data (set_id=eliezer)155.4.31.2152661886! W' ossec9708i.mDovecot Aborted Login with empty userNov 18 05:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001i.eExim Auth failed2025-11-18 05:29:23 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:49826: 535 Incorrect authentication data (set_id=leandro)118.36.234.1561835841   +e=  -U+ ossec13001i/GExim Auth failed2025-11-18 05:33:10 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:56219: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795Y<  -=) ossec13001i/9Exim Auth failed2025-11-18 05:32:56 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:40950: 535 Incorrect authentication data (set_id=contato)128.185.253.981269750 ;  -'' ossec13001i/5Exim Auth failed2025-11-18 05:32:51 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:38083: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)201.61.40.1173469034}:  -' ossec13001i/!Exim Auth failed2025-11-18 05:32:33 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:51688: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)187.218.57.5039960639 W' ossec9708i/!Dovecot Aborted Login with empty userNov 18 05:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.8  e1) ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 05:32:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750j7  -a' ossec13001i/CExim Auth failed2025-11-18 05:33:06 dovecot_login authenticator failed for ([182.239.80.71]) [182.239.80.71]:40574: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)182.239.80.711819730n6  -i' ossec13001i.Exim Auth failed2025-11-18 05:31:23 dovecot_login authenticator failed for ([223.75.156.89]) [223.75.156.89]:31386: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)223.75.156.891814991a5  -M) ossec13001i.Exim Auth failed2025-11-18 05:31:23 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:48108: 535 Incorrect authentication data (set_id=administrativo1)128.185.253.981269750'4  e#) ossec9710i.Dovecot Auth failed on disconnected session.Nov 18 05:31:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841^3  -I' ossec13001i.Exim Auth failed2025-11-18 05:31:07 dovecot_login authenticator failed for ([219.248.4.146]) [219.248.4.146]:53874: 535 Incorrect authentication data (set_id=administrativo1)219.248.4.1461835841i2  -_' ossec13001i.Exim Auth failed2025-11-18 05:31:34 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:46993: 535 Incorrect authentication data (set_id=alex.vendas)189.218.82.1439960631  k' ossec9709i.Multiple Dovecot Aborted Logins with empty userNov 18 05:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V0  -;% ossec13001i.Exim Auth failed2025-11-18 05:31:29 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:47438: 535 Incorrect authentication data (set_id=financeiro)144.24.107.11269750/  W' ossec9708i/Dovecot Aborted Login with empty userNov 18 05:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H * >  4 lvND:0bX&^hTJ@|6,r"ZxnPF<2d( j`V~tB8.$Lf\zp | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& i2B! i2! i2P! i2H! i2:! i2.! i2.! i2J! i28! i2$! i2N! i2:! i26! i2,! i2$! i2! i2! i1! i1! i2! i1! i1! i1! i1! i2! i1! i1! i1! i1! i1! i1! i1! i1y! i1! i1! i1! i1! i1! i1}! i1=! i13! i1-! i1)! i1Y! i1E! i1A! i1!! i1! i1! i1! i1! i0! i1!! i1! i1! i1! i0! i1! i1 ! i0! i0! i0! i0! i0!~ i0!} i0!| i0!{ i0!z i0!y i0!x i0u!w i0!v i0!u i0!t i0!s i0!r i0!q i0u!p i0!o i0!n i0!m i0!l i0a!k i0Q!j i0A!i i0A!h i0A!g i0k!f i0k!e i0Q!d i0M!c i0K!b i0C!a i0[!` i0U!_ i0M!^ i0K!] i0E!\ i0![ i0!Z i0 !Y i0!X i01!W i0)!V i/!U i/!T i/!S i/!R i/!Q i/!P i/!O i/!N i/!M i/!L i/!K i/!J i/!I i/!H i/!G i/{!F i/s!E i/_!D i/]!C i/O!B i/u!A i/]!@ i/O!? i/M!> i/G!= i/C!7 i/9!< i/5!; i/!!: i/!!9 i/!8 i/!, i/!/ i.!2 i.!1 i.!0 i.!6 i.!5 i.!4 i.!. i.!3 i.!- i.!& i.!' i.!% i.!$ i.!+ i.!* i.!) i.!( i.!# i.m!" i.m!! i.e! i.Y! i.Q! i.I! i.A! i.?! i.:! i.:! i.0! i."! i.! i.! i.! i3Z! i3B! i3, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^K  -E+ ossec13001i/Exim Auth failed2025-11-18 05:35:01 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:41414: 535 Incorrect authentication data (set_id=sec.geral)128.185.227.1421269750\J  -G% ossec13001i/Exim Auth failed2025-11-18 05:34:39 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:25309: 535 Incorrect authentication data (set_id=eliezer)116.94.0.1591861060I  k' ossec9709i/Multiple Dovecot Aborted Logins with empty userNov 18 05:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034VH  -9' ossec13001i/Exim Auth failed2025-11-18 05:34:14 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:34060: 535 Incorrect authentication data (set_id=eliezer)124.246.98.761880251/G  e1+ ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 05:34:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<0fuIU9pDFuF9gnHM>125.130.113.2041835841bF  -O) ossec13001i/{Exim Auth failed2025-11-18 05:34:01 dovecot_login authenticator failed for ([221.234.10.211]) [221.234.10.211]:39590: 535 Incorrect authentication data (set_id=andre.nascimento)221.234.10.2111814991)E  e-# ossec9710i/sDovecot Auth failed on disconnected session.Nov 18 05:33:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001_D  -K' ossec13001i/_Exim Auth failed2025-11-18 05:33:34 dovecot_login authenticator failed for ([161.81.253.47]) [161.81.253.47]:56148: 535 Incorrect authentication data (set_id=andre.nascimento)161.81.253.471819730C W' ossec9708i/]Dovecot Aborted Login with empty userNov 18 05:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/B  e3+ ossec9710i/ODovecot Auth failed on disconnected session.Nov 18 05:33:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758dA  -U' ossec13001i/uExim Auth failed2025-11-18 05:33:56 dovecot_login authenticator failed for ([222.99.52.202]) [222.99.52.202]:47624: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)222.99.52.2021835841)@  e)' ossec9710i/]Dovecot Auth failed on disconnected session.Nov 18 05:33:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<5Sp/UdpDYtY7GIXF>59.24.133.1971835841Y?  -=) ossec13001i/OExim Auth failed2025-11-18 05:33:18 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:37839: 535 Incorrect authentication data (set_id=eduardo)46.212.127.1283144096>  -' ossec13001i/MExim Auth failed2025-11-18 05:33:16 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:51445: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)202.82.20.2411819730  [  -+ ossec13001i0Exim Auth failed2025-11-18 05:36:40 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:42135: 535 Incorrect authentication data (set_id=fabio.vendas)122.162.240.1491269750Z W' ossec9708i0Dovecot Aborted Login with empty userNov 18 05:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iY  -c# ossec13001i0 Exim Auth failed2025-11-18 05:36:29 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:52586: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)8.209.221.71861060fX  -W) ossec13001i0Exim Auth failed2025-11-18 05:36:22 dovecot_login authenticator failed for (95.105.113.109.dynamic.o56.ru) [95.105.113.109]:48988: 535 Incorrect authentication data (set_id=contato)95.105.113.10920173704W  e=) ossec9710i01Dovecot Auth failed on disconnected session.Nov 18 05:37:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<7uwwXtpDDqN2wSaf>118.193.38.1591819730aV  -O' ossec13001i0)Exim Auth failed2025-11-18 05:36:56 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:36327: 535 Incorrect authentication data (set_id=info@ilumix.com.br)182.42.113.101814991!U  e# ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 05:35:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001*T  e'+ ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 05:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822aS  -O' ossec13001i/Exim Auth failed2025-11-18 05:35:59 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62111: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730lR  -g% ossec13001i/Exim Auth failed2025-11-18 05:35:51 dovecot_login authenticator failed for (3.inet153.multi-net.ru) [89.105.153.3]:35346: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)89.105.153.32017370Q W' ossec9708i/Dovecot Aborted Login with empty userNov 18 05:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dP  -U' ossec13001i/Exim Auth failed2025-11-18 05:35:24 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:57601: 535 Incorrect authentication data (set_id=xavier)111.70.23.2411668284-O  e1' ossec9710i/Dovecot Auth failed on disconnected session.Nov 18 05:35:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867xN  -y+ ossec13001i/Exim Auth failed2025-11-18 05:34:11 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:9219: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)182.163.122.1331210997gM  -_# ossec13001i/Exim Auth failed2025-11-18 05:35:03 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:29613: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)61.37.150.61835841 p  Y.81NpZj  -=+ ossec13001i0QExim Auth failed2025-11-18 05:37:36 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:35951: 535 Incorrect authentication data (set_id=sbfin)123.129.196.1181814991_i  -G+ ossec13001i0AExim Auth failed2025-11-18 05:37:21 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51708: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034Ph  -/% ossec13001i0AExim Auth failed2025-11-18 05:37:20 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:40288: 535 Incorrect authentication data (set_id=info)111.63.42.761814991/g  e3) ossec9710i0ADovecot Auth failed on disconnected session.Nov 18 05:37:19 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.61.175.118, lip=200.150.196.245, TLS, session=<5XDhXdpDXktvPa92>111.61.175.1181814991Yf  -C% ossec13001i0kExim Auth failed2025-11-18 05:38:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49653: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758e  W' ossec9708i0kDovecot Aborted Login with empty userNov 18 05:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0wDHYdpDBuKxV3kv>177.87.121.473469034'd  e#) ossec9710i0QDovecot Auth failed on disconnected session.Nov 18 05:37:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.25418802511c  e9' ossec9710i0MDovecot Auth failed on disconnected session.Nov 18 05:37:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730"b  e% ossec9710i0KDovecot Auth failed on disconnected session.Nov 18 05:37:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<0Te1X9pDvpEvT1jH>47.79.88.1991861060,a  e++ ossec9710i0CDovecot Auth failed on disconnected session.Nov 18 05:37:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841!`  e) ossec9710i0[Dovecot Auth failed on disconnected session.Nov 18 05:37:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.61.177.188, lip=200.150.196.245, TLS, session=111.61.177.1881814991]_  -G) ossec13001i0UExim Auth failed2025-11-18 05:37:40 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:56106: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549^  k' ossec9709i0MMultiple Dovecot Aborted Logins with empty userNov 18 05:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x]  -}' ossec13001i0KExim Auth failed2025-11-18 05:37:31 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:50328: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)82.65.140.2183017382s\  -o+ ossec13001i0EExim Auth failed2025-11-18 05:37:24 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:39392: 535 Incorrect authentication data (set_id=sbfin@radiolouvoreterno.com.br)180.168.100.2301814991 ' 0y  e;# ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483nx  -e+ ossec13001i0Exim Auth failed2025-11-18 05:39:09 dovecot_login authenticator failed for ([124.114.149.106]) [124.114.149.106]:55285: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)124.114.149.1061814991 w  -!) ossec13001i0uExim Auth failed2025-11-18 05:38:13 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:51077: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)122.160.50.1551269750Vv  -7) ossec13001i0Exim Auth failed2025-11-18 05:39:00 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:39872: 535 Incorrect authentication data (set_id=info)220.80.223.1441835841eu  -S+ ossec13001i0Exim Auth failed2025-11-18 05:38:49 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:58130: 535 Incorrect authentication data (set_id=marcelo.pinheiro)121.178.185.1411835841.t  e/+ ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:38:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<6I93ZNpDdPJxoZB3>113.161.144.1191562822Ts  -7% ossec13001i0Exim Auth failed2025-11-18 05:38:36 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:53676: 535 Incorrect authentication data (set_id=contato)115.77.111.21562822r W' ossec9708i0Dovecot Aborted Login with empty userNov 18 05:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  -%+ ossec13001i0Exim Auth failed2025-11-18 05:38:30 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:44536: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)122.187.227.1641269750xp -y) ossec13001i0uExim Auth failed2025-11-18 05:38:13 dovecot_plain authenticator failed for ([10.181.195.229]) [170.39.216.210]:52024: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)170.39.216.2103017382lo  -e) ossec13001i0Exim Auth failed2025-11-18 05:38:25 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:54764: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)196.188.187.21337996)n  e+% ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:38:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<38q9ZNpDALt3xBIC>119.196.18.21835841jm  -_) ossec13001i0Exim Auth failed2025-11-18 05:38:40 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:55142: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)14.139.107.1461269750)l  e') ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:38:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750Uk  -7' ossec13001i0aExim Auth failed2025-11-18 05:37:52 dovecot_login authenticator failed for ([178.35.150.58]) [178.35.150.58]:52072: 535 Incorrect authentication data (set_id=xavier)178.35.150.582017370   /  e7% ossec9710i1Dovecot Auth failed on disconnected session.Nov 18 05:40:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841\  -A+ ossec13001i1Exim Auth failed2025-11-18 05:40:34 dovecot_login authenticator failed for ([218.149.228.148]) [218.149.228.148]:54420: 535 Incorrect authentication data (set_id=adriana)218.149.228.1481835841  k' ossec9709i1Multiple Dovecot Aborted Logins with empty userNov 18 05:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p  -k+ ossec13001i0Exim Auth failed2025-11-18 05:40:11 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12145: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)195.142.106.177298795d  -Q+ ossec13001i1Exim Auth failed2025-11-18 05:40:50 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52127: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034l  -g% ossec13001i1 Exim Auth failed2025-11-18 05:40:42 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:59673: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)217.33.89.472635167v  -y' ossec13001i0Exim Auth failed2025-11-18 05:40:23 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:59594: 535 Incorrect authentication data (set_id=contato)92.255.190.692017370'  e%' ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:40:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9E3TadpDpuxn9M4G>103.244.206.61643084d  -W% ossec13001i0Exim Auth failed2025-11-18 05:39:31 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:44191: 535 Incorrect authentication data (set_id=envios)75.64.207.526252001i  -_' ossec13001i0Exim Auth failed2025-11-18 05:39:21 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:42721: 535 Incorrect authentication data (set_id=aureovieira)77.94.125.2502017370+~  e)+ ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:39:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841'}  e%' ossec9710i0Dovecot Auth failed on disconnected session.Nov 18 05:39:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991U|  -7' ossec13001i0Exim Auth failed2025-11-18 05:39:32 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:58903: 535 Incorrect authentication data (set_id=cpanel)112.27.30.2531814991{ W' ossec9708i0Dovecot Aborted Login with empty userNov 18 05:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034wz  -y) ossec13001i0Exim Auth failed2025-11-18 05:39:17 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:9256: 535 Incorrect authentication data (set_id=envios@comercial.art.br)75.152.225.1546251999 .  h27]1.e  -Y% ossec13001i1}Exim Auth failed2025-11-18 05:42:36 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:41206: 535 Incorrect authentication data (set_id=info@89fmjoinville.com.br)1.212.225.991835841 W' ossec9708i1=Dovecot Aborted Login with empty userNov 18 05:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4bhEbtpDhMWxV3kv>177.87.121.473469034(  e+# ossec9710i13Dovecot Auth failed on disconnected session.Nov 18 05:41:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<3DmSbdpD6saUcQQF>148.113.4.51269750V  -7) ossec13001i1-Exim Auth failed2025-11-18 05:41:17 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:51546: 535 Incorrect authentication data (set_id=info)116.114.94.2421814991w  -{' ossec13001i1)Exim Auth failed2025-11-18 05:41:13 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:35568: 535 Incorrect authentication data (set_id=ieqcampocomprido)125.20.251.6612697502  e=% ossec9710i1YDovecot Auth failed on disconnected session.Nov 18 05:42:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991+  e)+ ossec9710i1EDovecot Auth failed on disconnected session.Nov 18 05:41:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822'  e#) ossec9710i1ADovecot Auth failed on disconnected session.Nov 18 05:41:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044{  -) ossec13001i1!Exim Auth failed2025-11-18 05:41:05 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:56022: 535 Incorrect authentication data (set_id=info@ilumix.com.br)122.143.115.181814991  W' ossec9708i1Dovecot Aborted Login with empty userNov 18 05:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e%) ossec9710i1Dovecot Auth failed on disconnected session.Nov 18 05:40:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730g  -]% ossec13001i1Exim Auth failed2025-11-18 05:40:58 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:47766: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)61.72.58.2421835841Y  -A% ossec13001i1Exim Auth failed2025-11-18 05:40:57 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:51628: 535 Incorrect authentication data (set_id=fabio.vendas)115.77.111.21562822  -+ ossec13001i0Exim Auth failed2025-11-18 05:40:15 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:51272: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)175.100.107.2381831722$  e) ossec9710i1!Dovecot Auth failed on disconnected session.Nov 18 05:41:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750   (  - BY' W' ossec9708i1Dovecot Aborted Login with empty userNov 18 05:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l&  -a+ ossec13001i1Exim Auth failed2025-11-18 05:44:22 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:11317: 535 Incorrect authentication data (set_id=envios@comercial.art.br)171.244.140.1341562822#%  3K) ossec11301i2New FTP connection.Nov 18 05:45:07 hosting pure-ftpd: (?@195.184.76.239) [INFO] New connection from 195.184.76.239195.184.76.2396252001e$  -W' ossec13001i1Exim Auth failed2025-11-18 05:43:20 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:55385: 535 Incorrect authentication data (set_id=compras)201.172.88.853996063Y#  -;+ ossec13001i1Exim Auth failed2025-11-18 05:43:11 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:47898: 535 Incorrect authentication data (set_id=info)125.139.124.1201835841`"  -M' ossec13001i1Exim Auth failed2025-11-18 05:43:08 dovecot_login authenticator failed for ([211.185.14.75]) [211.185.14.75]:36774: 535 Incorrect authentication data (set_id=secretarioadjunto)211.185.14.751835841!  W' ossec9708i1Dovecot Aborted Login with empty userNov 18 05:44:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -_) ossec13001i1Exim Auth failed2025-11-18 05:43:55 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:33076: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)152.52.246.1781269750  k' ossec9709i1Multiple Dovecot Aborted Logins with empty userNov 18 05:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -E) ossec13001i1Exim Auth failed2025-11-18 05:43:28 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:33494: 535 Incorrect authentication data (set_id=aureovieira)121.73.168.2342186224 W' ossec9708i1yDovecot Aborted Login with empty userNov 18 05:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  -g' ossec13001i1Exim Auth failed2025-11-18 05:42:57 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:54026: 535 Incorrect authentication data (set_id=info@ieq.com.br)24.119.144.866252001S  -3' ossec13001i1Exim Auth failed2025-11-18 05:42:56 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:50576: 535 Incorrect authentication data (set_id=info)222.76.248.541814991g  -_# ossec13001i1Exim Auth failed2025-11-18 05:42:52 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:42664: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)14.6.16.1371835841/  e5' ossec9710i1Dovecot Auth failed on disconnected session.Nov 18 05:42:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991n  -i) ossec13001i1Exim Auth failed2025-11-18 05:42:45 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:46624: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)80.227.138.214290557 9 J b v M 0/7  e1+ ossec9710i2.Dovecot Auth failed on disconnected session.Nov 18 05:45:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001e6  -S+ ossec13001i2JExim Auth failed2025-11-18 05:46:01 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:47858: 535 Incorrect authentication data (set_id=ieqcampocomprido)141.148.165.2306252001c5  -W# ossec13001i28Exim Auth failed2025-11-18 05:45:43 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:46979: 535 Incorrect authentication data (set_id=toro@toromartelinho.com.br)36.39.140.21835841j4  -a' ossec13001i2$Exim Auth failed2025-11-18 05:45:23 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:40043: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)38.43.103.2433469034a3  -U! ossec13001i2NExim Auth failed2025-11-18 05:46:04 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:44506: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)14.33.96.31835841_2  -K' ossec13001i2:Exim Auth failed2025-11-18 05:45:45 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:34822: 535 Incorrect authentication data (set_id=ieqcampocomprido)120.157.6.1472077456Z1  -A' ossec13001i26Exim Auth failed2025-11-18 05:45:40 dovecot_login authenticator failed for ([36.135.107.57]) [36.135.107.57]:39126: 535 Incorrect authentication data (set_id=presidencia)36.135.107.571814991$0  e!' ossec9710i2,Dovecot Auth failed on disconnected session.Nov 18 05:45:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758l/  -g' ossec13001i2$Exim Auth failed2025-11-18 05:45:23 dovecot_login authenticator failed for ([41.59.200.166]) [41.59.200.166]:43783: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)41.59.200.166149590.  3C% ossec11301i2New FTP connection.Nov 18 05:45:08 hosting pure-ftpd: (?@195.184.76.9) [INFO] New connection from 195.184.76.9195.184.76.96252001%-  e!' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:44:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991h,  -[) ossec13001i1Exim Auth failed2025-11-18 05:44:09 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:51074: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)103.251.31.1661269750d+  -W% ossec13001i1Exim Auth failed2025-11-18 05:44:09 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:46628: 535 Incorrect authentication data (set_id=rene)182.76.71.821269750k*  -c' ossec13001i2Exim Auth failed2025-11-18 05:45:02 dovecot_login authenticator failed for ([218.22.187.69]) [218.22.187.66]:51594: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)218.22.187.661814991X)  -=' ossec13001i1Exim Auth failed2025-11-18 05:44:44 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:30997: 535 Incorrect authentication data (set_id=novamanha)211.97.119.871814991g(  -Y) ossec13001i1Exim Auth failed2025-11-18 05:44:35 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:46115: 535 Incorrect authentication data (set_id=envios)187.161.136.183996063  dvnYF  -=) ossec13001i2ZExim Auth failed2025-11-18 05:46:16 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:50222: 535 Incorrect authentication data (set_id=eduardo)182.95.112.1021269750bE  -O) ossec13001i2Exim Auth failed2025-11-18 05:47:00 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:40006: 535 Incorrect authentication data (set_id=secretarioadjunto)152.52.236.1581269750D  -+ ossec13001i2pExim Auth failed2025-11-18 05:46:39 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:45016: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)190.121.193.1263595528jC  -c% ossec13001i2pExim Auth failed2025-11-18 05:46:38 dovecot_plain authenticator failed for (ccc0g6f5lrz92see88) [43.131.9.114]:44410: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)43.131.9.1142921044B  k' ossec9709i2jMultiple Dovecot Aborted Logins with empty userNov 18 05:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+A  e+) ossec9710i2XDovecot Auth failed on disconnected session.Nov 18 05:46:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.24718358415@  e?) ossec9710i2TDovecot Auth failed on disconnected session.Nov 18 05:46:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730u?  -u) ossec13001i2Exim Auth failed2025-11-18 05:46:58 dovecot_login authenticator failed for ([223.84.249.154]) [223.84.249.154]:1127: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)223.84.249.1541814991)>  e%+ ossec9710i2dDovecot Auth failed on disconnected session.Nov 18 05:46:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991p=  -i+ ossec13001i2BExim Auth failed2025-11-18 05:45:53 dovecot_login authenticator failed for ([211.198.128.204]) [211.198.128.204]:52791: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)211.198.128.2041835841b<  -O) ossec13001i2Exim Auth failed2025-11-18 05:45:14 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:50452: 535 Incorrect authentication data (set_id=contato)85.247.230.1322264397e;  -W' ossec13001i2PExim Auth failed2025-11-18 05:46:07 dovecot_login authenticator failed for ([58.35.120.169]) [58.35.120.169]:64961: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)58.35.120.1691814991X:  -A# ossec13001i2HExim Auth failed2025-11-18 05:45:58 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:35590: 535 Incorrect authentication data (set_id=toro)92.40.62.722635167.9  e1) ossec9710i2:Dovecot Auth failed on disconnected session.Nov 18 05:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.14429210448 W' ossec9708i2.Dovecot Aborted Login with empty userNov 18 05:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7oCZfNpD3quxV3kv>177.87.121.473469034 @zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH@W <0$ |pdXL@K'3& }qeYMA5)ui]QE9-! ymaUI=1% }qeYMA5)?3tgZM~qd 29 2921044- 3017382 3017382 3017382 3017382B 3017382A 3017382 3017382 3017382 3017382a 3017382 3017382 3017382 3017382^ 3017382 3017382 3017382 298795-$ 298795, 298795+ 298795+ 298795+ 298795* 298795* 298795*i 298795*^ 298795* 298795) 298795) 298795)~ 298795( 298795(V 298795& 298795&< 298795&8 298795%Z 298795$G 298795# 298795" 298795! 298795!= 298795 298795 l 298795 P 298795 298795\ 298795r 298795f 298795 298795 298795r 298795 298795 298795 298795 298795 298795 298795+ 298795 298795 298795} 298795V 298795 298795V 298795{ 298795- 298795= 298795 298795| 298795 298795 298795 298795 298795 298795i 298795 298795 L 298795  298795 298795 r 298795 p 298795 298795 p 298795L 2987956 298795 298795 298795 298795b 298795 298795 298795 298795 298795 298795 298795 298795- 298795 298795 298795 298795 298795 2963597h 2963597 2963597 294640, 294640+ 294640* 294640) 294640%W 294640$ 294640" 294640"i 294640i 294640 294640 294640 294640 294640 2946404 294640 $ 294640  294640 O 294640 294640( 294640` 294640 2921044- 2921044-[ 2921044, 2921044,i 2921044+ 2921044+ 2921044+ 2921044+E 2921044* 2921044* 2921044* 2921044) 2921044) 2921044){ 2921044)> 2921044)5 2921044( 2921044'} 2921044'{ 2921044'v 2921044'o 2921044'@ 2921044'7 2921044' 2921044' 2921044' 2921044& 2921044& 2921044&C 2921044&. 2921044& 2921044% 2921044% 2921044% 2921044%G 2921044%A 2921044%% 2921044$ 2921044$ 2921044$ 2921044$ 2921044$ 2921044$c 2921044# 2921044# 2921044# 2921044#z 2921044#0 2921044#( 2921044# 2921044# 2921044# 2921044" 2921044"A 2921044"& 2921044"# 2921044! 2921044! 2921044! 2921044! 2921044! 2921044 2921044 2921044 2921044 2921044 2921044 Z 2921044 * 2921044O 2921044J 2921044' 2921044! 2921044 2921044 2921044 2921044v 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044Q 2921044 2921044 2921044 2921044 2921044} 2921044y 2921044v 2921044O 2921044L 2921044 2921044Q 2921044; 2921044* 2921044 2921044 2921044 2921044 2921044x 2921044` 29210444 2921044 2921044 2921044 2921044w 2921044 2921044 2921044 2921044 2921044 2921044 2921044p 2921044Z 2921044E 2921044 2921044 2921044q 2921044P8 3017382 3017382 3017382 K 2921044/? 2921044. 294640.r 298795.U 298795.= 294640.6 2921044. 3017382 3017382 3017382 5 3017382 R 3017382  3017382 3017382 z 3017382 3017382 3017382 3017382 n 2921044-   s|U  -+ ossec13001i2Exim Auth failed2025-11-18 05:47:22 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:45176: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)103.230.176.1521269750\T  -I% ossec13001i2Exim Auth failed2025-11-18 05:47:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64697: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758)S  e+% ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:47:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0nt+gtpDXt9vAEul>111.0.75.1651814991/R  e1+ ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:47:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822,Q  e/' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:47:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867fP  -W) ossec13001i2Exim Auth failed2025-11-18 05:47:09 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:52907: 535 Incorrect authentication data (set_id=contato)179.185.29.2333469034VO  -9' ossec13001i2Exim Auth failed2025-11-18 05:48:01 dovecot_login authenticator failed for ([188.247.43.42]) [188.247.43.42]:58076: 535 Incorrect authentication data (set_id=compras)188.247.43.422017370lN  -c) ossec13001i2Exim Auth failed2025-11-18 05:47:45 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:45100: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)140.84.188.1403996063oM  -g+ ossec13001i2Exim Auth failed2025-11-18 05:47:42 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:45520: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)190.238.101.2093932488L W' ossec9708i2Dovecot Aborted Login with empty userNov 18 05:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(K  e'' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:47:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001(J  e#+ ossec9710i2VDovecot Auth failed on disconnected session.Nov 18 05:46:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001\I  -C) ossec13001i2Exim Auth failed2025-11-18 05:47:06 dovecot_login authenticator failed for (User) [177.74.174.120]:60177: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)177.74.174.1203469034H  W' ossec9708i2Dovecot Aborted Login with empty userNov 18 05:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gG  -[' ossec13001i2bExim Auth failed2025-11-18 05:46:24 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:55728: 535 Incorrect authentication data (set_id=aureovieira)118.3.227.1601861060  %d  W' ossec9708i3<Dovecot Aborted Login with empty userNov 18 05:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344c  e=) ossec9710i34Dovecot Auth failed on disconnected session.Nov 18 05:49:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044&b  e'# ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:48:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483a W' ossec9708i2Dovecot Aborted Login with empty userNov 18 05:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X`  -;) ossec13001i3Exim Auth failed2025-11-18 05:49:08 dovecot_login authenticator failed for ([46.148.100.210]) [46.148.100.210]:50426: 535 Incorrect authentication data (set_id=envios)46.148.100.2102017370-_  e/) ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:49:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750P^  -1# ossec13001i2Exim Auth failed2025-11-18 05:48:58 dovecot_login authenticator failed for ([46.44.0.185]) [46.44.0.185]:56664: 535 Incorrect authentication data (set_id=rodrigo)46.44.0.1852017370c]  -U% ossec13001i2Exim Auth failed2025-11-18 05:48:43 dovecot_login authenticator failed for ([213.234.5.66]) [213.234.5.66]:36500: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)213.234.5.662017370h\  -Y+ ossec13001i2Exim Auth failed2025-11-18 05:48:42 dovecot_login authenticator failed for (hn.kd.ny.adsl) [222.139.245.137]:34462: 535 Incorrect authentication data (set_id=envios@comercial.art.br)222.139.245.1371814991Y[  -=) ossec13001i2Exim Auth failed2025-11-18 05:47:57 dovecot_login authenticator failed for ([85.236.186.137]) [85.236.186.137]:33924: 535 Incorrect authentication data (set_id=compras)85.236.186.1372017370)Z  e%+ ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:47:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<+Mung9pDrKVrhr+5>107.134.191.1856252001]Y -C) ossec13001i2Exim Auth failed2025-11-18 05:47:12 dovecot_login authenticator failed for (User) [177.74.174.120]:60177: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)177.74.174.1203469034$X  e' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:48:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822(W  e'' ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 05:48:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084qV  -o' ossec13001i2Exim Auth failed2025-11-18 05:47:53 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:42703: 535 Incorrect authentication data (set_id=andressa.financeiro)189.218.82.143996063  m S9U]r  -E) ossec13001i3Exim Auth failed2025-11-18 05:51:15 dovecot_login authenticator failed for ([178.178.222.53]) [178.178.222.53]:41672: 535 Incorrect authentication data (set_id=aureovieira)178.178.222.532017370yq  -{+ ossec13001i3Exim Auth failed2025-11-18 05:52:01 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:58308: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)207.200.180.17462520014p  e?' ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:51:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651)o  e+' ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:51:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758*n  e+' ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:51:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520016m  eA) ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:52:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750`l  -I+ ossec13001i3Exim Auth failed2025-11-18 05:51:53 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:40516: 535 Incorrect authentication data (set_id=aureovieira)110.189.153.1361814991k W' ossec9708i3Dovecot Aborted Login with empty userNov 18 05:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<35IHktpDUM+xV3kv>177.87.121.473469034j W' ossec9708i3ZDovecot Aborted Login with empty userNov 18 05:50:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-i  e/) ossec9710i3BDovecot Auth failed on disconnected session.Nov 18 05:50:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.20222333870h  e3+ ossec9710i3xDovecot Auth failed on disconnected session.Nov 18 05:51:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822\g  -K! ossec13001i3nExim Auth failed2025-11-18 05:50:52 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:42586: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)59.51.87.91814991'f  e%' ossec9710i3$Dovecot Auth failed on disconnected session.Nov 18 05:49:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822e  k' ossec9709i3Multiple Dovecot Aborted Logins with empty userNov 18 05:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  xP6E(  e)% ossec9710i4dDovecot Auth failed on disconnected session.Nov 18 05:54:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370/  e7% ossec9710i4bDovecot Auth failed on disconnected session.Nov 18 05:54:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001-~ e/' ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:53:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730m}  -e) ossec13001i4Exim Auth failed2025-11-18 05:53:40 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:59200: 535 Incorrect authentication data (set_id=compras)172.91.113.2486252001| W' ossec9708i4Dovecot Aborted Login with empty userNov 18 05:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034${  e' ossec9710i4 Dovecot Auth failed on disconnected session.Nov 18 05:53:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<3E7+mNpDiJ8v+yzS>47.251.44.21062520014z  e?' ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:53:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084y  W' ossec9708i3Dovecot Aborted Login with empty userNov 18 05:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340x  e5) ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:52:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730Sw  -5% ossec13001i3Exim Auth failed2025-11-18 05:52:24 dovecot_login authenticator failed for ([58.16.114.30]) [58.16.114.30]:33117: 535 Incorrect authentication data (set_id=eduardo)58.16.114.301814991dv  -Q+ ossec13001i3Exim Auth failed2025-11-18 05:53:01 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61521: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651lu  -c) ossec13001i3Exim Auth failed2025-11-18 05:52:48 dovecot_login authenticator failed for ([60.191.221.118]) [60.191.221.118]:48207: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)60.191.221.1181814991t  k' ossec9709i3Multiple Dovecot Aborted Logins with empty userNov 18 05:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-s  e/) ossec9710i3Dovecot Auth failed on disconnected session.Nov 18 05:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387 Z mJZl  -c) ossec13001i4Exim Auth failed2025-11-18 05:56:55 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:44206: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)103.251.143.141269750  k' ossec9709i4Multiple Dovecot Aborted Logins with empty userNov 18 05:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  e/+ ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:55:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001t  -y# ossec13001i4~Exim Auth failed2025-11-18 05:55:26 dovecot_login authenticator failed for (adsl-5-141-80-56.salekhard.ru) [5.141.80.56]:38662: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)5.141.80.562017370/  e7% ossec9710i4vDovecot Auth failed on disconnected session.Nov 18 05:55:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841Z  -?) ossec13001i4Exim Auth failed2025-11-18 05:55:44 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:56004: 535 Incorrect authentication data (set_id=juridico)175.205.191.271835841)  e%+ ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001\  -C) ossec13001i4Exim Auth failed2025-11-18 05:55:35 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:49848: 535 Incorrect authentication data (set_id=formula316)182.95.177.1181269750  W' ossec9708i4Dovecot Aborted Login with empty userNov 18 05:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -G+ ossec13001i4Exim Auth failed2025-11-18 05:55:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51767: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034f  -[' ossec13001i4vExim Auth failed2025-11-18 05:55:18 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:51476: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)146.19.200.63660013-  e3% ossec9710i4nDovecot Auth failed on disconnected session.Nov 18 05:55:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841'  e)# ossec9710i4VDovecot Auth failed on disconnected session.Nov 18 05:54:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483 W' ossec9708i4JDovecot Aborted Login with empty userNov 18 05:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  -_+ ossec13001i4hExim Auth failed2025-11-18 05:55:03 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51289: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651 ,-X*tgZM@3& ^QD7zm`SF9,vi\OB5(reK>1$ {naTG:- : -   w j ] P C 6 )   s f Y L ? 2 %    r e X K > 1 $  { n a T G|o 5 (    bUH;.! v i \ O B   xk~qdWJ=0# 0# zB 3469034* 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034(? 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034)q 3469034)m 3469034)k 3469034)j 3469034)` 3469034)] 3469034)Z 3469034)W 3469034)P 3469034)O 3469034)J 3469034)F 3469034)B 3469034)= 3469034)< 3469034): 3469034)2 3469034)- 3469034)) 3469034) 3469034(A 3469034) 3469034) 3469034) 3469034) 3469034) 3469034) 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034( 3469034(| 3469034(x 3469034(v 3469034(t 3469034(q 3469034(p 3469034(o 3469034(m 3469034(l 3469034(i 3469034(f 3469034(b 3469034(` 3469034(Z 3469034(Y 3469034(Q 3469034(O 3469034(K 3469034(H 3469034( 3469034( 3469034( 3469034( 3469034,q 3469034,n 3469034,h 3469034,^ 3469034,U 3469034,4 3469034,. 3469034,' 3469034,% 3469034, 3469034, 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+c 3469034+[ 3469034+V 3469034+S 3469034( 3469034+I 3469034+ 3469034+7 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034, 3469034* 3469034* 3469034* 3469034* 3469034*| 3469034*t 3469034*o 3469034*k 3469034, 3469034*b 3469034*\ 3469034*T 3469034*Q 3469034*L 3469034*K 3469034*B 3469034*; 3469034*5 3469034*4 3469034*3 3469034*0 3469034*/ 3469034*- 3469034** 3469034*( 3469034, 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034+6 3469034+3 3469034+0 3469034+( 3469034+$ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034* 3469034, 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+| 3469034+w 3469034+v 3469034+r 3469034+q 3469034+o 3469034+n 3469034+m 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034+ 3469034," 3469034, 3469034,O 3469034,E 3469034,D 3469034,B 3469034,~ 3469034,} 3469034,f 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, : rXmAe:'  e#) ossec9710i5TDovecot Auth failed on disconnected session.Nov 18 05:59:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<+uagrNpDtMLSchJs>210.114.18.1081835841X  -;) ossec13001i4Exim Auth failed2025-11-18 05:57:09 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:44831: 535 Incorrect authentication data (set_id=rafael)121.134.31.1931835841(  e+# ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 05:57:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001g  -[) ossec13001i5Exim Auth failed2025-11-18 05:57:39 dovecot_login authenticator failed for (host-79-121-102-227.juropnet.hu) [79.121.102.227]:54690: 535 Incorrect authentication data (set_id=contato)79.121.102.227719819 W' ossec9708i4Dovecot Aborted Login with empty userNov 18 05:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/ e5% ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:57:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.2166252001&  e%% ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:57:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991X  -A# ossec13001i5Exim Auth failed2025-11-18 05:57:35 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:61907: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999o  -i) ossec13001i4Exim Auth failed2025-11-18 05:57:26 dovecot_login authenticator failed for ([111.26.167.166]) [111.26.167.166]:53416: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)111.26.167.1661814991(  e%) ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:56:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822 W' ossec9708i4Dovecot Aborted Login with empty userNov 18 05:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8yrto9pDpNaxV3kv>177.87.121.473469034f  -[% ossec13001i4Exim Auth failed2025-11-18 05:56:25 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:57449: 535 Incorrect authentication data (set_id=presidencia)174.79.87.5362520010  e7' ossec9710i4Dovecot Auth failed on disconnected session.Nov 18 05:56:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991z  -) ossec13001i4Exim Auth failed2025-11-18 05:56:10 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:33810: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)116.98.104.1381562822  ~ [ O AR<Zl, W' ossec9708i5tDovecot Aborted Login with empty userNov 18 05:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\+  -A+ ossec13001i5hExim Auth failed2025-11-18 05:59:20 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:41228: 535 Incorrect authentication data (set_id=compras)121.131.220.1441835841V*  -9' ossec13001i5hExim Auth failed2025-11-18 05:59:19 dovecot_login authenticator failed for ([118.121.234.5]) [118.121.234.5]:39982: 535 Incorrect authentication data (set_id=adriana)118.121.234.51814991j)  -c% ossec13001i5\Exim Auth failed2025-11-18 05:59:07 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:47692: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)38.226.118.03469034^(  -G) ossec13001i5Exim Auth failed2025-11-18 05:59:57 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:47228: 535 Incorrect authentication data (set_id=alex.vendas)175.43.184.2021814991\'  -A+ ossec13001i5Exim Auth failed2025-11-18 05:59:44 dovecot_login authenticator failed for ([113.200.216.246]) [113.200.216.246]:42842: 535 Incorrect authentication data (set_id=rodrigo)113.200.216.24618149912&  e9) ossec9710i5pDovecot Auth failed on disconnected session.Nov 18 05:59:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044k%  -c' ossec13001i5lExim Auth failed2025-11-18 05:59:24 dovecot_login authenticator failed for ([223.210.0.110]) [111.48.77.157]:49117: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)111.48.77.1571814991Y$  -C% ossec13001i5lExim Auth failed2025-11-18 05:59:23 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49764: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758-#  e/) ossec9710i5PDovecot Auth failed on disconnected session.Nov 18 05:58:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044"  -) ossec13001i5LExim Auth failed2025-11-18 05:58:52 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:62736: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)220.246.66.2091819730!  k' ossec9709i59Multiple Dovecot Aborted Logins with empty userNov 18 05:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343  e9+ ossec9710i5XDovecot Auth failed on disconnected session.Nov 18 05:59:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001  W' ossec9708i5VDovecot Aborted Login with empty userNov 18 05:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  e3' ossec9710i5VDovecot Auth failed on disconnected session.Nov 18 05:59:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001 }  1 T x mFhh}g<  -_' ossec13001i6Exim Auth failed2025-11-18 06:01:52 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:49541: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)65.20.143.15999237;  k' ossec9709i5Multiple Dovecot Aborted Logins with empty userNov 18 06:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y:  -?' ossec13001i5Exim Auth failed2025-11-18 06:01:04 dovecot_login authenticator failed for ([116.233.83.90]) [116.233.83.90]:35060: 535 Incorrect authentication data (set_id=financeiro)116.233.83.901814991Z9  -A' ossec13001i5Exim Auth failed2025-11-18 06:01:03 dovecot_login authenticator failed for ([60.186.172.37]) [60.186.172.37]:59860: 535 Incorrect authentication data (set_id=aureovieira)60.186.172.371814991#8  e' ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 06:00:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<6g3TstpDXuo+PIOJ>62.60.131.1371307587 W' ossec9708i5Dovecot Aborted Login with empty userNov 18 06:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.6  e1) ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 06:01:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001s5  -o+ ossec13001i5Exim Auth failed2025-11-18 06:00:51 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:39274: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)180.168.100.2301814991Z4  -A' ossec13001i5Exim Auth failed2025-11-18 06:00:47 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:46778: 535 Incorrect authentication data (set_id=aureovieira)182.95.174.181269750f3  -W) ossec13001i5Exim Auth failed2025-11-18 06:00:14 dovecot_login authenticator failed for (static.vnpt.vn) [14.228.180.199]:63106: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)14.228.180.1991562822X2  -A# ossec13001i5Exim Auth failed2025-11-18 06:01:01 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:36160: 535 Incorrect authentication data (set_id=administrativo1)59.96.62.291269750Y1  -A' ossec13001i5Exim Auth failed2025-11-18 06:00:31 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:59213: 535 Incorrect authentication data (set_id=aureovieira)94.20.234.161587116e0  -W' ossec13001i5Exim Auth failed2025-11-18 06:00:07 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:56674: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)50.231.243.286252001u/  -w) ossec13001i5Exim Auth failed2025-11-18 06:00:36 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.222.60]:49052: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)154.177.222.60357994e.  -W' ossec13001i5Exim Auth failed2025-11-18 06:00:22 dovecot_login authenticator failed for ([89.175.253.50]) [89.175.253.50]:48534: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)89.175.253.502017370-  - + ossec13001i5Exim Auth failed2025-11-18 05:59:42 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:58388: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)121.202.140.1111819730    +K  e)+ ossec9710i61Dovecot Auth failed on disconnected session.Nov 18 06:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991J W' ossec9708i6)Dovecot Aborted Login with empty userNov 18 06:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YI  -?' ossec13001i6Exim Auth failed2025-11-18 06:02:09 dovecot_login authenticator failed for ([123.22.173.13]) [123.22.173.13]:55931: 535 Incorrect authentication data (set_id=financeiro)123.22.173.131562822/H  e3) ossec9710i67Dovecot Auth failed on disconnected session.Nov 18 06:02:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730oG  -g+ ossec13001i61Exim Auth failed2025-11-18 06:02:39 dovecot_login authenticator failed for ([122.186.219.150]) [122.186.219.150]:48064: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)122.186.219.1501269750SF  -5% ossec13001i6Exim Auth failed2025-11-18 06:02:16 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:33419: 535 Incorrect authentication data (set_id=eduardo)119.6.108.131814991E  -) ossec13001i6Exim Auth failed2025-11-18 06:02:10 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:58900: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)116.98.104.1381562822iD  -_' ossec13001i6Exim Auth failed2025-11-18 06:02:07 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:52214: 535 Incorrect authentication data (set_id=atualizacoes)200.89.159.593865483C  W' ossec9708i6 Dovecot Aborted Login with empty userNov 18 06:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034rB  -o) ossec13001i5Exim Auth failed2025-11-18 06:01:50 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:40219: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)119.164.159.861814991&A  e!) ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 06:01:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044k@  -a) ossec13001i5Exim Auth failed2025-11-18 06:01:24 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:51608: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)152.52.246.1781269750?  e# ossec9710i5Dovecot Auth failed on disconnected session.Nov 18 06:01:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<8oWVtNpD3ISUcQQF>148.113.4.51269750_>  -K' ossec13001i6Exim Auth failed2025-11-18 06:01:56 dovecot_login authenticator failed for (mail.jimsmithcenters.com) [38.87.177.252]:49920: 535 Incorrect authentication data (set_id=contato)38.87.177.2526252001=  -+ ossec13001i6Exim Auth failed2025-11-18 06:01:56 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47634: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)117.250.107.1801269750  i v :Z% )%Y  e%# ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:04:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<0VJ3wdpD1AenYwhf>167.99.8.956252001X  W' ossec9708i6Dovecot Aborted Login with empty userNov 18 06:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.W  e1) ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:04:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750V  k' ossec9709i6Multiple Dovecot Aborted Logins with empty userNov 18 06:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0AaGwNpDVrCxV3kv>177.87.121.473469034^U  -E+ ossec13001i6eExim Auth failed2025-11-18 06:03:32 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52085: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.1413469034T W' ossec9708i6eDovecot Aborted Login with empty userNov 18 06:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341S  e7) ossec9710i6_Dovecot Auth failed on disconnected session.Nov 18 06:03:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841\R  -A+ ossec13001i6QExim Auth failed2025-11-18 06:03:11 dovecot_login authenticator failed for ([118.220.149.121]) [118.220.149.121]:45560: 535 Incorrect authentication data (set_id=compras)118.220.149.12118358418Q  eG' ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:04:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822oP  -g+ ossec13001i6wExim Auth failed2025-11-18 06:03:50 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:56909: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)222.108.177.1101835841-O  e/) ossec9710i6kDovecot Auth failed on disconnected session.Nov 18 06:03:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3o4XvdpDKomB4rs4>129.226.187.5618197307N  eC) ossec9710i6GDovecot Auth failed on disconnected session.Nov 18 06:03:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.251814991pM  -m' ossec13001i6EExim Auth failed2025-11-18 06:03:01 dovecot_login authenticator failed for h-155-4-122-170.a259.priv.bahnhof.se [155.4.122.170]:54684: 535 Incorrect authentication data (set_id=isabellylisboa)155.4.122.17026618863L  e=' ossec9710i67Dovecot Auth failed on disconnected session.Nov 18 06:02:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<7r0WutpD+JmkXF7M>164.92.94.2046252001  gD*3g  e9+ ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:05:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822if  -]) ossec13001i6Exim Auth failed2025-11-18 06:05:09 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:38281: 535 Incorrect authentication data (set_id=faturamento)110.25.112.1451668284e -9' ossec13001i6Exim Auth failed2025-11-18 06:06:00 dovecot_plain authenticator failed for (parin-test.kpz0ku3kfnqubkkeppdkbtt1th.bx.internal.cloudapp.net) [20.127.208.26]:64167: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)20.127.208.266252001'd  e)# ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:06:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750)c  e') ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:05:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750b W' ossec9708i6Dovecot Aborted Login with empty userNov 18 06:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a W+ ossec9708i6Dovecot Aborted Login with empty userNov 18 06:05:27 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.17634690340`  e3+ ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:06:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001h_  -]' ossec13001i6Exim Auth failed2025-11-18 06:05:57 dovecot_login authenticator failed for ([102.110.11.36]) [102.110.11.36]:2236: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)102.110.11.3624644615^  e?) ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:04:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387}]  - % ossec13001i6Exim Auth failed2025-11-18 06:04:43 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:39960: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)71.229.1.1866252001-\  e3% ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:04:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<1r6wwNpD7otAF/Qn>64.23.244.396252001X[  -;) ossec13001i6Exim Auth failed2025-11-18 06:04:26 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:40258: 535 Incorrect authentication data (set_id=rafael)122.187.220.301269750.Z  e5% ossec9710i6Dovecot Auth failed on disconnected session.Nov 18 06:04:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<2NLFv9pDdLBzR+4E>115.71.238.41835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f  \ R >  4 H * vlbXND:0&|rh^,"TJ@6d2(ZxPnF< ~tj`VLB$8.zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& i:p" i:l" i:h" i:b" i:b" i:D" i:>" i:*" i:&" i:" i:" i:" i9" i9" i9" i:" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9" i9s" i9l" i9j" i9\" i9" i9q" i9l" i9>" i96" i96" i93" i9)" i9#" i8" i8" i8" i9" i9 " i9 " i9" i8" i9 " i9 " i8" i8" i8" i9" i9" i9" i8" i8" i8" i8" i8" i8" i8" i8" i8" i8" i8u" i8o" i8" i8" i8" i8" i8E" i8E" i8E" i8=" i8]" i8U" i8" i8 " i8" i8+" i8'" i8#" i7" i7" i7" i7" i7" i7" i7" i7" i7" i7" i7" i7" i7y" i7u" i7]" i7[" i7G" i7e"~ i7Y"} i7U"| i7E"{ i7?"z i7s"y i7m"x i7"w i7"v i7+"u i7%"t i7!"s i7"r i7"q i7 "p i7"o i75"n i73"m i7"l i7"k i7!"j i7 "i i7 "h i6"` i6"e i6"d i6"_ i6"b i6"c i6"a i6"g i6"f i6"X i6"Y i6"^ i6"] i6"\ i6"W i6"V i6"[ i6"Z i6"Q i6w"P i6k"O i6e"U i6e"T i6_"S i6Q"R i6G"N i6E"M i67"L i67"H i61"K i61"G i6)"J i6"F i6"I i6"E i6"D i6 "C i6"> i6"= i6"< i5"B i;n# i;l# i;h# i;b# i;\# i;Z# i;X# i;X# i;P# i;L# i;J# i;<# i;:# i;,# i;# i;# i;" i;" i;# i;# i;# i;# i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:" i:r" i5"A i5"; i5"@ i5"? i5": i5"9 i5"2 i5"6 i5"5 i5"4 i5"8 i5"/ i5"7 i5"1 i5". i5"3 i5"0 i5"( i5"' i5"- i5t", i5p"& i5l"% i5l"$ i5h"+ i5h"* i5\") i5X" i5V" i5V" i5T" i5P"# i5L"" i59"! i5" i5" i5" i4" i4" i4" i4" i4" i;r# i4" i4" i4" i4" i4" i4" i4" i4" i4" i4" i4" i4" i4" i4~" i4v" i4v" i4n" i4h" i4d" i4b! i4V" i4J" i4! i4! i4! i4 ! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! i3! : 8 D  9 ^CVhioSw  -5% ossec13001i7Exim Auth failed2025-11-18 06:06:33 dovecot_login authenticator failed for (noname.vdonsk.ru) [193.111.3.59]:42332: 535 Incorrect authentication data (set_id=lucas)193.111.3.592017370v W' ossec9708i7Dovecot Aborted Login with empty userNov 18 06:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\u  -C) ossec13001i7+Exim Auth failed2025-11-18 06:06:50 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:54146: 535 Incorrect authentication data (set_id=assessoria)217.195.94.2432017370/t  e3) ossec9710i7%Dovecot Auth failed on disconnected session.Nov 18 06:06:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730ks  -c' ossec13001i7!Exim Auth failed2025-11-18 06:06:40 dovecot_login authenticator failed for ([152.52.234.232]) [103.251.31.34]:47552: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)103.251.31.341269750Yr  -=) ossec13001i7Exim Auth failed2025-11-18 06:06:37 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:43870: 535 Incorrect authentication data (set_id=contato)112.162.18.1501835841jq  -a' ossec13001i7Exim Auth failed2025-11-18 06:06:23 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:39472: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)106.0.165.2191605651ip  -_' ossec13001i7 Exim Auth failed2025-11-18 06:06:19 dovecot_login authenticator failed for ([60.211.194.58]) [60.211.194.58]:9381: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)60.211.194.581814991o -9' ossec13001i7Exim Auth failed2025-11-18 06:06:12 dovecot_plain authenticator failed for (parin-test.kpz0ku3kfnqubkkeppdkbtt1th.bx.internal.cloudapp.net) [20.127.208.26]:64579: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)20.127.208.266252001Wn  -9) ossec13001i75Exim Auth failed2025-11-18 06:07:01 dovecot_login authenticator failed for ([219.128.55.250]) [219.128.55.250]:40438: 535 Incorrect authentication data (set_id=lucas)219.128.55.2501814991Ym  -=) ossec13001i73Exim Auth failed2025-11-18 06:06:58 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:49836: 535 Incorrect authentication data (set_id=compras)182.95.223.1141269750*l  e)) ossec9710i7Dovecot Auth failed on disconnected session.Nov 18 06:06:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<+0s2x9pDen2KxX03>138.197.125.556252001pk  -m' ossec13001i7Exim Auth failed2025-11-18 06:06:23 dovecot_login authenticator failed for ([39.171.42.206]) [39.171.42.206]:36026: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)39.171.42.2061814991~j  -) ossec13001i7!Exim Auth failed2025-11-18 06:06:40 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:60880: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)116.48.149.1231819730[i  -I# ossec13001i7 Exim Auth failed2025-11-18 06:06:20 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:36154: 535 Incorrect authentication data (set_id=contato)2.54.97.134294640ch  -U% ossec13001i7 Exim Auth failed2025-11-18 06:06:20 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:47758: 535 Incorrect authentication data (set_id=info@inovasite.net)50.235.31.476252001  z @ +HL&*F/  e5' ossec9710i7Dovecot Auth failed on disconnected session.Nov 18 06:08:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001`  -I+ ossec13001i7Exim Auth failed2025-11-18 06:08:16 dovecot_login authenticator failed for ([183.131.243.102]) [183.131.243.102]:60662: 535 Incorrect authentication data (set_id=aureovieira)183.131.243.1021814991x  -% ossec13001i7yExim Auth failed2025-11-18 06:08:08 dovecot_login authenticator failed for 221-120-4-49.emome-ip.hinet.net [221.120.4.49]:59588: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)221.120.4.491668284"  e% ossec9710i7uDovecot Auth failed on disconnected session.Nov 18 06:08:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060x  -{) ossec13001i7]Exim Auth failed2025-11-18 06:07:39 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60464: 535 Incorrect authentication data (set_id=bqtz)109.195.166.622017370_  -G+ ossec13001i7[Exim Auth failed2025-11-18 06:07:38 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52296: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034`  -K) ossec13001i7GExim Auth failed2025-11-18 06:07:18 dovecot_login authenticator failed for ([46.151.242.210]) [46.151.242.210]:58832: 535 Incorrect authentication data (set_id=bqtz@iemif.com)46.151.242.2102017370c~  -W' ossec13001i7eExim Auth failed2025-11-18 06:07:48 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:52173: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)185.34.17.25099237#}  e) ossec9710i7YDovecot Auth failed on disconnected session.Nov 18 06:07:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387|  k' ossec9709i7UMultiple Dovecot Aborted Logins with empty userNov 18 06:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346{  eE% ossec9710i7EDovecot Auth failed on disconnected session.Nov 18 06:07:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382:z  eG+ ossec9710i7?Dovecot Auth failed on disconnected session.Nov 18 06:07:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001y  W' ossec9708i7sDovecot Aborted Login with empty userNov 18 06:08:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+x  e++ ossec9710i7mDovecot Auth failed on disconnected session.Nov 18 06:07:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758 U xU  k' ossec9709i8 Multiple Dovecot Aborted Logins with empty userNov 18 06:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343  e;) ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 06:10:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730y  -}) ossec13001i8+Exim Auth failed2025-11-18 06:11:07 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:44050: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)121.73.169.2032186224  W' ossec9708i8'Dovecot Aborted Login with empty userNov 18 06:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  -w) ossec13001i8#Exim Auth failed2025-11-18 06:10:59 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:55628: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)27.123.114.1901269750 W' ossec9708i7Dovecot Aborted Login with empty userNov 18 06:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -I% ossec13001i7Exim Auth failed2025-11-18 06:09:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57279: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.401307582  e;' ossec9710i7Dovecot Auth failed on disconnected session.Nov 18 06:09:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001*  e-% ossec9710i7Dovecot Auth failed on disconnected session.Nov 18 06:10:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841V  -7) ossec13001i7Exim Auth failed2025-11-18 06:09:55 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:42922: 535 Incorrect authentication data (set_id=michael)116.75.218.1031269750a  -Q% ossec13001i7Exim Auth failed2025-11-18 06:09:33 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:44298: 535 Incorrect authentication data (set_id=michael@deproi.com.br)111.50.70.341814991m  -c+ ossec13001i7Exim Auth failed2025-11-18 06:08:48 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:35772: 535 Incorrect authentication data (set_id=contato)200.216.168.2263469034(  e'' ossec9710i7Dovecot Auth failed on disconnected session.Nov 18 06:08:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001i  -_' ossec13001i7Exim Auth failed2025-11-18 06:08:34 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:49856: 535 Incorrect authentication data (set_id=aureovieira)173.17.163.446252001 W' ossec9708i7Dovecot Aborted Login with empty userNov 18 06:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  #  -%+ ossec13001i8Exim Auth failed2025-11-18 06:13:33 dovecot_login authenticator failed for (nsg-corporate-150.219.186.122.airtel.in) [122.186.219.150]:55318: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)122.186.219.15012697504"  e?' ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 06:13:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651n!  -g) ossec13001i8uExim Auth failed2025-11-18 06:12:20 dovecot_login authenticator failed for ([175.125.68.208]) [175.125.68.208]:57786: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)175.125.68.2081835841[  -C' ossec13001i8oExim Auth failed2025-11-18 06:12:15 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:25369: 535 Incorrect authentication data (set_id=junior.gomes)211.97.119.871814991j  -c% ossec13001i8Exim Auth failed2025-11-18 06:13:07 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:53988: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)113.8.218.541814991M  ;% ossec13008i8Mail Recipient rejected2025-11-18 06:13:06 H=([92.246.87.86]) [92.246.87.86]:63159 F= rejected RCPT : "JunkMail rejected - ([92.246.87.86]) [92.246.87.86]:63159 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/92.246.87.86"92.246.87.862921044Q  -5# ossec13001i8Exim Auth failed2025-11-18 06:12:43 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:57367: 535 Incorrect authentication data (set_id=sec.geral)5.30.196.79290557 W' ossec9708i8Dovecot Aborted Login with empty userNov 18 06:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x  -y+ ossec13001i8EExim Auth failed2025-11-18 06:11:33 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:59522: 535 Incorrect authentication data (set_id=andressa.financeiro)223.197.145.1141819730V  -9' ossec13001i8EExim Auth failed2025-11-18 06:11:32 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:43106: 535 Incorrect authentication data (set_id=contato)38.141.252.556252001 W' ossec9708i8EDovecot Aborted Login with empty userNov 18 06:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -G) ossec13001i8=Exim Auth failed2025-11-18 06:11:25 dovecot_login authenticator failed for ([176.115.201.37]) [176.115.201.37]:38886: 535 Incorrect authentication data (set_id=atualizacoes)176.115.201.372017370*  -_) ossec13001i8]Exim Auth failed2025-11-18 06:11:56 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:53112: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)179.48.229.1173469034,  e++ ossec9710i8UDovecot Auth failed on disconnected session.Nov 18 06:11:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841{  -' ossec13001i8Exim Auth failed2025-11-18 06:10:48 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:41732: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)157.7.200.1521861060   *2  e)) ossec9710i9 Dovecot Auth failed on disconnected session.Nov 18 06:14:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750l1  -c) ossec13001i8Exim Auth failed2025-11-18 06:14:19 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:34699: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)111.23.117.1081814991o0  -k' ossec13001i8Exim Auth failed2025-11-18 06:14:15 dovecot_login authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:48894: 535 Incorrect authentication data (set_id=assessoria)166.195.4.2476252001j/  -_) ossec13001i8Exim Auth failed2025-11-18 06:14:15 dovecot_login authenticator failed for (nhavuivn.com) [210.245.33.154]:57862: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)210.245.33.1541562822l.  -g) ossec13001i9Exim Auth failed2025-11-18 06:15:03 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:49240: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)196.216.81.12649518e-  -W' ossec13001i9Exim Auth failed2025-11-18 06:15:02 dovecot_login authenticator failed for 111-70-49-179.emome-ip.hinet.net [111.70.49.179]:56130: 535 Incorrect authentication data (set_id=leandro)111.70.49.1791668284g,  -[' ossec13001i9Exim Auth failed2025-11-18 06:15:01 dovecot_login authenticator failed for ([106.91.215.98]) [106.91.215.98]:59470: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)106.91.215.981814991+  W' ossec9708i8Dovecot Aborted Login with empty userNov 18 06:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034**  e)) ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 06:13:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841k)  -e% ossec13001i8Exim Auth failed2025-11-18 06:14:01 dovecot_login authenticator failed for ([60.175.91.53]) [60.175.91.53]:55740: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)60.175.91.531814991f(  -]% ossec13001i8Exim Auth failed2025-11-18 06:13:52 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:57683: 535 Incorrect authentication data (set_id=paulinho.vendas)2.55.125.200294640'  -' ossec13001i8Exim Auth failed2025-11-18 06:13:42 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:64365: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)34.84.162.1771861060!&  e# ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 06:13:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001%  k' ossec9709i8Multiple Dovecot Aborted Logins with empty userNov 18 06:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4hG84NpDUL2xV3kv>177.87.121.473469034\$  -C) ossec13001i8Exim Auth failed2025-11-18 06:13:26 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:39234: 535 Incorrect authentication data (set_id=financeiro)122.184.124.461269750   16 YA  -=) ossec13001i9>Exim Auth failed2025-11-18 06:15:41 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:35659: 535 Incorrect authentication data (set_id=contato)115.141.143.5818358410@  e3+ ossec9710i96Dovecot Auth failed on disconnected session.Nov 18 06:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841? W' ossec9708i96Dovecot Aborted Login with empty userNov 18 06:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)>  e)' ossec9710i93Dovecot Auth failed on disconnected session.Nov 18 06:15:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841w=  -{) ossec13001i9)Exim Auth failed2025-11-18 06:15:20 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.222.60]:37908: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)154.177.222.60357994i<  -]) ossec13001i9#Exim Auth failed2025-11-18 06:15:14 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:55055: 535 Incorrect authentication data (set_id=brizola)223.197.226.511819730i;  -a% ossec13001i8Exim Auth failed2025-11-18 06:14:35 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43154: 535 Incorrect authentication data (set_id=faturamento)71.62.34.2166252001V:  -9' ossec13001i8Exim Auth failed2025-11-18 06:14:33 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:36907: 535 Incorrect authentication data (set_id=compras)83.239.84.1302017370\9  -A+ ossec13001i8Exim Auth failed2025-11-18 06:14:32 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:37192: 535 Incorrect authentication data (set_id=contato)103.158.138.1791269750V8  -7) ossec13001i9Exim Auth failed2025-11-18 06:15:07 dovecot_login authenticator failed for ([223.100.248.64]) [223.100.248.64]:57359: 535 Incorrect authentication data (set_id=nfe2)223.100.248.641814991m7  -e) ossec13001i9 Exim Auth failed2025-11-18 06:14:52 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:47756: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)111.61.175.1181814991.6  e3' ossec9710i9 Dovecot Auth failed on disconnected session.Nov 18 06:14:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<4HA25dpDrpMkMrBu>36.50.176.1101562822-5  e1' ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 06:14:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<+jLv5NpDdpFSczCz>82.115.48.17915228674 W' ossec9708i8Dovecot Aborted Login with empty userNov 18 06:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o3  -k' ossec13001i9 Exim Auth failed2025-11-18 06:14:52 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:32940: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)51.68.226.1713017382 X t anyjQhuX&P  e!+ ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 06:17:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<5fjz7dpDitvBl4nP>193.151.137.207130758oO  -i) ossec13001i9Exim Auth failed2025-11-18 06:17:09 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:38943: 535 Incorrect authentication data (set_id=vendas.luiz)73.222.126.2136252001oN  -g+ ossec13001i9Exim Auth failed2025-11-18 06:17:06 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:55732: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)122.186.219.1501269750eM  -U+ ossec13001i9Exim Auth failed2025-11-18 06:17:05 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:42092: 535 Incorrect authentication data (set_id=secretarioadjunto)178.250.191.189458258L  W' ossec9708i9Dovecot Aborted Login with empty userNov 18 06:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034K  -/) ossec13001i9Exim Auth failed2025-11-18 06:17:00 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:46994: 535 Incorrect authentication data (set_id=adriana)179.48.229.1173469034uJ  -s+ ossec13001i9Exim Auth failed2025-11-18 06:16:49 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:55192: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)220.201.218.1461814991qI  -q% ossec13001i9Exim Auth failed2025-11-18 06:16:49 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:60692: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)115.77.111.21562822oH  -i) ossec13001i9sExim Auth failed2025-11-18 06:16:35 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:60306: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)152.52.231.2021269750G  [{) ossec12004i9lPossible Dovecot CVE-2019-11500 attemptNov 18 06:16:26 hosting dovecot: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=104.152.52.213, lip=200.150.196.245, session=104.152.52.2136252001)F  e') ossec9710i9jDovecot Auth failed on disconnected session.Nov 18 06:16:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730cE  -O+ ossec13001i9\Exim Auth failed2025-11-18 06:16:10 dovecot_login authenticator failed for ([223.166.105.105]) [223.166.105.105]:58276: 535 Incorrect authentication data (set_id=isabellylisboa)223.166.105.1051814991+D  e+) ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 06:17:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251C  k' ossec9709i9qMultiple Dovecot Aborted Logins with empty userNov 18 06:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034"B  ;C' ossec13008i9lMail Recipient rejected2025-11-18 06:16:27 H=(200.150.196.245) [104.152.52.60]:50709 F= rejected RCPT : SMTP AUTH is required for message submission on port 587104.152.52.606252001    ' ;s_  -o+ ossec13001i:Exim Auth failed2025-11-18 06:19:20 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:60484: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)121.142.146.1671835841-^  e-+ ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:18:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.11915628223]  eA# ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:18:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483`\  -M' ossec13001i9Exim Auth failed2025-11-18 06:18:48 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:50630: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730j[  -a' ossec13001i9Exim Auth failed2025-11-18 06:18:38 dovecot_login authenticator failed for ([121.73.168.30]) [121.73.168.30]:39838: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)121.73.168.302186224Z W' ossec9708i9Dovecot Aborted Login with empty userNov 18 06:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\Y  -E' ossec13001i:Exim Auth failed2025-11-18 06:19:03 dovecot_login authenticator failed for ([114.101.79.13]) [114.101.79.13]:38252: 535 Incorrect authentication data (set_id=atualizacoes1)114.101.79.131814991TX  -5' ossec13001i9Exim Auth failed2025-11-18 06:18:06 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:38026: 535 Incorrect authentication data (set_id=paulo)103.107.36.181269750 W  -) ossec13001i9Exim Auth failed2025-11-18 06:17:39 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:40422: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)122.187.220.301269750qV  -o' ossec13001i9Exim Auth failed2025-11-18 06:17:38 dovecot_login authenticator failed for 80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:35530: 535 Incorrect authentication data (set_id=secretaria)80.15.223.14830173824U  e?' ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 06:17:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730uT  -y' ossec13001i9Exim Auth failed2025-11-18 06:17:25 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:51414: 535 Incorrect authentication data (set_id=secretaria@contabilidadefollador.com.br)91.239.23.149458258iS  -a' ossec13001i9Exim Auth failed2025-11-18 06:17:38 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:58080: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795R W' ossec9708i9Dovecot Aborted Login with empty userNov 18 06:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034bQ  -M+ ossec13001i9Exim Auth failed2025-11-18 06:17:24 dovecot_login authenticator failed for ([103.130.207.227]) [103.130.207.227]:36518: 535 Incorrect authentication data (set_id=atualizacoes1)103.130.207.2271282988  p@m W' ossec9708i:Dovecot Aborted Login with empty userNov 18 06:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'l  e#) ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:21:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730Yk  -?' ossec13001i:Exim Auth failed2025-11-18 06:22:06 dovecot_login authenticator failed for ([24.144.4.218]) [38.87.177.252]:34138: 535 Incorrect authentication data (set_id=aureovieira)38.87.177.25262520011j  e5+ ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:21:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822&i  e!) ossec9710i:rDovecot Auth failed on disconnected session.Nov 18 06:20:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750,h  e++ ossec9710i:pDovecot Auth failed on disconnected session.Nov 18 06:20:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841%g  e#% ossec9710i:lDovecot Auth failed on disconnected session.Nov 18 06:20:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841*f  e+' ossec9710i:hDovecot Auth failed on disconnected session.Nov 18 06:20:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084Ye  -C% ossec13001i:bExim Auth failed2025-11-18 06:20:33 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61099: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758d W' ossec9708i:bDovecot Aborted Login with empty userNov 18 06:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  W' ossec9708i:DDovecot Aborted Login with empty userNov 18 06:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#b  e% ossec9710i:>Dovecot Auth failed on disconnected session.Nov 18 06:19:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060[a  -C' ossec13001i:*Exim Auth failed2025-11-18 06:19:37 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:42114: 535 Incorrect authentication data (set_id=presidencia)182.95.46.1861269750`  k' ossec9709i:&Multiple Dovecot Aborted Logins with empty userNov 18 06:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 3 { n}r^3'|  e%' ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:22:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<0Z9kAdtD4OdSnOdL>82.156.231.751814991{  --' ossec13001i:Exim Auth failed2025-11-18 06:22:34 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52570: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)70.91.135.18162520011z  e;% ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:23:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991dy  -Q+ ossec13001i:Exim Auth failed2025-11-18 06:22:56 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55939: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.2311605651jx  -a' ossec13001i:Exim Auth failed2025-11-18 06:22:46 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:59861: 535 Incorrect authentication data (set_id=gerson)172.90.128.976252001mw  -e) ossec13001i:Exim Auth failed2025-11-18 06:22:36 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:38892: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)137.131.24.1706252001v  k' ossec9709i:Multiple Dovecot Aborted Logins with empty userNov 18 06:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1RXnANtDZsGxV3kv>177.87.121.473469034u  W' ossec9708i:Dovecot Aborted Login with empty userNov 18 06:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dt  -U' ossec13001i:Exim Auth failed2025-11-18 06:22:56 dovecot_login authenticator failed for ([200.5.113.133]) [200.5.113.133]:15140: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)200.5.113.1333865483es  -U) ossec13001i:Exim Auth failed2025-11-18 06:22:24 dovecot_login authenticator failed for ([61.51.81.78]) [222.128.15.127]:50610: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)222.128.15.1271814991+r  e)+ ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:22:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822+q  e1# ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:22:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750p  - + ossec13001i:Exim Auth failed2025-11-18 06:21:37 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:43542: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)122.187.221.1301269750ho  -[) ossec13001i:Exim Auth failed2025-11-18 06:21:33 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:36508: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)103.129.195.4312697502n  e9+ ossec9710i:Dovecot Auth failed on disconnected session.Nov 18 06:21:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758     9^.?IZo]  -E) ossec13001i;rExim Auth failed2025-11-18 06:25:05 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:39718: 535 Incorrect authentication data (set_id=alex.vendas)218.156.93.2031835841g  -W+ ossec13001i;hExim Auth failed2025-11-18 06:24:55 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:64656: 535 Incorrect authentication data (set_id=sec.geral)207.200.180.1746252001k  -e% ossec13001i;bExim Auth failed2025-11-18 06:24:50 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:38548: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)175.206.1.601835841r  -q' ossec13001i;XExim Auth failed2025-11-18 06:24:40 dovecot_login authenticator failed for ([95.66.178.169]) [95.66.178.169]:48855: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)95.66.178.1692017370R  -7# ossec13001i;:Exim Auth failed2025-11-18 06:24:10 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:43291: 535 Incorrect authentication data (set_id=financeiro)5.30.196.79290557e  -Y% ossec13001i;lExim Auth failed2025-11-18 06:24:59 dovecot_login authenticator failed for 153-27-58-67.gci.net [67.58.27.153]:59436: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)67.58.27.1536252001,  e-) ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:23:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044,  e3# ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:23:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001W  -?' ossec13001i;Exim Auth failed2025-11-18 06:23:19 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:54162: 535 Incorrect authentication data (set_id=marialuiza)185.34.17.25099237_  -I) ossec13001i;Exim Auth failed2025-11-18 06:23:30 dovecot_login authenticator failed for ([222.175.187.214]) [218.59.235.170]:46608: 535 Incorrect authentication data (set_id=junior.gomes)218.59.235.1701814991g  -W+ ossec13001i;Exim Auth failed2025-11-18 06:23:28 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1032: 535 Incorrect authentication data (set_id=aureovieira)186.179.100.1293686110  -% ossec13001i;Exim Auth failed2025-11-18 06:23:18 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:55045: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)85.152.57.602510769  -' ossec13001i;,Exim Auth failed2025-11-18 06:23:55 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:57426: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)182.76.86.1301269750m  S=+ ossec11000i;Login failed on the cpanel service.[2025-11-18 06:23:36 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect124.198.131.1076252001~ W' ossec9708i;Dovecot Aborted Login with empty userNov 18 06:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]}  -I' ossec13001i:Exim Auth failed2025-11-18 06:22:45 dovecot_login authenticator failed for ([87.201.160.53]) [87.201.160.53]:42566: 535 Incorrect authentication data (set_id=administrativo1)87.201.160.53290557    Y  -=) ossec13001i;Exim Auth failed2025-11-18 06:26:38 dovecot_login authenticator failed for ([220.172.203.43]) [220.172.203.43]:34102: 535 Incorrect authentication data (set_id=contato)220.172.203.431814991  - + ossec13001i;Exim Auth failed2025-11-18 06:25:29 dovecot_login authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:55216: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)122.187.225.2201269750.  e1) ossec9710i;zDovecot Auth failed on disconnected session.Nov 18 06:25:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044  W' ossec9708i;Dovecot Aborted Login with empty userNov 18 06:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -[) ossec13001i;Exim Auth failed2025-11-18 06:25:47 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:48078: 535 Incorrect authentication data (set_id=marialuiza)121.202.143.881819730l  -a+ ossec13001i;Exim Auth failed2025-11-18 06:25:36 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63676: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651  k' ossec9709i;Multiple Dovecot Aborted Logins with empty userNov 18 06:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  e5' ossec9710i;ZDovecot Auth failed on disconnected session.Nov 18 06:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991q  -k+ ossec13001i;XExim Auth failed2025-11-18 06:24:39 dovecot_login authenticator failed for ([180.100.212.177]) [180.100.212.177]:35338: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)180.100.212.1771814991Y  -=) ossec13001i;JExim Auth failed2025-11-18 06:24:25 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:52291: 535 Incorrect authentication data (set_id=contato)158.222.23.2456252001Y  -E% ossec13001i;nExim Auth failed2025-11-18 06:25:01 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:48157: 535 Incorrect authentication data (set_id=paulinho.vendas)65.20.130.9599237&  e+ ossec9710i;\Dovecot Auth failed on disconnected session.Nov 18 06:24:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001 W' ossec9708i;PDovecot Aborted Login with empty userNov 18 06:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s  -q) ossec13001i;LExim Auth failed2025-11-18 06:24:28 dovecot_login authenticator failed for (159-179-77-186.enitel.net.ni) [186.77.179.159]:35744: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)186.77.179.1593617476s  -s' ossec13001i;<Exim Auth failed2025-11-18 06:24:11 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:37814: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)173.17.163.446252001 9 \ &p93(  e;) ossec9710i<,Dovecot Auth failed on disconnected session.Nov 18 06:28:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044,'  e++ ossec9710i<&Dovecot Auth failed on disconnected session.Nov 18 06:28:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001.&  e9! ossec9710i<Dovecot Auth failed on disconnected session.Nov 18 06:27:41 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=61.2.44.54, lip=200.150.196.245, TLS, session=61.2.44.541269750% W' ossec9708i<Dovecot Aborted Login with empty userNov 18 06:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]$ -C) ossec13001i;Exim Auth failed2025-11-18 06:27:26 dovecot_login authenticator failed for (User) [177.74.174.120]:61057: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)177.74.174.1203469034#  e% ossec9710i<&Dovecot Auth failed on disconnected session.Nov 18 06:28:06 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=61.73.190.98, lip=200.150.196.245, TLS, session=61.73.190.981835841"  -) ossec13001i;Exim Auth failed2025-11-18 06:26:13 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:36950: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)125.23.155.1101269750(!  e'' ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:27:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<2kT7ENtDdo4v+yzS>47.251.44.21062520012 e7) ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:26:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044-  e-+ ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:26:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001 W' ossec9708i;Dovecot Aborted Login with empty userNov 18 06:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  e/' ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:27:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867%  e!' ossec9710i;Dovecot Auth failed on disconnected session.Nov 18 06:26:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991   f ? i6  -_) ossec13001i<Exim Auth failed2025-11-18 06:30:09 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:38950: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)196.190.43.167337996'5  e%' ossec9710i<Dovecot Auth failed on disconnected session.Nov 18 06:29:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822'4  e%' ossec9710i<Dovecot Auth failed on disconnected session.Nov 18 06:29:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<0QHBGttDFt8tPZWl>45.61.149.16562520013  Sq' ossec11000i<Login failed on the cpanel service.[2025-11-18 06:29:43 -0300] info [cpaneld] 45.115.81.146 - deproico "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password45.115.81.14618317222 W' ossec9708i<~Dovecot Aborted Login with empty userNov 18 06:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[1  -?+ ossec13001i, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044v/  -y' ossec13001i, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084#-  e!# ossec9710i<8Dovecot Auth failed on disconnected session.Nov 18 06:28:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<3Z68FdtDwuhCYSpH>66.97.42.713865483,  W' ossec9708i<`Dovecot Aborted Login with empty userNov 18 06:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  k' ossec9709i, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.*  e1) ossec9710i<0Dovecot Auth failed on disconnected session.Nov 18 06:28:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841()  e)% ossec9710i<.Dovecot Auth failed on disconnected session.Nov 18 06:28:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<+HUxFdtDKMVvAEul>111.0.75.1651814991 * E,D*F W' ossec9708i=0Dovecot Aborted Login with empty userNov 18 06:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dE  -U' ossec13001i='Exim Auth failed2025-11-18 06:32:22 dovecot_login authenticator failed for ([58.56.128.190]) [58.56.128.190]:46742: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)58.56.128.1901814991D  W' ossec9708i=Dovecot Aborted Login with empty userNov 18 06:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034OC  -/# ossec13001i= Exim Auth failed2025-11-18 06:31:53 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:50514: 535 Incorrect authentication data (set_id=xavier)36.39.140.21835841tB  -s) ossec13001i=Exim Auth failed2025-11-18 06:31:45 dovecot_login authenticator failed for (argument.net.tomline.ru) [213.183.100.27]:60772: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)213.183.100.272017370A  -+ ossec13001i<Exim Auth failed2025-11-18 06:31:39 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:59510: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)166.195.195.1696252001d@  -U' ossec13001i<Exim Auth failed2025-11-18 06:31:29 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:51612: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)125.20.253.861269750u?  -u) ossec13001i<Exim Auth failed2025-11-18 06:31:12 dovecot_login authenticator failed for ([120.224.56.242]) [120.224.56.242]:33474: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)120.224.56.2421814991r>  -u% ossec13001i= Exim Auth failed2025-11-18 06:31:56 dovecot_login authenticator failed for 89-67-54-224.dynamic.play.pl [89.67.54.224]:34055: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)89.67.54.224798544Q=  -1' ossec13001i= Exim Auth failed2025-11-18 06:31:52 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:59861: 535 Incorrect authentication data (set_id=adm)94.20.234.161587116<  k' ossec9709i<Multiple Dovecot Aborted Logins with empty userNov 18 06:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^;  -I' ossec13001i<Exim Auth failed2025-11-18 06:31:29 dovecot_login authenticator failed for ([60.167.19.189]) [60.167.19.189]:33203: 535 Incorrect authentication data (set_id=paulinho.vendas)60.167.19.1891814991*:  e)) ossec9710i<Dovecot Auth failed on disconnected session.Nov 18 06:31:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.4712697509 Sq# ossec11000i<Login failed on the cpanel service.[2025-11-18 06:30:50 -0300] info [cpaneld] 77.68.78.42 - lixadora "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadora (has_cpuser_file failed)77.68.78.4226351678 W' ossec9708i<Dovecot Aborted Login with empty userNov 18 06:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2mKLHdtD8JuxV3kv>177.87.121.473469034a7  -K+ ossec13001i<Exim Auth failed2025-11-18 06:30:28 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:47926: 535 Incorrect authentication data (set_id=sandromiguel)101.127.101.2251880251 S h u e ag]V -C) ossec13001i=uExim Auth failed2025-11-18 06:33:40 dovecot_login authenticator failed for (User) [177.74.174.120]:63608: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)177.74.174.1203469034uU  -u) ossec13001i=cExim Auth failed2025-11-18 06:33:22 dovecot_login authenticator failed for ([95.221.232.167]) [95.221.232.167]:52612: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)95.221.232.1672017370$T  e' ossec9710i=]Dovecot Auth failed on disconnected session.Nov 18 06:33:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001fS  -Y' ossec13001i=}Exim Auth failed2025-11-18 06:33:47 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:60622: 535 Incorrect authentication data (set_id=envios@comercial.art.br)125.19.251.901269750[R  -?+ ossec13001i=gExim Auth failed2025-11-18 06:33:25 dovecot_login authenticator failed for ([121.164.135.251]) [121.164.135.251]:34301: 535 Incorrect authentication data (set_id=marcos)121.164.135.2511835841UQ  -9' ossec13001i=_Exim Auth failed2025-11-18 06:33:18 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:63063: 535 Incorrect authentication data (set_id=adriana)94.205.250.78290557vP  -u+ ossec13001i=NExim Auth failed2025-11-18 06:33:02 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52115: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)181.191.136.14134690346O  eA) ossec9710i=NDovecot Auth failed on disconnected session.Nov 18 06:33:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750N  - ) ossec13001i=>Exim Auth failed2025-11-18 06:32:45 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:56551: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)220.246.66.2091819730jM  -]+ ossec13001i=8Exim Auth failed2025-11-18 06:32:39 dovecot_login authenticator failed for ([103.130.207.227]) [103.130.207.227]:40820: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)103.130.207.2271282988UL  -7' ossec13001i=Exim Auth failed2025-11-18 06:32:07 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:52328: 535 Incorrect authentication data (set_id=gerson)187.6.121.2463469034 K  -%' ossec13001i=QExim Auth failed2025-11-18 06:33:04 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:40406: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)108.30.14.2216252001oJ  -q# ossec13001i=HExim Auth failed2025-11-18 06:32:56 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:55770: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)89.67.37.52798544gI  -Y) ossec13001i=FExim Auth failed2025-11-18 06:32:54 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:44402: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)200.199.32.1743469034HH  -) ossec13001i=>Exim Auth failed2025-11-18 06:32:45 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:35702: 535 Incorrect authentication data111.26.177.2161814991]G  -G) ossec13001i=6Exim Auth failed2025-11-18 06:32:37 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:32876: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549  dXjoV~(e  e'' ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822, rip=177.87.121.47, lip=200.150.196.245, session=<0AmgLdtD7pqxV3kv>177.87.121.473469034$a  e## ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:34:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483O`  -1# ossec13001i=]Exim Auth failed2025-11-18 06:33:16 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:59102: 535 Incorrect authentication data (set_id=contato)5.30.196.79290557j_  -]+ ossec13001i=YExim Auth failed2025-11-18 06:33:12 dovecot_login authenticator failed for ([110.185.173.167]) [110.185.173.167]:40328: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)110.185.173.1671814991*^  e-% ossec9710i=UDovecot Auth failed on disconnected session.Nov 18 06:33:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<21WaJttDMMJ3xBIC>119.196.18.21835841Z]  -=+ ossec13001i=Exim Auth failed2025-11-18 06:33:51 dovecot_login authenticator failed for ([210.211.111.147]) [210.211.111.149]:37342: 535 Incorrect authentication data (set_id=bruno)210.211.111.14915628227\  eE' ossec9710i=kDovecot Auth failed on disconnected session.Nov 18 06:33:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.616430844[  e?' ossec9710i=wDovecot Auth failed on disconnected session.Nov 18 06:33:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651Z W' ossec9708i=mDovecot Aborted Login with empty userNov 18 06:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034eY  -]% ossec13001i=YExim Auth failed2025-11-18 06:33:12 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:40639: 535 Incorrect authentication data (set_id=marcos@maringasoldas.com.br)65.20.131.6399237nX  -g) ossec13001i=Exim Auth failed2025-11-18 06:33:54 dovecot_login authenticator failed for ([121.148.184.47]) [121.148.184.47]:36327: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)121.148.184.4718358410W e5' ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:33:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<+blfKdtDaK4rmxBp>43.155.16.1051819730  wLl:es  -[# ossec13001i>!Exim Auth failed2025-11-18 06:36:31 dovecot_login authenticator failed for ([59.6.75.186]) [59.6.75.186]:46608: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)59.6.75.1861835841r W' ossec9708i=Dovecot Aborted Login with empty userNov 18 06:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342q e;% ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:35:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=47.251.0.21662520011p  e5+ ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 06:36:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001.o  e5% ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:35:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841\n  -I% ossec13001i=Exim Auth failed2025-11-18 06:34:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63559: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758'm  e'% ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:34:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370l  -% ossec13001i=Exim Auth failed2025-11-18 06:34:16 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:42262: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)179.42.49.3434690340k  e9% ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:34:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001(j  e#+ ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:34:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001\i  -A+ ossec13001i=Exim Auth failed2025-11-18 06:34:10 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:49465: 535 Incorrect authentication data (set_id=contato)121.131.220.14418358410h  e5) ossec9710i=Dovecot Auth failed on disconnected session.Nov 18 06:34:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387eg  -U) ossec13001i=Exim Auth failed2025-11-18 06:34:42 dovecot_login authenticator failed for ([218.93.229.146]) [218.93.229.146]:40289: 535 Incorrect authentication data (set_id=andressa.financeiro)218.93.229.1461814991f  k' ossec9709i=Multiple Dovecot Aborted Logins with empty userNov 18 06:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  8 U N 4 |R   -+ ossec13001i>}Exim Auth failed2025-11-18 06:38:04 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:47839: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)182.239.109.2081819730  W' ossec9708i>{Dovecot Aborted Login with empty userNov 18 06:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0VdYONtDROGxV3kv>177.87.121.473469034#  3K) ossec11301i>SNew FTP connection.Nov 18 06:37:21 hosting pure-ftpd: (?@91.196.152.127) [INFO] New connection from 91.196.152.12791.196.152.1273017382   3G' ossec11301i>QNew FTP connection.Nov 18 06:37:19 hosting pure-ftpd: (?@91.196.152.37) [INFO] New connection from 91.196.152.3791.196.152.373017382&~  e%% ossec9710i>GDovecot Auth failed on disconnected session.Nov 18 06:37:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.3862520012}  e7+ ossec9710i>wDovecot Auth failed on disconnected session.Nov 18 06:37:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<6JntN9tDbG1o7MS0>104.236.196.1806252001+|  e-' ossec9710i>gDovecot Auth failed on disconnected session.Nov 18 06:37:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001{  k' ossec9709i>]Multiple Dovecot Aborted Logins with empty userNov 18 06:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,z  e-) ossec9710i>EDovecot Auth failed on disconnected session.Nov 18 06:37:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044y W' ossec9708i>!Dovecot Aborted Login with empty userNov 18 06:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x  -+ ossec13001i>Exim Auth failed2025-11-18 06:36:13 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:58371: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)166.201.209.1526252001_w  -K' ossec13001i>=Exim Auth failed2025-11-18 06:37:00 dovecot_login authenticator failed for ([120.194.50.39]) [120.194.50.39]:16486: 535 Incorrect authentication data (set_id=marcelo.pinheiro)120.194.50.391814991[v  -?+ ossec13001i>/Exim Auth failed2025-11-18 06:36:46 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:60656: 535 Incorrect authentication data (set_id=wesley)111.170.146.1771814991xu  -y+ ossec13001i>'Exim Auth failed2025-11-18 06:36:39 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:44964: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)220.180.171.1571814991it -[) ossec13001i>#Exim Auth failed2025-11-18 06:36:34 dovecot_plain authenticator failed for ([10.181.195.229]) [170.39.216.210]:62051: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)170.39.216.2103017382  p CZqNerz  -) ossec13001i>Exim Auth failed2025-11-18 06:39:58 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:54028: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)42.200.196.1411819730Z  -A' ossec13001i>Exim Auth failed2025-11-18 06:39:43 dovecot_login authenticator failed for ([176.226.163.5]) [176.226.163.5]:54506: 535 Incorrect authentication data (set_id=aureovieira)176.226.163.52017370 W' ossec9708i>Dovecot Aborted Login with empty userNov 18 06:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -7' ossec13001i>Exim Auth failed2025-11-18 06:39:19 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:46392: 535 Incorrect authentication data (set_id=envios)182.78.144.341269750e  -W' ossec13001i>Exim Auth failed2025-11-18 06:39:18 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:41424: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)193.95.24.11724644611  e;' ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 06:40:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758j  -]+ ossec13001i>Exim Auth failed2025-11-18 06:39:59 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:40950: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)222.108.177.1101835841e  -Y' ossec13001i>Exim Auth failed2025-11-18 06:38:53 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:57653: 535 Incorrect authentication data (set_id=envios@comercial.art.br)94.207.19.166290557e  -W' ossec13001i>Exim Auth failed2025-11-18 06:38:52 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:52318: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)27.123.113.861269750)  e%+ ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 06:38:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991 W' ossec9708i>Dovecot Aborted Login with empty userNov 18 06:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340  e7' ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 06:39:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991(  e%) ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 06:38:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<1k5vO9tDLKsO4dKR>14.225.210.1451562822.  e1) ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 06:38:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044`  -K) ossec13001i>Exim Auth failed2025-11-18 06:38:29 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:47780: 535 Incorrect authentication data (set_id=paulinho.vendas)122.184.120.981269750 / ( ;  -\  -A+ ossec13001i?Exim Auth failed2025-11-18 06:40:21 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:60542: 535 Incorrect authentication data (set_id=compras)200.107.163.1953932488  W' ossec9708i?/Dovecot Aborted Login with empty userNov 18 06:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -K+ ossec13001i?+Exim Auth failed2025-11-18 06:40:59 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52063: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034s  -o+ ossec13001i?Exim Auth failed2025-11-18 06:40:35 dovecot_login authenticator failed for ([109.233.215.154]) [109.233.215.154]:38376: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)109.233.215.1542017370  k' ossec9709i?Multiple Dovecot Aborted Logins with empty userNov 18 06:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0nlNQdtDuLKxV3kv>177.87.121.473469034m  -g' ossec13001i?Exim Auth failed2025-11-18 06:40:18 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:40608: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)183.171.53.821733045$  e) ossec9710i?3Dovecot Auth failed on disconnected session.Nov 18 06:41:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841\  -A+ ossec13001i?Exim Auth failed2025-11-18 06:40:47 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:51889: 535 Incorrect authentication data (set_id=contato)116.199.171.2461269750  -' ossec13001i?Exim Auth failed2025-11-18 06:40:44 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:47572: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)122.186.91.501269750#  e% ossec9710i?'Dovecot Auth failed on disconnected session.Nov 18 06:40:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991i  -]) ossec13001i?%Exim Auth failed2025-11-18 06:40:51 dovecot_login authenticator failed for (static.92.254.104.190.cps.com.ar) [190.104.254.91]:56774: 535 Incorrect authentication data (set_id=compras)190.104.254.913865483S  -5% ossec13001i?Exim Auth failed2025-11-18 06:40:46 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:54408: 535 Incorrect authentication data (set_id=compras)77.41.156.642017370,  e-) ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:40:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001h  -_% ossec13001i?Exim Auth failed2025-11-18 06:40:19 dovecot_login authenticator failed for ([36.96.36.174]) [36.96.36.174]:54699: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)36.96.36.1741814991a  -Q% ossec13001i?Exim Auth failed2025-11-18 06:40:16 dovecot_login authenticator failed for ([59.16.192.32]) [59.16.192.32]:52308: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)59.16.192.321835841 * x n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R  * H > 4 vD:0lbXN&,|"TJ@h6r^xZndPF<2( VL~tj`$B8. p\fRH>4*z | r h ^ T J @ 6 , "     vlbXND:0& iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB$ iB~# iB# iB# iB# iBN# iBF# iB|# iBx# iBr# iBZ# iB!# iB# iB# iB># iB5# iB)# iA# iA# iA# iA# iA# iA# iA# iA# iA# iA# iA# iA# iA}# iAi# iAQ# iA.# iAJ# iA<# i@# i@# i@# iA # iA# i@# i@# i@# i@# i@# i@# i@# i@# i@# i@{# i@y# i@u# i@i# i@a# i@# i@# i@w# i@w# i@# i@# i@# i@i# i@M# i@A# i@=# i@;# i@# i@ # i@# i?# i?# i?# i?# i?# i?# i?# i?# i?# i?# i?y# i?y# i?w# i?# i?# i?# i?# i?7# i?m# i?m# i?[# i?S# i?5# i?S# i?M# i?A# i?=# i?# i?/# i?+# i?# i?# i?# i?3# i?# i?# i?'# i?%# i?# i?# i?# i?# i># i># i># i># i># i># i># i># i># i># i># i># i># i># i># i>}# i>{# i>w#} i>g#| i>]#{ i>S# i>Q# i>G#~ i>E#z i>=#w i>/#v i>'#u i>##t i>!#y i>!#s i>#x i>#p i=#o i=#r i=#q i=#b i=#m i=#h i=#g i=#j i;#$ i;#! i;# i;# i;# i;# i;# i;# i;#" i;# i;# i;# i;# i;# iC$C iC$< iC$= iC$; iC$: iC$9 iC$8 iCy$7 iCs$6 iCm$5 iCg$1 iC]$0 iC[$3 iCK$/ iCI$. iCG$4 iC=$- iC3$2 iC/$) iC+$ iC'$( iC#$! iC$' iC$ iC$ iC$$ iC$# iC$& iC$ iC $ iC $, iC $% iC$+ iB$" iB$ iB$* i=#k i=#a i=#f i=#e i=#c i=#n i=#l i=#d i=#i i=#X i=#W i=#] i=}#S i=w#[ i=u#V i=m#Z i=k#\ i=g#R i=c#U i=_#Q i=]#` i=]#T i=Y#_ i=Y#Y i=U#^ i=Q#K i=N#P i=N#O i=H#J i=F#I i=>#N i=>#H i=8#M i=6#G i=0#F i='#E i=#L i=#D i= #> i= #C i= #= i=#BF iC$? i<#A i<#< i<#@ i<#; i<#: i<#? i<#9 i<#8 i<#7 i<#6 i<#5 i<#4 i<#3 i<~#2 i, rip=177.87.121.47, lip=200.150.196.245, session=<8mh4SNtDnt6xV3kv>177.87.121.473469034*  -++ ossec13001i?7Exim Auth failed2025-11-18 06:41:10 dovecot_login authenticator failed for (122.156.170.222.broad.sh.hl.dynamic.163data.com.cn) [222.170.156.122]:41551: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)222.170.156.1221814991i)  -_' ossec13001i?mExim Auth failed2025-11-18 06:42:04 dovecot_login authenticator failed for 111-70-33-163.emome-ip.hinet.net [111.70.33.163]:39808: 535 Incorrect authentication data (set_id=presidencia)111.70.33.16316682841(  e7) ossec9710i?mDovecot Auth failed on disconnected session.Nov 18 06:42:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730['  -?+ ossec13001i?[Exim Auth failed2025-11-18 06:41:46 dovecot_login authenticator failed for ([218.75.123.109]) [183.247.171.186]:39622: 535 Incorrect authentication data (set_id=compras)183.247.171.1861814991m&  -i% ossec13001i?SExim Auth failed2025-11-18 06:41:38 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:37422: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)125.19.156.21269750V%  -9' ossec13001i?5Exim Auth failed2025-11-18 06:41:08 dovecot_login authenticator failed for ([93.102.241.68]) [93.102.241.68]:59812: 535 Incorrect authentication data (set_id=compras)93.102.241.682264397T$  -5' ossec13001i?SExim Auth failed2025-11-18 06:41:38 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:35324: 535 Incorrect authentication data (set_id=lucas)182.95.115.381269750# W' ossec9708i?MDovecot Aborted Login with empty userNov 18 06:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e"  -U+ ossec13001i?AExim Auth failed2025-11-18 06:41:21 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:60481: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795"!  e) ossec9710i?=Dovecot Auth failed on disconnected session.Nov 18 06:41:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044  iF/=  e1+ ossec9710i@ Dovecot Auth failed on disconnected session.Nov 18 06:44:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001< W' ossec9708i@Dovecot Aborted Login with empty userNov 18 06:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j;  -a' ossec13001i?Exim Auth failed2025-11-18 06:44:29 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:51306: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)88.84.209.1462017370.:  e5% ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:44:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001$9  e!' ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:43:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758&8  e!) ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:43:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.10129210447  k' ossec9709i?Multiple Dovecot Aborted Logins with empty userNov 18 06:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$6  e## ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:43:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.9562520015  W' ossec9708i?Dovecot Aborted Login with empty userNov 18 06:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,4  e-) ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:43:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<6Nl/TdtD3IGB4rs4>129.226.187.561819730e3 -Q+ ossec13001i?Exim Auth failed2025-11-18 06:43:56 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51988: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.141346903432  e=' ossec9710i?Dovecot Auth failed on disconnected session.Nov 18 06:43:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<3LuJTNtDtIykXF7M>164.92.94.2046252001b1  -M+ ossec13001i?yExim Auth failed2025-11-18 06:42:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52180: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.14134690340  e# ossec9710i?yDovecot Auth failed on disconnected session.Nov 18 06:42:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750  j :!3K  e?% ossec9710i@aDovecot Auth failed on disconnected session.Nov 18 06:46:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841mJ  -e+ ossec13001i@Exim Auth failed2025-11-18 06:46:58 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:55466: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)178.250.191.189458258YI  -=) ossec13001i@Exim Auth failed2025-11-18 06:46:45 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:43944: 535 Incorrect authentication data (set_id=brizola)103.250.160.761269750nH  -g) ossec13001i@wExim Auth failed2025-11-18 06:46:31 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:56777: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)103.129.195.4312697503G  e9+ ossec9710i@wDovecot Auth failed on disconnected session.Nov 18 06:46:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822$F  e## ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:47:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750-E  e-+ ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:46:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991D  W' ossec9708i@Dovecot Aborted Login with empty userNov 18 06:47:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,C  e++ ossec9710i@iDovecot Auth failed on disconnected session.Nov 18 06:46:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841(B  e%) ossec9710i@MDovecot Auth failed on disconnected session.Nov 18 06:45:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.5562520013A  e;) ossec9710i@ADovecot Auth failed on disconnected session.Nov 18 06:45:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387@ W' ossec9708i@=Dovecot Aborted Login with empty userNov 18 06:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.?  e1) ossec9710i@;Dovecot Auth failed on disconnected session.Nov 18 06:45:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<7b3xUttDQI/SchJs>210.114.18.1081835841c>  -U% ossec13001i@Exim Auth failed2025-11-18 06:44:51 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:38352: 535 Incorrect authentication data (set_id=lucas)179.42.49.343469034  z D m SG:pY  -i+ ossec13001iAExim Auth failed2025-11-18 06:48:47 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:38596: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)128.185.235.1101269750PX  -3% ossec13001i@Exim Auth failed2025-11-18 06:48:37 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:56202: 535 Incorrect authentication data (set_id=wesley)65.20.158.10992378W  eC+ ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:48:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001+V  e1# ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:47:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001"U  e% ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:47:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060YT  -C% ossec13001i@Exim Auth failed2025-11-18 06:47:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:54346: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758,S  e/' ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:47:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001R  -' ossec13001i@Exim Auth failed2025-11-18 06:48:02 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:44798: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)50.212.27.1506252001Q W' ossec9708i@Dovecot Aborted Login with empty userNov 18 06:47:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9TlaWttD6uSxV3kv>177.87.121.473469034SP  -5% ossec13001i@Exim Auth failed2025-11-18 06:47:29 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:57528: 535 Incorrect authentication data (set_id=cpanel)115.77.111.215628222O  e=% ossec9710i@{Dovecot Auth failed on disconnected session.Nov 18 06:46:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382N  k' ossec9709i@yMultiple Dovecot Aborted Logins with empty userNov 18 06:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)M  e') ossec9710i@uDovecot Auth failed on disconnected session.Nov 18 06:46:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<9JppVttDUNRA44h6>64.227.136.12212697502L  e9) ossec9710i@iDovecot Auth failed on disconnected session.Nov 18 06:46:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730 L d J  l~HfLg W' ossec9708iADovecot Aborted Login with empty userNov 18 06:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^f  -G) ossec13001iAExim Auth failed2025-11-18 06:51:13 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:47935: 535 Incorrect authentication data (set_id=sandromiguel)118.45.101.15918358412e  e9) ossec9710iADovecot Auth failed on disconnected session.Nov 18 06:51:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730jd  -_) ossec13001iAExim Auth failed2025-11-18 06:50:57 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:33396: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)125.20.245.1821269750+c  e/% ossec9710iA}Dovecot Auth failed on disconnected session.Nov 18 06:50:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<1TkNZttDN6J3xBIC>119.196.18.21835841b W' ossec9708iAiDovecot Aborted Login with empty userNov 18 06:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&a  e!) ossec9710iAQDovecot Auth failed on disconnected session.Nov 18 06:50:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387`  k' ossec9709iA.Multiple Dovecot Aborted Logins with empty userNov 18 06:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  W' ossec9708iAJDovecot Aborted Login with empty userNov 18 06:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+^  e-' ossec9710iA<Dovecot Auth failed on disconnected session.Nov 18 06:49:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001] W' ossec9708i@Dovecot Aborted Login with empty userNov 18 06:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344\  e?' ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:48:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822/[  e5' ossec9710i@Dovecot Auth failed on disconnected session.Nov 18 06:48:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001-Z  e/) ossec9710iA Dovecot Auth failed on disconnected session.Nov 18 06:48:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=167.71.230.2301269750  6~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& ]PC6wj}pcVI</" znbVJ>2&~rfZNB6* 6252001. 6252001. 6252001. 6252001. 6252001. 6252001/ 6252001/ 6252001/ 6252001/ 6252001/| 6290252/` 6252001/> 6252001/ 6252001/ 6252001/ 6252001/ 6290252/ 690791 T 690791  690791 690791 690791 690791 690791 Q 690791 690791 690791 690791u 690791$ 690791 690791 660013-( 660013+L 660013+G 660013+F 660013+C 660013+< 660013+; 660013+9 660013+8 660013)E 660013( 660013" 660013 D 660013 660013 660013 660013[ 660013 660013 6600134 660013 660013C 660013 660013- 630336)C 630336 630336 630336 630336 630336 9 630336 g 6290252- 6290252-2 6290252! 6290252d 6290252 6290252 6290252 6290252 6290252 6290252 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001.} 6252001.t 6252001.q 6252001._ 6252001.\ 6252001.Z 6252001.Q 6252001.E 6252001.A 6252001.; 6252001.# 6252001. 6252001. 6252001. 6252001. 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001-} 6252001-t 6252001-p 6252001-g 6252001-] 6252001-Y 6252001-W 6252001-R 6252001-K 6252001-I 6252001-A 6252001-? 6252001-; 6252001-6 6252001-! 6252001- 6252001- 6252001- 6252001- 6252001- 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001,b 6252001,Y 6252001,R 6252001,Q 6252001,7 6252001,, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+u 6252001+h 6252001+g 6252001+d 6252001+T 6252001+: 6252001+2 6252001+/ 6252001+ 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001*p 6252001*f 6252001*_ 6252001*V 6252001*R 6252001*D 6252001*@ 6252001*> 6252001*, 6252001* 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001)v 6252001)u 6252001)r 6252001)_ 6252001)S 6252001)R 6252001)M 6252001)H 6252001)A 6252001); 6252001)7 6252001)* 6252001) 6252001) 6252001) 6252001) 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001(~ 6252001(n 6252001(a 6252001(] 6252001(X 6252001(N 6252001(G 6252001(= 6252001(; 6252001(2 6252001(/ 6252001(+ 6252001(" 6252001( 6252001( 6252001' 6252001' 6252001'N 6252001/ 6252001/ 6252001/    $ v W' ossec9708iBZDovecot Aborted Login with empty userNov 18 06:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u W+ ossec9708iB!Dovecot Aborted Login with empty userNov 18 06:53:36 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034t W' ossec9708iBDovecot Aborted Login with empty userNov 18 06:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Us  -7' ossec13001iBExim Auth failed2025-11-18 06:53:22 dovecot_login authenticator failed for ([124.67.121.58]) [124.67.121.58]:48965: 535 Incorrect authentication data (set_id=rafael)124.67.121.581814991Vr  -9' ossec13001iB>Exim Auth failed2025-11-18 06:54:05 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:45138: 535 Incorrect authentication data (set_id=contato)121.73.163.1921862242q  e9) ossec9710iB5Dovecot Auth failed on disconnected session.Nov 18 06:53:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<668qcdtDcI2B4kCN>129.226.64.1411819730op  -i) ossec13001iB)Exim Auth failed2025-11-18 06:53:44 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:47888: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)210.219.232.341835841o  W' ossec9708iADovecot Aborted Login with empty userNov 18 06:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ln  -c) ossec13001iAExim Auth failed2025-11-18 06:53:00 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:49318: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)221.209.48.2031814991cm  -U% ossec13001iAExim Auth failed2025-11-18 06:52:37 dovecot_login authenticator failed for 221-120-4-50.emome-ip.hinet.net [221.120.4.50]:36276: 535 Incorrect authentication data (set_id=juridico)221.120.4.501668284l  k' ossec9709iAMultiple Dovecot Aborted Logins with empty userNov 18 06:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1y0zbNtDjOaxV3kv>177.87.121.473469034^k  -I' ossec13001iAExim Auth failed2025-11-18 06:52:22 dovecot_login authenticator failed for ([5.141.122.210]) [5.141.122.210]:35226: 535 Incorrect authentication data (set_id=paulinho.vendas)5.141.122.2102017370gj  -]% ossec13001iAExim Auth failed2025-11-18 06:52:20 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:37856: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)111.26.63.831814991 i  e# ossec9710iADovecot Auth failed on disconnected session.Nov 18 06:52:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001xh  -y+ ossec13001iAExim Auth failed2025-11-18 06:51:55 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:38174: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)122.224.154.1661814991 2 , A   'DN+&K]2'  e#) ossec9710iBDovecot Auth failed on disconnected session.Nov 18 06:55:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841j  -]+ ossec13001iBExim Auth failed2025-11-18 06:55:54 dovecot_login authenticator failed for (mail.highqualityautoparts.com.br) [111.122.211.212]:8652: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991W  -9) ossec13001iBExim Auth failed2025-11-18 06:55:21 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:51682: 535 Incorrect authentication data (set_id=comercial)218.28.168.1901814991V  -9' ossec13001iBExim Auth failed2025-11-18 06:55:11 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:52177: 535 Incorrect authentication data (set_id=adriana)222.92.61.2421814991l  -c) ossec13001iBExim Auth failed2025-11-18 06:55:56 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:33524: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)221.10.226.19618149917  eE' ossec9710iBDovecot Auth failed on disconnected session.Nov 18 06:55:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<8KE4eNtDcIeWXx+e>150.95.31.1581605651  k' ossec9709iBMultiple Dovecot Aborted Logins with empty userNov 18 06:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r  -q' ossec13001iB~Exim Auth failed2025-11-18 06:55:09 dovecot_login authenticator failed for ([123.52.202.92]) [123.52.202.92]:36642: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)123.52.202.921814991_~  -M% ossec13001iBExim Auth failed2025-11-18 06:55:24 dovecot_login authenticator failed for ([210.117.217.236]) [202.30.43.42]:34675: 535 Incorrect authentication data (set_id=marcelo.pinheiro)202.30.43.421835841h}  -[) ossec13001iBExim Auth failed2025-11-18 06:55:11 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:57082: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)178.178.222.562017370y|  -' ossec13001iBExim Auth failed2025-11-18 06:55:11 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:56346: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)31.151.70.1502750405-{  e1' ossec9710iBNDovecot Auth failed on disconnected session.Nov 18 06:54:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<2Pd6cttDBplSczCz>82.115.48.1791522867gz -U+ ossec13001iBFExim Auth failed2025-11-18 06:54:12 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52056: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034ly  -c) ossec13001iB|Exim Auth failed2025-11-18 06:55:07 dovecot_login authenticator failed for ([182.139.39.150]) [182.139.39.150]:48360: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)182.139.39.1501814991fx  ;K' ossec13008iBxMail Recipient rejected2025-11-18 06:55:03 H=(localhost) [179.0.178.104]:54336 F= rejected RCPT : Nenhuma pessoa no endereço."179.0.178.1043469034vw  -w) ossec13001iBrExim Auth failed2025-11-18 06:54:57 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:49454: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)121.73.168.1812186224 C  )  {  -+ ossec13001iBExim Auth failed2025-11-18 06:56:53 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1197: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)186.179.100.1293686110}  -' ossec13001iBExim Auth failed2025-11-18 06:56:41 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:35795: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)201.61.215.873469034(  e%) ossec9710iBDovecot Auth failed on disconnected session.Nov 18 06:56:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<4xS9edtDzLkv7PP+>47.236.243.2541880251\  -A+ ossec13001iBExim Auth failed2025-11-18 06:56:27 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:35308: 535 Incorrect authentication data (set_id=brizola)125.139.124.1201835841_  -O# ossec13001iBExim Auth failed2025-11-18 06:56:24 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:59808: 535 Incorrect authentication data (set_id=compras)111.70.32.51668284/  e1+ ossec9710iBDovecot Auth failed on disconnected session.Nov 18 06:57:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841 W' ossec9708iBDovecot Aborted Login with empty userNov 18 06:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001iBExim Auth failed2025-11-18 06:56:21 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:46876: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)69.112.28.1816252001  -+ ossec13001iBExim Auth failed2025-11-18 06:56:18 dovecot_login authenticator failed for (mail.highqualityautoparts.com.br) [111.122.211.212]:13410: 535 Incorrect authentication data (set_id=admin@highqualityautoparts.com.br)111.122.211.2121814991s  -o+ ossec13001iBExim Auth failed2025-11-18 06:56:59 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.248.115.172]:54055: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)171.248.115.1721562822X  -A# ossec13001iBExim Auth failed2025-11-18 06:56:47 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:58944: 535 Incorrect authentication data (set_id=administrativo1)24.121.1.616252001  W' ossec9708iBDovecot Aborted Login with empty userNov 18 06:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e)) ossec9710iBDovecot Auth failed on disconnected session.Nov 18 06:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750X  -A' ossec13001iBExim Auth failed2025-11-18 06:55:23 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:52833: 535 Incorrect authentication data (set_id=aureovieira)65.20.179.25199237]  -E) ossec13001iBExim Auth failed2025-11-18 06:55:21 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:50920: 535 Incorrect authentication data (set_id=alex.vendas)195.222.59.1573277605 #  7 R u[a6 4A>)$  e-% ossec9710iCDovecot Auth failed on disconnected session.Nov 18 06:57:45 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=94.200.20.66, lip=200.150.196.245, TLS, session=94.200.20.66290557#  - ' ossec13001iCExim Auth failed2025-11-18 06:57:43 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:46354: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)188.122.151.62661886o"  -g+ ossec13001iBExim Auth failed2025-11-18 06:57:17 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:56320: 535 Incorrect authentication data (set_id=juridico)190.121.192.2103595528S!  -5% ossec13001iC#Exim Auth failed2025-11-18 06:57:54 dovecot_login authenticator failed for ([60.15.194.58]) [60.15.194.58]:52722: 535 Incorrect authentication data (set_id=contato)60.15.194.581814991'  e%' ossec9710iCDovecot Auth failed on disconnected session.Nov 18 06:57:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<5ADOfttD8K87GIXF>59.24.133.1971835841'  e%' ossec9710iCDovecot Auth failed on disconnected session.Nov 18 06:57:40 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=58.49.113.138, lip=200.150.196.245, session=58.49.113.1381814991v  -w) ossec13001iCExim Auth failed2025-11-18 06:57:49 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:49665: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)175.43.184.2021814991 W' ossec9708iC Dovecot Aborted Login with empty userNov 18 06:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6iMVfttDLICxV3kv>177.87.121.473469034Y  -E# ossec13001iBExim Auth failed2025-11-18 06:57:15 dovecot_login authenticator failed for (31-154-85-196.orange.net.il) [2.55.85.196]:47919: 535 Incorrect authentication data (set_id=adm)2.55.85.196294640a  -M) ossec13001iC+Exim Auth failed2025-11-18 06:58:01 dovecot_login authenticator failed for ([157.230.66.74]) [137.184.193.67]:53204: 535 Incorrect authentication data (set_id=marcelo.pinheiro)137.184.193.676252001S  -5% ossec13001iBExim Auth failed2025-11-18 06:56:12 dovecot_login authenticator failed for ([221.2.153.49]) [221.2.153.49]:56442: 535 Incorrect authentication data (set_id=compras)221.2.153.491814991n  -g) ossec13001iBExim Auth failed2025-11-18 06:56:08 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40428: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)103.251.143.141269750m  -e) ossec13001iBExim Auth failed2025-11-18 06:57:04 dovecot_login authenticator failed for ([222.99.237.249]) [222.99.237.249]:54825: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)222.99.237.2491835841.  e1+ ossec9710iBDovecot Auth failed on disconnected session.Nov 18 06:57:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758Y  -?' ossec13001iBExim Auth failed2025-11-18 06:57:02 dovecot_login authenticator failed for ([119.126.90.69]) [119.126.90.69]:42982: 535 Incorrect authentication data (set_id=financeiro)119.126.90.691814991  d3  -U' ossec13001iC[Exim Auth failed2025-11-18 06:58:50 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:57016: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)182.95.59.1541269750 2  e) ossec9710iC3Dovecot Auth failed on disconnected session.Nov 18 06:58:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=124.167.20.116, lip=200.150.196.245, TLS, session=124.167.20.11618149911  W' ossec9708iCgDovecot Aborted Login with empty userNov 18 06:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903400  e;# ossec9710iC]Dovecot Auth failed on disconnected session.Nov 18 06:58:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483`/  -K) ossec13001iCKExim Auth failed2025-11-18 06:58:34 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:32870: 535 Incorrect authentication data (set_id=isabellylisboa)207.219.221.536251999.  k' ossec9709iCIMultiple Dovecot Aborted Logins with empty userNov 18 06:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v-  -y' ossec13001iC=Exim Auth failed2025-11-18 06:58:20 dovecot_login authenticator failed for ([121.185.89.74]) [121.185.89.74]:46638: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)121.185.89.741835841,  - ) ossec13001iC Exim Auth failed2025-11-18 06:57:29 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:38673: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)90.160.139.1632510769e+  -S+ ossec13001iCExim Auth failed2025-11-18 06:57:26 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63512: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651W*  -=% ossec13001iBExim Auth failed2025-11-18 06:57:12 dovecot_login authenticator failed for ([61.2.212.194]) [61.2.212.194]:36806: 535 Incorrect authentication data (set_id=vanessalima)61.2.212.19412697504)  e?' ossec9710iC/Dovecot Auth failed on disconnected session.Nov 18 06:58:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730^(  -E+ ossec13001iC'Exim Auth failed2025-11-18 06:57:57 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:2366: 535 Incorrect authentication data (set_id=financeiro)196.200.112.2372328926-'  e/) ossec9710iCDovecot Auth failed on disconnected session.Nov 18 06:57:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730&  -' ossec13001iCExim Auth failed2025-11-18 06:57:41 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:58295: 535 Incorrect authentication data (set_id=atualizacoes)179.184.33.863469034k%  -c' ossec13001iC Exim Auth failed2025-11-18 06:57:30 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:18550: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)58.49.113.1381814991  D    6G&*B  e'+ ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:01:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822*A  e)) ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:01:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<28dNjdtDxsOB4rs4>129.226.187.561819730&@  e%% ossec9710iCDovecot Auth failed on disconnected session.Nov 18 07:01:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841o?  -g+ ossec13001iCExim Auth failed2025-11-18 07:01:28 dovecot_login authenticator failed for ([180.100.212.177]) [180.100.212.177]:51908: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)180.100.212.1771814991`>  -M' ossec13001iDExim Auth failed2025-11-18 07:02:03 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62520: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.721819730= W' ossec9708iCDovecot Aborted Login with empty userNov 18 07:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,<  e1% ossec9710iCDovecot Auth failed on disconnected session.Nov 18 07:00:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841k;  -_+ ossec13001iCExim Auth failed2025-11-18 06:59:56 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53063: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651T:  -7% ossec13001iCExim Auth failed2025-11-18 06:59:55 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:48277: 535 Incorrect authentication data (set_id=rafael)61.72.59.1061835841g9  -Y) ossec13001iCExim Auth failed2025-11-18 06:59:40 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:34422: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)220.178.246.4318149918 W' ossec9708iCDovecot Aborted Login with empty userNov 18 06:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z7  -# ossec13001iCyExim Auth failed2025-11-18 06:59:20 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:38536: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)47.24.76.306252001/6  e5' ossec9710iCsDovecot Auth failed on disconnected session.Nov 18 06:59:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822X5  -A' ossec13001iCmExim Auth failed2025-11-18 06:59:08 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:41158: 535 Incorrect authentication data (set_id=aureovieira)65.20.171.11699237\4  -I% ossec13001iCGExim Auth failed2025-11-18 06:58:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58172: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758 i {aX[inQ  -i' ossec13001iDJExim Auth failed2025-11-18 07:02:49 dovecot_login authenticator failed for 80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:35536: 535 Incorrect authentication data (set_id=contato)80.15.223.1483017382yP  -}) ossec13001iD8Exim Auth failed2025-11-18 07:02:32 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:45522: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)110.25.105.2231668284O  -) ossec13001iD8Exim Auth failed2025-11-18 07:02:31 dovecot_login authenticator failed for (static-adsl190-250-78-191.une.net.co) [190.250.78.191]:65252: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)190.250.78.1913686110N W' ossec9708iD8Dovecot Aborted Login with empty userNov 18 07:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)M  e') ossec9710iDVDovecot Auth failed on disconnected session.Nov 18 07:03:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750yL  -}) ossec13001iDBExim Auth failed2025-11-18 07:02:42 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:38198: 535 Incorrect authentication data (set_id=vanessalima)216.80.100.2356252001]K  -G' ossec13001iD<Exim Auth failed2025-11-18 07:02:36 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:54340: 535 Incorrect authentication data (set_id=bqtz@iemif.com)182.95.56.1341269750xJ  -' ossec13001iD6Exim Auth failed2025-11-18 07:02:29 dovecot_login authenticator failed for (host176-90-16-178.reedlan.com) [178.16.90.176]:57237: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)178.16.90.176690791&I  e%% ossec9710iD,Dovecot Auth failed on disconnected session.Nov 18 07:02:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060+H  e)+ ossec9710iD$Dovecot Auth failed on disconnected session.Nov 18 07:02:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841]G  -E+ ossec13001iDVExim Auth failed2025-11-18 07:03:02 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12113: 535 Incorrect authentication data (set_id=sec.geral)195.142.106.177298795F  W' ossec9708iDDovecot Aborted Login with empty userNov 18 07:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YE  -=) ossec13001iDExim Auth failed2025-11-18 07:01:43 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:44332: 535 Incorrect authentication data (set_id=contato)103.163.44.1181269750D  k' ossec9709iCMultiple Dovecot Aborted Logins with empty userNov 18 07:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'C  e%' ossec9710iCDovecot Auth failed on disconnected session.Nov 18 07:01:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084 &3   ey`  -' ossec13001iDExim Auth failed2025-11-18 07:04:31 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:39172: 535 Incorrect authentication data (set_id=financeiro@kglsolucoes.com)188.122.151.62661886h_  -a' ossec13001iDExim Auth failed2025-11-18 07:04:26 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:41088: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)62.201.212.5499237P^  -1# ossec13001iDExim Auth failed2025-11-18 07:04:42 dovecot_login authenticator failed for ([1.31.80.222]) [1.31.80.222]:44340: 535 Incorrect authentication data (set_id=eduardo)1.31.80.2221814991]  k' ossec9709iDMultiple Dovecot Aborted Logins with empty userNov 18 07:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/\  e7% ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:04:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991l[  -e' ossec13001iDExim Auth failed2025-11-18 07:03:48 dovecot_login authenticator failed for broadband-95-84-131-125.ip.moscow.rt.ru [95.84.131.125]:34054: 535 Incorrect authentication data (set_id=regiane)95.84.131.1252017370 Z  -!' ossec13001iDzExim Auth failed2025-11-18 07:03:37 dovecot_login authenticator failed for (3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:38541: 535 Incorrect authentication data (set_id=regiane@singseguros.com.br)124.239.129.21814991(Y  e+# ossec9710iDnDovecot Auth failed on disconnected session.Nov 18 07:03:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750%X  e+ ossec9710iDfDovecot Auth failed on disconnected session.Nov 18 07:03:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001}W  - % ossec13001iDExim Auth failed2025-11-18 07:03:56 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:45332: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)50.82.10.1556252001VV  -9' ossec13001iDExim Auth failed2025-11-18 07:03:45 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:44356: 535 Incorrect authentication data (set_id=contato)120.157.6.1472077456U W' ossec9708iDtDovecot Aborted Login with empty userNov 18 07:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,T  e++ ossec9710iDbDovecot Auth failed on disconnected session.Nov 18 07:03:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822oS  -i) ossec13001iD`Exim Auth failed2025-11-18 07:03:12 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:38402: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)220.179.120.261814991VR  -7) ossec13001iDLExim Auth failed2025-11-18 07:02:52 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:41200: 535 Incorrect authentication data (set_id=bqtz)103.251.143.141269750  o W' ossec9708iDDovecot Aborted Login with empty userNov 18 07:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1JasmttDWMWxV3kv>177.87.121.473469034on  -g+ ossec13001iDExim Auth failed2025-11-18 07:05:24 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:53818: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)220.201.218.1461814991$m  e!' ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:05:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<7gqVmdtDoMk+PIOL>62.60.131.139130758+l  e-' ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:05:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991^k  -G) ossec13001iEExim Auth failed2025-11-18 07:05:51 dovecot_login authenticator failed for ([36.154.134.146]) [36.154.134.146]:58376: 535 Incorrect authentication data (set_id=atualizacoes)36.154.134.1461814991ij  -_' ossec13001iDExim Auth failed2025-11-18 07:05:47 dovecot_login authenticator failed for ([121.18.148.10]) [121.18.148.10]:36400: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)121.18.148.101814991\i  -E' ossec13001iDExim Auth failed2025-11-18 07:04:53 dovecot_login authenticator failed for ([213.234.9.218]) [213.234.9.218]:57716: 535 Incorrect authentication data (set_id=ferramentaria)213.234.9.2182017370~h  - % ossec13001iDExim Auth failed2025-11-18 07:04:46 dovecot_login authenticator failed for 116-59-11-85.emome-ip.hinet.net [116.59.11.85]:60352: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)116.59.11.851668284ng  -g) ossec13001iDExim Auth failed2025-11-18 07:04:44 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:58437: 535 Incorrect authentication data (set_id=financeiro)177.174.95.2453469034nf  -k% ossec13001iDExim Auth failed2025-11-18 07:05:01 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:42333: 535 Incorrect authentication data (set_id=adm@fundamentalbrinquedos.com.br)61.72.59.1061835841_e  -K' ossec13001iDExim Auth failed2025-11-18 07:05:00 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:40188: 535 Incorrect authentication data (set_id=marcelo.pinheiro)222.120.176.61835841rd  -o) ossec13001iDExim Auth failed2025-11-18 07:04:35 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:44297: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)193.169.28.2442017370*c  e)) ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:04:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044b  W' ossec9708iDDovecot Aborted Login with empty userNov 18 07:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.a  e/+ ossec9710iDDovecot Auth failed on disconnected session.Nov 18 07:04:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822 %@ a vpU)#~  e+ ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:06:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1oCvnNtDYrnBl4nP>193.151.137.207130758(}  e'' ossec9710iE.Dovecot Auth failed on disconnected session.Nov 18 07:06:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001/|  e5' ossec9710iE,Dovecot Auth failed on disconnected session.Nov 18 07:06:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867{ W' ossec9708iE(Dovecot Aborted Login with empty userNov 18 07:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^z  -O# ossec13001iE(Exim Auth failed2025-11-18 07:06:31 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:60840: 535 Incorrect authentication data (set_id=formula316)89.67.5.135798544y  -)) ossec13001iEExim Auth failed2025-11-18 07:06:15 dovecot_login authenticator failed for (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:56860: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)122.163.127.141269750Ux  -9% ossec13001iEHExim Auth failed2025-11-18 07:07:04 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:59500: 535 Incorrect authentication data (set_id=novamanha)102.38.3.1772215636w  - + ossec13001iE:Exim Auth failed2025-11-18 07:06:49 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:49827: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)122.187.228.2331269750,v  e/' ossec9710iE6Dovecot Auth failed on disconnected session.Nov 18 07:06:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991pu  -o% ossec13001iDExim Auth failed2025-11-18 07:05:32 dovecot_login authenticator failed for ([60.15.194.58]) [60.15.194.58]:55749: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)60.15.194.581814991ot  -k' ossec13001iDExim Auth failed2025-11-18 07:05:21 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:41774: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)189.80.46.2503469034Ps  -1' ossec13001iDExim Auth failed2025-11-18 07:05:16 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:57114: 535 Incorrect authentication data (set_id=adm)65.20.237.19199237[r  -?+ ossec13001iEExim Auth failed2025-11-18 07:05:54 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:40134: 535 Incorrect authentication data (set_id=bianca)154.144.255.2102542007aq  -O' ossec13001iDExim Auth failed2025-11-18 07:05:47 dovecot_login authenticator failed for (8.226.206.178.in-addr.arpa) [178.206.226.8]:58794: 535 Incorrect authentication data (set_id=contato)178.206.226.82017370Wp  -=% ossec13001iDExim Auth failed2025-11-18 07:05:46 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:40467: 535 Incorrect authentication data (set_id=vendas.luiz)113.8.218.541814991 4 z|n46  eA) ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:08:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.251814991-  e-+ ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:08:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001]  -E) ossec13001iEExim Auth failed2025-11-18 07:08:35 dovecot_login authenticator failed for ([111.26.167.239]) [111.26.167.240]:58052: 535 Incorrect authentication data (set_id=vendas.luiz)111.26.167.2401814991x  -% ossec13001iEExim Auth failed2025-11-18 07:08:25 dovecot_login authenticator failed for (82-156-58-61.tinp.net.tw) [61.58.156.82]:35324: 535 Incorrect authentication data (set_id=financeiro@quintalbrincante.com.br)61.58.156.821668284z  -' ossec13001iEExim Auth failed2025-11-18 07:08:19 dovecot_login authenticator failed for 93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:48351: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)93.42.227.2513175395*  e+' ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:08:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<+AtQpNtDGpwtPZWl>45.61.149.1656252001f  -U+ ossec13001iE_Exim Auth failed2025-11-18 07:07:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51927: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034l  -c) ossec13001iEExim Auth failed2025-11-18 07:08:06 dovecot_login authenticator failed for ([180.129.66.134]) [180.129.66.134]:54191: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)180.129.66.1341880251  W' ossec9708iEDovecot Aborted Login with empty userNov 18 07:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u  -s+ ossec13001iEpExim Auth failed2025-11-18 07:07:43 dovecot_login authenticator failed for ([163.179.123.188]) [163.179.123.188]:38573: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)163.179.123.1881814991p  -k) ossec13001iEhExim Auth failed2025-11-18 07:07:36 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:55858: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)181.115.237.193923057  k' ossec9709iEeMultiple Dovecot Aborted Logins with empty userNov 18 07:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9b7codtDxrmxV3kv>177.87.121.473469034,  e++ ossec9710iEeDovecot Auth failed on disconnected session.Nov 18 07:07:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001j  -a' ossec13001iEvExim Auth failed2025-11-18 07:07:50 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:47058: 535 Incorrect authentication data (set_id=financeiro)78.66.119.13926618863  e;) ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:06:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044 $  v\  -G' ossec13001iEExim Auth failed2025-11-18 07:09:22 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:39010: 535 Incorrect authentication data (set_id=info)95.87.248.223732800d  -Q+ ossec13001iEExim Auth failed2025-11-18 07:09:13 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:45176: 535 Incorrect authentication data (set_id=info@mag.adv.br)121.142.146.1671835841+  e/% ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:10:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841e  -U) ossec13001iEExim Auth failed2025-11-18 07:09:26 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:53891: 535 Incorrect authentication data (set_id=andressa.financeiro)222.101.241.441835841+  e+) ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:10:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841(  e'' ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:09:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<+a0sp9tDAt1n9M4G>103.244.206.61643084"  e' ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:08:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991  - + ossec13001iEExim Auth failed2025-11-18 07:08:48 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:39336: 535 Incorrect authentication data (set_id=financeiro)122.170.100.2531269750b -K+ ossec13001iEExim Auth failed2025-11-18 07:08:35 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51638: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034[  -A) ossec13001iEExim Auth failed2025-11-18 07:08:34 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:46290: 535 Incorrect authentication data (set_id=sec.geral)103.250.160.761269750 W' ossec9708iEDovecot Aborted Login with empty userNov 18 07:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0kxvpdtDEN2xV3kv>177.87.121.473469034#  e!# ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:08:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483S  -5% ossec13001iEExim Auth failed2025-11-18 07:08:26 dovecot_login authenticator failed for ([36.135.92.35]) [36.135.92.36]:59308: 535 Incorrect authentication data (set_id=compras)36.135.92.3618149910  e3+ ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:09:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822X  -=' ossec13001iEExim Auth failed2025-11-18 07:08:56 dovecot_login authenticator failed for (adlondrina.com.br) [61.50.119.110]:24828: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991   "E"+  W' ossec9708iF7Dovecot Aborted Login with empty userNov 18 07:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)*  e+' ossec9710iF)Dovecot Auth failed on disconnected session.Nov 18 07:10:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758)  k' ossec9709iFMultiple Dovecot Aborted Logins with empty userNov 18 07:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y(  -C% ossec13001iF;Exim Auth failed2025-11-18 07:11:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64648: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758d'  -W' ossec13001iF5Exim Auth failed2025-11-18 07:11:00 dovecot_login authenticator failed for ([41.65.118.172]) [41.42.206.123]:40370: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)41.42.206.123357994y&  -{+ ossec13001iF1Exim Auth failed2025-11-18 07:10:56 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:52879: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)208.180.252.1836252001a%  -M) ossec13001iF Exim Auth failed2025-11-18 07:10:15 dovecot_login authenticator failed for ([124.115.206.10]) [124.115.206.10]:44496: 535 Incorrect authentication data (set_id=paulinho.vendas)124.115.206.101814991Z$  -E% ossec13001iEExim Auth failed2025-11-18 07:09:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:52210: 535 Incorrect authentication data (set_id=postamster@deproi.com.br)62.60.131.40130758#  -' ossec13001iEExim Auth failed2025-11-18 07:09:09 dovecot_login authenticator failed for 110-25-109-53.adsl.fetnet.net [110.25.109.53]:33244: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)110.25.109.531668284g"  -[' ossec13001iEExim Auth failed2025-11-18 07:09:21 dovecot_login authenticator failed for (adlondrina.com.br) [61.50.119.110]:29586: 535 Incorrect authentication data (set_id=test@adlondrina.com.br)61.50.119.1101814991&!  e%% ossec9710iEDovecot Auth failed on disconnected session.Nov 18 07:09:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991c  -O+ ossec13001iEExim Auth failed2025-11-18 07:10:03 dovecot_login authenticator failed for ([219.147.196.170]) [219.147.196.170]:49315: 535 Incorrect authentication data (set_id=isabellylisboa)219.147.196.1701814991v  -w) ossec13001iEExim Auth failed2025-11-18 07:09:56 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:26011: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)216.194.174.276252001  -C) ossec13001iEExim Auth failed2025-11-18 07:09:41 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:59058: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)122.180.249.321269750 W' ossec9708iEDovecot Aborted Login with empty userNov 18 07:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  o:  -g+ ossec13001iFyExim Auth failed2025-11-18 07:12:08 dovecot_login authenticator failed for ([219.135.168.148]) [219.135.168.148]:34341: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)219.135.168.1481814991q9  -o' ossec13001iFExim Auth failed2025-11-18 07:13:03 dovecot_login authenticator failed for ([61.189.61.162]) [61.189.61.162]:51464: 535 Incorrect authentication data (set_id=atendimento@interlubfiltros.com.br)61.189.61.1621814991Y8  -;+ ossec13001iFExim Auth failed2025-11-18 07:12:46 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:51166: 535 Incorrect authentication data (set_id=compras)128.185.208.15812697507 W' ossec9708iFDovecot Aborted Login with empty userNov 18 07:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<80y5s9tDLNmxV3kv>177.87.121.473469034Y6  -=) ossec13001iFExim Auth failed2025-11-18 07:12:30 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:38788: 535 Incorrect authentication data (set_id=compras)46.212.127.1283144096g5 -U+ ossec13001iFsExim Auth failed2025-11-18 07:12:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51542: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034*4  e)) ossec9710iFYDovecot Auth failed on disconnected session.Nov 18 07:11:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387(3  e'' ossec9710iFUDovecot Auth failed on disconnected session.Nov 18 07:11:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822m2  -e) ossec13001iFOExim Auth failed2025-11-18 07:11:26 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:37848: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)222.101.241.441835841T1  -9' ossec13001iFiExim Auth failed2025-11-18 07:11:52 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:41397: 535 Incorrect authentication data (set_id=eduardo)65.20.167.11799237g0  -_# ossec13001iFUExim Auth failed2025-11-18 07:11:32 dovecot_login authenticator failed for (5x3x179x215.dynamic.spb.ertelecom.ru) [5.3.179.215]:59836: 535 Incorrect authentication data (set_id=adriana)5.3.179.2152017370/ W' ossec9708iFUDovecot Aborted Login with empty userNov 18 07:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,.  e-) ossec9710iFQDovecot Auth failed on disconnected session.Nov 18 07:11:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730Z-  -A' ossec13001iFEExim Auth failed2025-11-18 07:11:15 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:51142: 535 Incorrect authentication data (set_id=aureovieira)95.220.47.2422017370/,  e3+ ossec9710iF9Dovecot Auth failed on disconnected session.Nov 18 07:11:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758 1 p o BRdy`/Ce10H  e9% ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:13:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001ZG  -A' ossec13001iFExim Auth failed2025-11-18 07:13:40 dovecot_login authenticator failed for ([27.24.141.119]) [27.24.141.119]:42646: 535 Incorrect authentication data (set_id=aureovieira)27.24.141.1191814991hF  -[) ossec13001iFExim Auth failed2025-11-18 07:13:25 dovecot_login authenticator failed for ([208.69.161.192]) [208.69.161.192]:52167: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)208.69.161.1926252001-E  e/) ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:13:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750D  W' ossec9708iFDovecot Aborted Login with empty userNov 18 07:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gC  -]% ossec13001iFExim Auth failed2025-11-18 07:14:01 dovecot_login authenticator failed for ([139.60.85.94]) [139.60.85.94]:43357: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)139.60.85.946252001jB  -a' ossec13001iFExim Auth failed2025-11-18 07:13:45 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:43436: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)120.157.17.962077456lA  -c) ossec13001iFExim Auth failed2025-11-18 07:13:58 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:37396: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)121.73.169.1492186224)@  e+% ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:13:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841?  k' ossec9709iFMultiple Dovecot Aborted Logins with empty userNov 18 07:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z>  -A' ossec13001iFExim Auth failed2025-11-18 07:13:27 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:50108: 535 Incorrect authentication data (set_id=atendimento)125.19.254.261269750/=  e5' ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:14:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<9QLduNtDhO0rmxBp>43.155.16.1051819730$<  e' ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:12:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<0WEfs9tDEqkv+yzS>47.251.44.21062520011;  e5+ ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:12:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 * n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p  f R H  4 > * \ vlbX&ND:0^|rh,"TJ@6F<2ndZxP( ~tj.`VLB8$zpf \RH>4* | r h ^ T J @ 6 , "    x vlbXND:0& iI%D iJ&%E iJ%@ iJ%? iJ%> iJ%B iJ%A iI%= iI%< iI%; iI%: iI%9 iI%8 iI%7 iI%6 iI%5 iI%4 iI%3 iI%2 iI%1 iI%0 iI%/ iI%. iI%- iI%, iI%+ iI%* iII%) iIe%( iIa%' iI[%& iIS%% iIM%$ iII%# iI;%" iI7%! iI%% iI%% iIA% iI9% iI-% iI'% iI#% iH% iH% iH% iI % iI% iI% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iH% iHw% iHq% iHo% iHi% iHK$ iH5$ iH=$ iH/$ iHU$ iHS$ iHK$ iHE$ iG$ iG$ iH$ iH$ iH$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iGw$ iGq$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iG$ iGY$ iGO$ iGK$ iGE$ iF$ iF$ iG#$ iG$ iG $ iG$ iG $ iF$ iG$ iG$ iG$ iG $ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iF$ iFy$ iFs$ iFi$ iFY$ iFU$ iFU$ iFU$ iFQ$ iFO$ iFE$ iF;$ iF9$ iF7$ iF5$ iF1$ iF)$ iF$ iF $ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iD8$P iD8$O iD8$N iD6$J iD,$I iD$$H iD$F iD$> iD$B iD$E iD$A iC$@ iKx%k iKr%j iKP%f iKJ%e iKF%d iKF%c iKB%b iK0%a iK.%g iK(%\ iK$%` iK%[ iK%_ iK%^ iK%] iJ%Z iJ%Y iJ%W iJ%V iJ%U iJ%T iJ%S iJ%R iJ%X iJ%Q iJ%P iJ%O iJ%N iJ%M iJ%L iJp%H iJn%G iJf%F iJY%K iJQ%J iJB%I iJ(%C iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iE$ iEv$ iEp$ iEh$ iEe$ iEe$ iE_$ iEH$x iE:$w iE6$v iE.$} iE,$| iE(${ iE($z iE$y iE$ iE$~ iE$r iE$k iD$q iD$j iD$p iD$u iD$o iD$n iD$t iD$s iD$m< iK~%h iD$l iD$f iD$b iD$e iD$i iD$h iD$a iD$g iD$^ iD$d iD$c iD$] iD$` iD$_ iD$\ iD$W iD$[ iD$V iDz$Z iDt$U iDn$Y iDf$X iDb$T iD`$S iDV$M iDV$G iDL$R iDJ$Q iDB$L iD<$K ` knq}`.W  e3' ossec9710iGODovecot Auth failed on disconnected session.Nov 18 07:15:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<1fTuvttD+tAtPZWl>45.61.149.1656252001gV -U+ ossec13001iGKExim Auth failed2025-11-18 07:15:38 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52228: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034U W' ossec9708iGEDovecot Aborted Login with empty userNov 18 07:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034VT  -9' ossec13001iFExim Auth failed2025-11-18 07:14:23 dovecot_login authenticator failed for ([152.231.25.65]) [152.231.25.64]:48922: 535 Incorrect authentication data (set_id=eduardo)152.231.25.643686110%S  e#% ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:14:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001PR  -1# ossec13001iG#Exim Auth failed2025-11-18 07:14:57 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:35759: 535 Incorrect authentication data (set_id=compras)14.6.16.1371835841yQ  -}) ossec13001iGExim Auth failed2025-11-18 07:14:38 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:60498: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)200.199.32.1743469034,P  e-) ossec9710iG Dovecot Auth failed on disconnected session.Nov 18 07:14:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044lO  -c) ossec13001iGExim Auth failed2025-11-18 07:14:29 dovecot_login authenticator failed for ([221.159.174.17]) [221.159.174.17]:35466: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)221.159.174.171835841N W' ossec9708iG Dovecot Aborted Login with empty userNov 18 07:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+rPfuttD7J6xV3kv>177.87.121.4734690340M  e7' ossec9710iFDovecot Auth failed on disconnected session.Nov 18 07:14:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730`L  -M' ossec13001iGExim Auth failed2025-11-18 07:14:52 dovecot_login authenticator failed for ([5.158.118.171]) [5.158.118.171]:54788: 535 Incorrect authentication data (set_id=secretarioadjunto)5.158.118.1712017370lK  -c) ossec13001iGExim Auth failed2025-11-18 07:14:42 dovecot_login authenticator failed for ([46.148.100.210]) [46.148.100.210]:55712: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)46.148.100.2102017370$J  e## ossec9710iGDovecot Auth failed on disconnected session.Nov 18 07:14:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483'I  e'% ossec9710iG Dovecot Auth failed on disconnected session.Nov 18 07:14:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370    &:!)df  -U' ossec13001iGExim Auth failed2025-11-18 07:17:04 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:56612: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)193.46.192.202510769me  -g' ossec13001iGExim Auth failed2025-11-18 07:17:01 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:3072: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)200.33.171.653996063{d  -' ossec13001iGExim Auth failed2025-11-18 07:16:36 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:60715: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)87.103.126.5422643975c  eA' ossec9710iGwDovecot Auth failed on disconnected session.Nov 18 07:16:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<3idFwdtDruEI1et7>8.213.235.1231605651-b  e3% ossec9710iGqDovecot Auth failed on disconnected session.Nov 18 07:16:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841ta  -s) ossec13001iGExim Auth failed2025-11-18 07:17:06 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:55921: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)173.25.186.1306252001`  W' ossec9708iGDovecot Aborted Login with empty userNov 18 07:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<77/Zw9tDROCxV3kv>177.87.121.473469034h_  -[) ossec13001iGExim Auth failed2025-11-18 07:16:48 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:53475: 535 Incorrect authentication data (set_id=vendas.luiz)71.208.122.1856252001[^  -E% ossec13001iGExim Auth failed2025-11-18 07:16:45 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:32877: 535 Incorrect authentication data (set_id=administrativo1)61.1.105.1051269750 ]  -%) ossec13001iGExim Auth failed2025-11-18 07:16:33 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:44836: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)178.140.95.2212017370S\  -7# ossec13001iGExim Auth failed2025-11-18 07:17:03 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:57046: 535 Incorrect authentication data (set_id=leandro)61.12.86.901269750z[  -# ossec13001iGExim Auth failed2025-11-18 07:16:51 dovecot_login authenticator failed for 111-70-32-3.emome-ip.hinet.net [111.70.32.3]:58880: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)111.70.32.31668284kZ  -_+ ossec13001iGExim Auth failed2025-11-18 07:16:49 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:33505: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)222.108.177.1101835841lY  -a+ ossec13001iGExim Auth failed2025-11-18 07:16:49 dovecot_login authenticator failed for ([219.135.168.148]) [219.135.168.148]:39793: 535 Incorrect authentication data (set_id=leandro@eloempresas.com)219.135.168.14818149912X  e7+ ossec9710iGYDovecot Auth failed on disconnected session.Nov 18 07:15:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001 EA uA' ~qWJ y l _ R E 8 +   8+uh[NA4' ~qdWJ=0# zm`SF9,vi\OB5(A x ^ D 7  t M  } p c V I < / "   h[N4d rfZN|pdXL@4(sfYL?2% | o b U H ; . !   4 1655842 1655842 1643084 1 1643084 1668284 1668284 1668284 1655842 1655842 1655842: 1643084& 1643084 1643084 1643084C 1643084 1643084 1643084 1643084< 1643084m 1643084L 1643084 1643084 1643084& 1643084 1643084 1643084R 1643084 1643084 1643084 1643084u 1643084Y 1643084 1643084P 1643084 1643084 1643084* 1643084 1643084 1643084 1643084 1643084 1643084 1643084X 1643084 1643084 1643084_ 1643084H 16430842 1643084 1643084 1643084. 1643084 1643084 1643084 1643084 1643084 1643084| 1643084$ 1643084 1643084 1643084` 1643084 1643084 1643084 1643084 C 1643084 @ 1643084  1643084  1643084 1643084 1643084 1643084  1643084 1643084 " 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084 3 1643084 1643084 1643084 1643084t 16430845 1643084 1643084 1643084 1643084l 1643084( 1643084 1643084 1643084 1643084 1643084D 1643084 1643084  1605651. 1605651- 1643084- 1605651- 1605651- 1605651- 1605651&p 1605651% 1605651%| 1605651- 1605651, 1605651, 1605651,u 1643084+ 1643084+ 1605651+ 1605651+s 1605651+p 1643084+? 1605651+ 1643084* 1643084*{ 1643084*[ 1605651*O 1605651*F 1643084* 1605651) 1605651) 1643084) 1605651) 1605651)T 1605651)4 1643084)0 1643084( 1643084~ 1643084c 1643084, 1643084' 1643084 1643084 1643084V 1643084 1643084 1643084 1643084 1605651( 1605651( 1605651' 1605651& 1605651& 1605651& 1643084( 1643084([ 1643084' 1643084' 1643084' 1643084' 1643084'= 1643084'+ 1643084& 1643084& 1643084% 1643084% 1643084% 1643084% 1643084$ 1643084$C 1643084/B 1605651/8 1605651/ 1643084#\ 1643084#. & 1643084" Z' 1643084!  1643084! 1643084! 1643084!  1643084 _ 1643084 6 1643084   1643084 Q' 16430843 1643084 k 1643084 1643084a  1643084 1643084m 1643084K' 1643084 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284~ 1668284| 1668284{ 1668284x 1668284q 1668284p 1668284i 1668284g 1668284f 1668284a 1668284\ 1668284T 1668284R 1668284Q 1668284O 1668284N 1668284H 1668284G 1668284A 1668284> 1668284: 16682848 16682844 1668284- 1668284, 1668284' 1668284# 1668284 1668284 1668284 1668284 1668284  t]u  -E) ossec13001iHExim Auth failed2025-11-18 07:18:54 dovecot_login authenticator failed for ([113.137.31.134]) [113.137.31.134]:56110: 535 Incorrect authentication data (set_id=alex.vendas)113.137.31.1341814991)t  e+% ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:18:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<1XFnyttDkryiAOAm>162.0.224.386252001+s  e+) ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:18:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001r W' ossec9708iGDovecot Aborted Login with empty userNov 18 07:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034xq  -}' ossec13001iGExim Auth failed2025-11-18 07:17:08 dovecot_login authenticator failed for (mail.jimsmithcenters.com) [38.87.177.252]:56066: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)38.87.177.2526252001p W' ossec9708iGDovecot Aborted Login with empty userNov 18 07:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\o  -G) ossec13001iGExim Auth failed2025-11-18 07:17:16 dovecot_login authenticator failed for ([93.191.115.52]) [194.31.220.231]:51496: 535 Incorrect authentication data (set_id=ferramentaria)194.31.220.23199237Yn  -?' ossec13001iGExim Auth failed2025-11-18 07:17:13 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:53942: 535 Incorrect authentication data (set_id=marialuiza)27.24.141.1121814991lm  -c) ossec13001iGExim Auth failed2025-11-18 07:17:13 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:59126: 535 Incorrect authentication data (set_id=aureovieira)110.175.41.2172077456~l  - ' ossec13001iGExim Auth failed2025-11-18 07:18:05 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:47395: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)93.241.232.142921044ak  -Q% ossec13001iGExim Auth failed2025-11-18 07:18:01 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:38130: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)85.12.240.142017370.j  e1) ossec9710iGDovecot Auth failed on disconnected session.Nov 18 07:17:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044_i  -Q! ossec13001iGExim Auth failed2025-11-18 07:17:21 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:59180: 535 Incorrect authentication data (set_id=financeiro)87.76.5.3620173700h  e5) ossec9710iGDovecot Auth failed on disconnected session.Nov 18 07:16:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387g  k' ossec9709iGMultiple Dovecot Aborted Logins with empty userNov 18 07:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6oEIwttD6s2xV3kv>177.87.121.473469034 "  h  -[) ossec13001iHExim Auth failed2025-11-18 07:20:58 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:39038: 535 Incorrect authentication data (set_id=contato)201.173.216.163996063&  e!) ossec9710iHwDovecot Auth failed on disconnected session.Nov 18 07:20:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<0f2S0NtDEJZ2wSaf>118.193.38.1591819730 W' ossec9708iHqDovecot Aborted Login with empty userNov 18 07:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -c% ossec13001iHoExim Auth failed2025-11-18 07:20:31 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:52030: 535 Incorrect authentication data (set_id=contato@cantoramaralima.com.br)65.20.211.9699237q  -k+ ossec13001iHiExim Auth failed2025-11-18 07:20:25 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:51819: 535 Incorrect authentication data (set_id=formula316)177.174.105.1133469034Y  -=) ossec13001iHKExim Auth failed2025-11-18 07:19:54 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:51377: 535 Incorrect authentication data (set_id=contato)111.171.125.941835841~  k' ossec9709iH5Multiple Dovecot Aborted Logins with empty userNov 18 07:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034"}  e) ossec9710iH=Dovecot Auth failed on disconnected session.Nov 18 07:19:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044d|  -U' ossec13001iH/Exim Auth failed2025-11-18 07:19:27 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:33654: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)157.20.228.2012697500{  e3+ ossec9710iHUDovecot Auth failed on disconnected session.Nov 18 07:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841z  W' ossec9708iHSDovecot Aborted Login with empty userNov 18 07:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iy  -]) ossec13001iHKExim Auth failed2025-11-18 07:19:55 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:48504: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)125.20.228.1461269750,x  e-) ossec9710iHEDovecot Auth failed on disconnected session.Nov 18 07:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822qw  -m) ossec13001iGExim Auth failed2025-11-18 07:18:26 dovecot_login authenticator failed for ([102.207.152.72]) [102.207.152.72]:51886: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)102.207.152.723374766ev  -S+ ossec13001iGExim Auth failed2025-11-18 07:18:14 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:46283: 535 Incorrect authentication data (set_id=contato)179.185.161.1453469034  - N # +6".  e5% ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:22:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001o  -m% ossec13001iHExim Auth failed2025-11-18 07:22:29 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:50904: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)85.12.240.142017370  e# ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:22:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750W  -9) ossec13001iHExim Auth failed2025-11-18 07:22:20 dovecot_login authenticator failed for (nhavuivn.com) [210.245.33.154]:57866: 535 Incorrect authentication data (set_id=sec.geral)210.245.33.1541562822 W' ossec9708iHDovecot Aborted Login with empty userNov 18 07:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l  -e' ossec13001iHExim Auth failed2025-11-18 07:21:27 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:57780: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)180.92.235.701210997o  -i+ ossec13001iHExim Auth failed2025-11-18 07:21:20 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:8200: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)197.255.227.180921929\  -I% ossec13001iHExim Auth failed2025-11-18 07:21:59 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63265: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758& e%% ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:21:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103O  -/# ossec13001iHExim Auth failed2025-11-18 07:21:40 dovecot_login authenticator failed for ([218.23.95.9]) [218.23.95.9]:40058: 535 Incorrect authentication data (set_id=xavier)218.23.95.918149914  e?' ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:21:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991'  e)# ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:21:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001[  -A) ossec13001iHExim Auth failed2025-11-18 07:21:44 dovecot_login authenticator failed for ([83.220.255.230]) [83.220.255.230]:50539: 535 Incorrect authentication data (set_id=sec.geral)83.220.255.2302017370Y  -=) ossec13001iHExim Auth failed2025-11-18 07:21:16 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:38936: 535 Incorrect authentication data (set_id=eduardo)216.194.174.276252001r  -q' ossec13001iHExim Auth failed2025-11-18 07:21:03 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:49559: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)178.232.65.993144096 1 j G+-7S931S"  -7# ossec13001iI;Exim Auth failed2025-11-18 07:23:54 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:42736: 535 Incorrect authentication data (set_id=rodrigo)182.95.47.21269750'!  e#) ossec9710iI7Dovecot Auth failed on disconnected session.Nov 18 07:23:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001  -) ossec13001iI%Exim Auth failed2025-11-18 07:23:32 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:60314: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)67.241.128.1976252001 W' ossec9708iI%Dovecot Aborted Login with empty userNov 18 07:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`  -Q% ossec13001iIAExim Auth failed2025-11-18 07:24:00 dovecot_login authenticator failed for (host87-89-16-178.reedlan.com) [178.16.89.87]:53930: 535 Incorrect authentication data (set_id=compras)178.16.89.87690791r  -s% ossec13001iI9Exim Auth failed2025-11-18 07:23:53 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:42434: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)111.70.3.1221668284z  -) ossec13001iI-Exim Auth failed2025-11-18 07:23:40 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:59214: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)45.136.194.1202510769e  -[% ossec13001iI'Exim Auth failed2025-11-18 07:23:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57001: 535 Incorrect authentication data (set_id=admin@cleservicosindustriais.com.br)62.60.131.40130758/  e3) ossec9710iI#Dovecot Auth failed on disconnected session.Nov 18 07:23:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730  k' ossec9709iHMultiple Dovecot Aborted Logins with empty userNov 18 07:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#  e) ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.10818358412  e7+ ossec9710iHDovecot Auth failed on disconnected session.Nov 18 07:22:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<1u9Y1ttD5IWElIx5>132.148.140.12162520016  eC' ossec9710iI Dovecot Auth failed on disconnected session.Nov 18 07:23:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001  W' ossec9708iIDovecot Aborted Login with empty userNov 18 07:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4mFF2dtDHJqxV3kv>177.87.121.473469034b  -O) ossec13001iIExim Auth failed2025-11-18 07:22:57 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:41812: 535 Incorrect authentication data (set_id=marcelo.pinheiro)123.209.78.1312077456   lW-30  e?% ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:26:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382&/  e%% ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:25:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.22818610604.  e;+ ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:25:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822Y-  -=) ossec13001iIExim Auth failed2025-11-18 07:25:40 dovecot_login authenticator failed for ([178.178.222.52]) [178.178.222.52]:57544: 535 Incorrect authentication data (set_id=contato)178.178.222.522017370,  k' ossec9709iIMultiple Dovecot Aborted Logins with empty userNov 18 07:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  W' ossec9708iIDovecot Aborted Login with empty userNov 18 07:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2pwI5NtD4uOxV3kv>177.87.121.473469034m*  -e) ossec13001iIExim Auth failed2025-11-18 07:25:02 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:58208: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)116.171.27.2481814991#)  e' ossec9710iIIDovecot Auth failed on disconnected session.Nov 18 07:24:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<9xEN3dtDtoA+PIOJ>62.60.131.137130758/(  e5' ossec9710iIeDovecot Auth failed on disconnected session.Nov 18 07:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001' W' ossec9708iIaDovecot Aborted Login with empty userNov 18 07:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4CCs3ttDNr+xV3kv>177.87.121.473469034X&  -;) ossec13001iI[Exim Auth failed2025-11-18 07:24:26 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:33436: 535 Incorrect authentication data (set_id=xavier)128.185.254.541269750,%  e-) ossec9710iISDovecot Auth failed on disconnected session.Nov 18 07:24:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044$  -) ossec13001iIMExim Auth failed2025-11-18 07:24:12 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:55454: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)24.224.226.1926251999\#  -I% ossec13001iIIExim Auth failed2025-11-18 07:24:08 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:53550: 535 Incorrect authentication data (set_id=rodrigo)46.10.56.170732800 k ufLk]?  -G) ossec13001iJExim Auth failed2025-11-18 07:27:33 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:37806: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549> W' ossec9708iJDovecot Aborted Login with empty userNov 18 07:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%=  e%# ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:26:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750,<  e-) ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:26:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750R;  -3% ossec13001iIExim Auth failed2025-11-18 07:26:24 dovecot_login authenticator failed for ([116.7.248.50]) [116.7.248.50]:52122: 535 Incorrect authentication data (set_id=envios)116.7.248.501814991\:  -E' ossec13001iIExim Auth failed2025-11-18 07:27:05 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:58508: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.1625200139  e;) ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:26:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387-8  e/) ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:26:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.10818358417 W' ossec9708iIDovecot Aborted Login with empty userNov 18 07:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i6  -]) ossec13001iIExim Auth failed2025-11-18 07:26:09 dovecot_login authenticator failed for ([175.237.47.241]) [175.237.47.241]:57286: 535 Incorrect authentication data (set_id=envios@comercial.art.br)175.237.47.2411835841a5  -M) ossec13001iIExim Auth failed2025-11-18 07:27:03 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:47372: 535 Incorrect authentication data (set_id=contato)46.212.127.1283144096h4  -_% ossec13001iIExim Auth failed2025-11-18 07:26:50 dovecot_login authenticator failed for ([14.161.44.92]) [14.161.44.92]:48233: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)14.161.44.921562822j3  -g! ossec13001iIExim Auth failed2025-11-18 07:26:34 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:60812: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)87.76.5.36201737022  e;' ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:25:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001#1  e% ossec9710iIDovecot Auth failed on disconnected session.Nov 18 07:25:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991 `  1 7 9gz`M W' ossec9708iJDovecot Aborted Login with empty userNov 18 07:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034iL  -_' ossec13001iJExim Auth failed2025-11-18 07:29:20 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42878: 535 Incorrect authentication data (set_id=edna)122.186.64.861269750,K  e/' ossec9710iJYDovecot Auth failed on disconnected session.Nov 18 07:28:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001J  k' ossec9709iJQMultiple Dovecot Aborted Logins with empty userNov 18 07:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7An87NtDxsCxV3kv>177.87.121.4734690341I  e7) ossec9710iJBDovecot Auth failed on disconnected session.Nov 18 07:28:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730H  W' ossec9708iJpDovecot Aborted Login with empty userNov 18 07:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-G  e/) ossec9710iJnDovecot Auth failed on disconnected session.Nov 18 07:29:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044zF  -) ossec13001iJfExim Auth failed2025-11-18 07:28:52 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:45893: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)200.141.211.583469034vE  -y' ossec13001iJ&Exim Auth failed2025-11-18 07:27:48 dovecot_login authenticator failed for (89-188-123-61.dyn-pool.spb.citytelecom.ru) [89.188.123.61]:51804: 535 Incorrect authentication data (set_id=ferramentaria)89.188.123.612017370RD  -7# ossec13001iIExim Auth failed2025-11-18 07:27:09 dovecot_login authenticator failed for ([41.59.99.40]) [41.59.99.40]:59573: 535 Incorrect authentication data (set_id=marialuiza)41.59.99.40149590ZC  -A' ossec13001iJ(Exim Auth failed2025-11-18 07:27:51 dovecot_login authenticator failed for ([182.76.108.121]) [182.78.159.82]:38592: 535 Incorrect authentication data (set_id=formula316)182.78.159.821269750iB  -]) ossec13001iJExim Auth failed2025-11-18 07:27:29 dovecot_login authenticator failed for ([219.140.170.34]) [59.173.225.128]:2035: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)59.173.225.12818149912A e7) ossec9710iJDovecot Auth failed on disconnected session.Nov 18 07:27:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044t@  -s) ossec13001iJExim Auth failed2025-11-18 07:27:35 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:56329: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)207.219.221.536251999  }n\  -g) ossec13001iK(Exim Auth failed2025-11-18 07:32:06 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:38478: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)182.95.176.13012697505[  eA' ossec9710iKDovecot Auth failed on disconnected session.Nov 18 07:31:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822cZ  -U' ossec13001iJExim Auth failed2025-11-18 07:31:24 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53160: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.4298795UY  -7' ossec13001iJExim Auth failed2025-11-18 07:31:18 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:42059: 535 Incorrect authentication data (set_id=envios)119.192.59.801835841lX -_+ ossec13001iJExim Auth failed2025-11-18 07:30:20 dovecot_plain authenticator failed for ([151.243.109.221]) [151.243.109.221]:57548: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)151.243.109.2212750405nW  -m% ossec13001iJExim Auth failed2025-11-18 07:30:53 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:59752: 535 Incorrect authentication data (set_id=envios@comercial.art.br)2.55.100.104294640#V  e!# ossec9710iJDovecot Auth failed on disconnected session.Nov 18 07:30:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<9g3B9NtD3DGnYwhf>167.99.8.956252001RU  -5# ossec13001iJExim Auth failed2025-11-18 07:30:44 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:34171: 535 Incorrect authentication data (set_id=rafael)187.93.2.863469034iT  -_' ossec13001iJExim Auth failed2025-11-18 07:30:33 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:50080: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)102.22.27.1462300660S W' ossec9708iJDovecot Aborted Login with empty userNov 18 07:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*R  e-% ossec9710iJDovecot Auth failed on disconnected session.Nov 18 07:30:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841)Q  e%+ ossec9710iJDovecot Auth failed on disconnected session.Nov 18 07:30:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991cP  -Q+ ossec13001iJExim Auth failed2025-11-18 07:30:03 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:40557: 535 Incorrect authentication data (set_id=loopert)151.237.115.206732800hO  -_% ossec13001iJExim Auth failed2025-11-18 07:29:36 dovecot_login authenticator failed for ([58.16.114.36]) [58.16.114.36]:52448: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)58.16.114.3618149917N  eA+ ossec9710iJDovecot Auth failed on disconnected session.Nov 18 07:29:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001 g l ; !%Hcj6<Ygnk  -g) ossec13001iKxExim Auth failed2025-11-18 07:33:28 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56143: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)103.168.241.321269750_j  -K' ossec13001iKrExim Auth failed2025-11-18 07:33:22 dovecot_login authenticator failed for ([111.57.17.172]) [111.57.17.172]:47796: 535 Incorrect authentication data (set_id=marcelo.pinheiro)111.57.17.1721814991\i  -A+ ossec13001iKExim Auth failed2025-11-18 07:33:45 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:47778: 535 Incorrect authentication data (set_id=contato)121.178.185.1411835841h W' ossec9708iK~Dovecot Aborted Login with empty userNov 18 07:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340g  e7' ossec9710iK.Dovecot Auth failed on disconnected session.Nov 18 07:32:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867uf  -{# ossec13001iKPExim Auth failed2025-11-18 07:32:47 dovecot_login authenticator failed for (devserver.gaonsoft.com) [118.39.27.8]:47398: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)118.39.27.81835841ae  -K+ ossec13001iKJExim Auth failed2025-11-18 07:32:41 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51605: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034Yd  -=) ossec13001iKFExim Auth failed2025-11-18 07:32:38 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:44344: 535 Incorrect authentication data (set_id=contato)195.222.59.1573277605xc  -y+ ossec13001iKFExim Auth failed2025-11-18 07:32:37 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:53765: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)220.189.196.1341814991b W' ossec9708iKBDovecot Aborted Login with empty userNov 18 07:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-a  e/) ossec9710iK0Dovecot Auth failed on disconnected session.Nov 18 07:32:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<3m0R+ttDHt2nR+bm>167.71.230.2301269750`  W' ossec9708iK$Dovecot Aborted Login with empty userNov 18 07:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&_  e!) ossec9710iKDovecot Auth failed on disconnected session.Nov 18 07:31:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387*^  e'+ ossec9710iKDovecot Auth failed on disconnected session.Nov 18 07:31:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991]  k' ossec9709iKMultiple Dovecot Aborted Logins with empty userNov 18 07:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  yz  -) ossec13001iKExim Auth failed2025-11-18 07:35:31 dovecot_login authenticator failed for pool-108-51-205-170.washdc.fios.verizon.net [108.51.205.170]:58046: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)108.51.205.1706252001Wy  -;' ossec13001iL Exim Auth failed2025-11-18 07:35:56 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:47683: 535 Incorrect authentication data (set_id=recepcao)27.124.65.1381269750'x  e#) ossec9710iL Dovecot Auth failed on disconnected session.Nov 18 07:35:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841w W' ossec9708iKDovecot Aborted Login with empty userNov 18 07:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v  -) ossec13001iKExim Auth failed2025-11-18 07:35:10 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:47476: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)190.104.254.913865483-u  e/) ossec9710iLDovecot Auth failed on disconnected session.Nov 18 07:36:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750jt  -_) ossec13001iLExim Auth failed2025-11-18 07:36:04 dovecot_login authenticator failed for ([95.221.232.167]) [95.221.232.167]:52674: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)95.221.232.16720173702s  e9) ossec9710iKDovecot Auth failed on disconnected session.Nov 18 07:35:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<1yk0BdxDBt+B4kCN>129.226.64.1411819730#r  3K) ossec11301iKNew FTP connection.Nov 18 07:34:09 hosting pure-ftpd: (?@66.132.153.114) [INFO] New connection from 66.132.153.11466.132.153.1146252001q  W' ossec9708iKDovecot Aborted Login with empty userNov 18 07:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034mp  -e) ossec13001iKExim Auth failed2025-11-18 07:34:47 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:60967: 535 Incorrect authentication data (set_id=contato)181.114.143.793865483do  -Q+ ossec13001iKExim Auth failed2025-11-18 07:34:47 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50151: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651tn  -u' ossec13001iKExim Auth failed2025-11-18 07:34:36 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:38970: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)125.19.216.581269750m  k' ossec9709iKMultiple Dovecot Aborted Logins with empty userNov 18 07:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+l  e+) ossec9710iKDovecot Auth failed on disconnected session.Nov 18 07:34:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251 * $>!  -' ossec13001iLdExim Auth failed2025-11-18 07:37:24 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:51862: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)189.56.202.863469034+  e1# ossec9710iL`Dovecot Auth failed on disconnected session.Nov 18 07:37:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001j  -g% ossec13001iLXExim Auth failed2025-11-18 07:37:11 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:39889: 535 Incorrect authentication data (set_id=adezir@transoltransportes.com.br)65.20.191.1299237+  e-) ossec9710iLDovecot Auth failed on disconnected session.Nov 18 07:37:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=196.251.100.48241170b  -O) ossec13001iLExim Auth failed2025-11-18 07:37:54 dovecot_login authenticator failed for (rev.perfectinternet.in) [103.12.132.157]:39290: 535 Incorrect authentication data (set_id=formula316)103.12.132.1571269750j  -_) ossec13001iLVExim Auth failed2025-11-18 07:37:08 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:59108: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)121.188.248.311835841b  -Q' ossec13001iLVExim Auth failed2025-11-18 07:37:08 dovecot_login authenticator failed for ([211.253.10.61]) [211.253.10.61]:52863: 535 Incorrect authentication data (set_id=andressa.financeiro)211.253.10.611835841k  -_+ ossec13001iL2Exim Auth failed2025-11-18 07:36:33 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:54697: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651 W' ossec9708iL0Dovecot Aborted Login with empty userNov 18 07:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -A' ossec13001iL&Exim Auth failed2025-11-18 07:36:22 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:65358: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001Y  -C% ossec13001iLExim Auth failed2025-11-18 07:36:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59535: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758v~  -y' ossec13001iLBExim Auth failed2025-11-18 07:36:49 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:33052: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)111.26.95.12018149914}  e?' ossec9710iLTDovecot Auth failed on disconnected session.Nov 18 07:37:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.10518197308|  eG' ossec9710iL8Dovecot Auth failed on disconnected session.Nov 18 07:36:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651R{  -1' ossec13001iL Exim Auth failed2025-11-18 07:36:16 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:57398: 535 Incorrect authentication data (set_id=nfe)177.239.160.33996063     60  e;# ossec9710iLDovecot Auth failed on disconnected session.Nov 18 07:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483'  U5% ossec11001iLDeferred login on the cpanel service[2025-11-18 07:38:23 -0300] info [webmaild] 177.4.64.247 - contato@magicoxavier.com.br "GET /cpsess4681237124/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect177.4.64.2473469034i  -_' ossec13001iLExim Auth failed2025-11-18 07:38:07 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:55850: 535 Incorrect authentication data (set_id=info@lorussoimoveis.com.br)222.120.176.61835841*  e+' ossec9710iLDovecot Auth failed on disconnected session.Nov 18 07:38:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841e  -S+ ossec13001iLExim Auth failed2025-11-18 07:38:49 dovecot_login authenticator failed for ([176.195.126.170]) [176.195.126.170]:53761: 535 Incorrect authentication data (set_id=ieqcampocomprido)176.195.126.1702017370P  -/% ossec13001iLExim Auth failed2025-11-18 07:38:43 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:50863: 535 Incorrect authentication data (set_id=info)117.135.6.101814991 W' ossec9708iLDovecot Aborted Login with empty userNov 18 07:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -K+ ossec13001iLExim Auth failed2025-11-18 07:38:25 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:48552: 535 Incorrect authentication data (set_id=ieqcampocomprido)128.185.229.1261269750\  -G% ossec13001iLrExim Auth failed2025-11-18 07:37:38 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:44486: 535 Incorrect authentication data (set_id=adezir)103.90.27.831643084,  e++ ossec9710iLnDovecot Auth failed on disconnected session.Nov 18 07:37:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841  W' ossec9708iLDovecot Aborted Login with empty userNov 18 07:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -7) ossec13001iLrExim Auth failed2025-11-18 07:37:38 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:43685: 535 Incorrect authentication data (set_id=info)210.97.109.1921835841  k' ossec9709iLlMultiple Dovecot Aborted Logins with empty userNov 18 07:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y  -' ossec13001iLExim Auth failed2025-11-18 07:38:04 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:40926: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)173.17.163.446252001g  -]% ossec13001iLhExim Auth failed2025-11-18 07:37:28 dovecot_login authenticator failed for ([95.79.108.51]) [95.79.108.51]:43525: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)95.79.108.512017370  e<Y.l&  -e' ossec13001iM^Exim Auth failed2025-11-18 07:41:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:53397: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)83.136.176.122510769% W' ossec9708iM\Dovecot Aborted Login with empty userNov 18 07:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*$  e)) ossec9710iMRDovecot Auth failed on disconnected session.Nov 18 07:41:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044/#  e7% ossec9710iMvDovecot Auth failed on disconnected session.Nov 18 07:41:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=LOGIN, rip=148.72.64.32, lip=200.150.196.245, session=148.72.64.326252001'"  e%' ossec9710iM&Dovecot Auth failed on disconnected session.Nov 18 07:40:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9gv8F9xDgOZn9M4G>103.244.206.61643084_!  -M% ossec13001iM"Exim Auth failed2025-11-18 07:40:33 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:52824: 535 Incorrect authentication data (set_id=novoamparo@adlondrina.com.br)84.54.33.2052750405%  e#% ossec9710iM"Dovecot Auth failed on disconnected session.Nov 18 07:40:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841  k' ossec9709iM"Multiple Dovecot Aborted Logins with empty userNov 18 07:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0tXhF9xDPOCxV3kv>177.87.121.473469034'  e#) ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:40:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<6XxnF9xD6KeB4rs4>129.226.187.561819730l  -c) ossec13001iMExim Auth failed2025-11-18 07:40:22 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:35416: 535 Incorrect authentication data (set_id=eliezer)57.132.150.1626252001  W' ossec9708iM>Dovecot Aborted Login with empty userNov 18 07:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z  -}+ ossec13001iMExim Auth failed2025-11-18 07:40:02 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:63445: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)223.197.153.1431819730(  e#+ ossec9710iLDovecot Auth failed on disconnected session.Nov 18 07:39:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001 W' ossec9708iLDovecot Aborted Login with empty userNov 18 07:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 + oA/+S4  -5% ossec13001iMExim Auth failed2025-11-18 07:42:46 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:40233: 535 Incorrect authentication data (set_id=support)58.16.201.521814991)3  e-# ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:42:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750i2  -]) ossec13001iMExim Auth failed2025-11-18 07:42:31 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:57698: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)119.164.159.861814991w1  -{' ossec13001iMExim Auth failed2025-11-18 07:42:55 dovecot_login authenticator failed for (9.134.166.220.broad.dy.sc.dynamic.163data.com.cn) [220.166.134.9]:43966: 535 Incorrect authentication data (set_id=rodrigo)220.166.134.91814991&0  e!) ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:42:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044*/ U9% ossec11001iMDeferred login on the cpanel service[2025-11-18 07:42:40 -0300] info [webmaild] 177.4.64.247 - xavier@projetocircense.com.br "GET /cpsess9988883684/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect177.4.64.2473469034/.  e5' ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:42:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822#-  k+ ossec9709iMMultiple Dovecot Aborted Logins with empty userNov 18 07:42:53 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=177.155.199.1763469034s,  -q) ossec13001iMExim Auth failed2025-11-18 07:42:34 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:35909: 535 Incorrect authentication data (set_id=support@fottolegal.com.br)222.252.21.2401562822+ W' ossec9708iMDovecot Aborted Login with empty userNov 18 07:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a*  -O' ossec13001iMExim Auth failed2025-11-18 07:42:15 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:53004: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.7218197303)  e;) ossec9710iMrDovecot Auth failed on disconnected session.Nov 18 07:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044T(  -7% ossec13001iMnExim Auth failed2025-11-18 07:41:49 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:53990: 535 Incorrect authentication data (set_id=recepcao)61.1.105.1051269750.'  e/+ ossec9710iMdDovecot Auth failed on disconnected session.Nov 18 07:41:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822  R b 2B  -) ossec13001iNExim Auth failed2025-11-18 07:44:40 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:43572: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)34.126.114.2391880251A W' ossec9708iNDovecot Aborted Login with empty userNov 18 07:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c@  -W# ossec13001iN Exim Auth failed2025-11-18 07:44:26 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:38700: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)180.71.9.311835841l?  -e' ossec13001iNExim Auth failed2025-11-18 07:44:18 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:51260: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)95.220.47.2422017370#>  e% ossec9710iN&Dovecot Auth failed on disconnected session.Nov 18 07:44:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060&=  e!) ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:43:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750~<  -) ossec13001iMExim Auth failed2025-11-18 07:43:39 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:45743: 535 Incorrect authentication data (set_id=administrativo@cleservicosindustriais.com.br)118.45.101.1591835841; W' ossec9708iMDovecot Aborted Login with empty userNov 18 07:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,:  e/' ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:43:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<0yY5ItxDkrRSczCz>82.115.48.1791522867l9  -e' ossec13001iMExim Auth failed2025-11-18 07:43:53 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:41497: 535 Incorrect authentication data (set_id=administrativo)201.173.86.133996063+8  e++ ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:43:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758,7  e++ ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:42:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822(6  e#+ ossec9710iMDovecot Auth failed on disconnected session.Nov 18 07:42:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.20418358415 W+ ossec9708iMDovecot Aborted Login with empty userNov 18 07:42:52 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034 o   JUp_olQ  -i# ossec13001iNIExim Auth failed2025-11-18 07:45:27 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:39914: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)24.121.1.616252001 P  -#+ ossec13001iN9Exim Auth failed2025-11-18 07:45:11 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:51391: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)212.120.163.1102017370aO  -K+ ossec13001iN7Exim Auth failed2025-11-18 07:45:10 dovecot_login authenticator failed for ([109.233.211.102]) [109.233.211.102]:51526: 535 Incorrect authentication data (set_id=misterthomas)109.233.211.1022017370qN  -m) ossec13001iN_Exim Auth failed2025-11-18 07:45:49 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:55664: 535 Incorrect authentication data (set_id=bruno)198.71.106.10262520015M  e?) ossec9710iNODovecot Auth failed on disconnected session.Nov 18 07:45:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730L  k' ossec9709iNOMultiple Dovecot Aborted Logins with empty userNov 18 07:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\K  -K! ossec13001iNKExim Auth failed2025-11-18 07:45:30 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:35868: 535 Incorrect authentication data (set_id=contato)87.76.5.3620173700J  e3+ ossec9710iNGDovecot Auth failed on disconnected session.Nov 18 07:45:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<3+dKKdxDYOxxoZB3>113.161.144.1191562822/I  e7% ossec9710iNADovecot Auth failed on disconnected session.Nov 18 07:45:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991H  W' ossec9708iNkDovecot Aborted Login with empty userNov 18 07:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gG  -]% ossec13001iN_Exim Auth failed2025-11-18 07:45:50 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:32795: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)1.82.135.1541814991(F  e'' ossec9710iN"Dovecot Auth failed on disconnected session.Nov 18 07:44:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001[E  -?+ ossec13001iNExim Auth failed2025-11-18 07:44:29 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:43170: 535 Incorrect authentication data (set_id=juliana)122.185.176.1261269750UD  -7' ossec13001iN"Exim Auth failed2025-11-18 07:44:49 dovecot_login authenticator failed for ([1.235.192.130]) [1.235.192.130]:58972: 535 Incorrect authentication data (set_id=rafael)1.235.192.1301835841'C  e%' ossec9710iNDovecot Auth failed on disconnected session.Nov 18 07:44:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001 J   E i j}*J\b  -A+ ossec13001iNExim Auth failed2025-11-18 07:47:49 dovecot_login authenticator failed for ([175.198.180.129]) [175.198.180.129]:36424: 535 Incorrect authentication data (set_id=rodrigo)175.198.180.1291835841ga  -[' ossec13001iNExim Auth failed2025-11-18 07:47:06 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:55166: 535 Incorrect authentication data (set_id=alex.vendas)208.96.233.676251999]` -E' ossec13001iNExim Auth failed2025-11-18 07:46:33 dovecot_login authenticator failed for (lorussoimoveis.com.br) [112.122.54.54]:12258: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991U_  -9% ossec13001iNExim Auth failed2025-11-18 07:46:51 dovecot_login authenticator failed for ([183.94.220.9]) [183.94.220.9]:44072: 535 Incorrect authentication data (set_id=novamanha)183.94.220.91814991l^  -c) ossec13001iNExim Auth failed2025-11-18 07:46:45 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45630: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)200.106.49.1493932488n]  -i' ossec13001iNExim Auth failed2025-11-18 07:46:39 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:37916: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)186.5.178.2293865483g\  -]% ossec13001iNExim Auth failed2025-11-18 07:47:00 dovecot_login authenticator failed for ([202.84.34.85]) [202.84.34.85]:58326: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)202.84.34.851210997f[  -U+ ossec13001iNExim Auth failed2025-11-18 07:46:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52075: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034sZ  -s' ossec13001iNExim Auth failed2025-11-18 07:46:36 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:53646: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)125.20.224.101269750iY  -]) ossec13001iNExim Auth failed2025-11-18 07:46:35 dovecot_login authenticator failed for ([70.174.168.102]) [70.174.168.102]:55298: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)70.174.168.1026252001{X  -) ossec13001iNrExim Auth failed2025-11-18 07:46:10 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:41339: 535 Incorrect authentication data (set_id=atualizacoes1)216.80.100.2356252001XW  -=' ossec13001iNExim Auth failed2025-11-18 07:46:54 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:52571: 535 Incorrect authentication data (set_id=comercial)147.92.66.1886251999TV  -5' ossec13001iNExim Auth failed2025-11-18 07:46:50 dovecot_login authenticator failed for (oabsjp.org.br) [61.50.119.110]:12462: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991pU  -i+ ossec13001iNExim Auth failed2025-11-18 07:46:45 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:47697: 535 Incorrect authentication data (set_id=adriana)166.195.195.1696252001iT  -]) ossec13001iNExim Auth failed2025-11-18 07:46:39 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:49297: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)61.145.163.1641814991S W' ossec9708iNDovecot Aborted Login with empty userNov 18 07:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dR  -U' ossec13001iNExim Auth failed2025-11-18 07:47:06 dovecot_login authenticator failed for (m121-202-152-6.smartone.com) [121.202.152.6]:15110: 535 Incorrect authentication data (set_id=novamanha)121.202.152.61819730  6q  k' ossec9709iOMultiple Dovecot Aborted Logins with empty userNov 18 07:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/p  e1+ ossec9710iNDovecot Auth failed on disconnected session.Nov 18 07:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<7moWNNxDfN6Gx8nN>134.199.201.2056252001\o  -I% ossec13001iO#Exim Auth failed2025-11-18 07:49:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63591: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758Vn  -9' ossec13001iO!Exim Auth failed2025-11-18 07:49:04 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:45502: 535 Incorrect authentication data (set_id=contato)103.220.16.511269750Ym  -;+ ossec13001iNExim Auth failed2025-11-18 07:47:30 dovecot_login authenticator failed for ([122.187.230.141]) [122.187.230.141]:53596: 535 Incorrect authentication data (set_id=info)122.187.230.1411269750bl  -O) ossec13001iNExim Auth failed2025-11-18 07:47:27 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:59916: 535 Incorrect authentication data (set_id=ieqcampocomprido)173.25.186.1306252001}k  -) ossec13001iNExim Auth failed2025-11-18 07:47:12 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:36673: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)35.130.111.1466252001sj  -u% ossec13001iNExim Auth failed2025-11-18 07:48:03 dovecot_login authenticator failed for ([77.95.56.101]) [92.62.79.243]:51691: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)92.62.79.2431527747i  - ' ossec13001iNExim Auth failed2025-11-18 07:47:58 dovecot_login authenticator failed for (175.48.89.218.broad.ls.sc.dynamic.163data.com.cn) [218.89.48.175]:51422: 535 Incorrect authentication data (set_id=administrativo1)218.89.48.1751814991fh  -_% ossec13001iNExim Auth failed2025-11-18 07:47:33 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:57077: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)65.20.251.5399237g W' ossec9708iNDovecot Aborted Login with empty userNov 18 07:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f  -% ossec13001iNExim Auth failed2025-11-18 07:47:42 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:40899: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)90.173.78.9025107692e  e7+ ossec9710iNDovecot Auth failed on disconnected session.Nov 18 07:47:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822_d  -K' ossec13001iNExim Auth failed2025-11-18 07:47:15 dovecot_login authenticator failed for (oabsjp.org.br) [61.50.119.110]:16776: 535 Incorrect authentication data (set_id=test@oabsjp.org.br)61.50.119.1101814991)c  e%+ ossec9710iNDovecot Auth failed on disconnected session.Nov 18 07:47:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    H > 4 z p f \ R   * vNlDbX&:0@^"TJ,6|rh<ndZxPF 2(j`V~tLB8.$p\zf | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& iQ&i iQ&h iQ&g iQ&f iQ&e iQ&d iQ&c iQ&b iQ&a iQ&` iQ&_ iQ&^ iQ&] iQ[&\ iQU&[ iQO&Z iQq&Y iQg&X iQY&W iQs&V iQk&U iQk&T iQg&S iQ?&R iQ;&Q iQ&P iQ&O iQ&N iQ&M iQ&L iQ&K iP&J iP&I iP&H iP&G iQ&F iP&E iP&D iP&C iP&B iP&A iP&@ iP&? iP&> iP&= iP&< iP&; iP&: iPS&9 iPy&8 iPu&7 iPk&6 iPi&5 iPc&4 iPm&3 iP&2 iP&1 iP&0 iPK&/ iPK&. iPI&- iP=&, iP;&+ iP-&* iPI&) iP&( iO&' iP&& iP&% iO&$ iO&# iO&" iO&! iO& iO& iO& iO& iO& iP& iP & iP & iO& iO& iO& iO& iO& iO& iO& iO& iO& iO& iO& iO& iOy& iOy& iOy& iOg& iO& iO& iO& iO1& iO-& iOU& iO=& iO1& iO-& iOU% iOQ% iOG% iO3% iO% iO% iO% iN% iN% iO% iO% iN% iO% iO% iO% iN% iO#% iO!% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iN% iNr% iNk% iN_% iN_% iNO% iNO% iNK% iNI% iNG% iNA% iN9% iN7% iN&% iN"% iN"% iN% iN% iN% iN% iR~& iR|& iRz& iRv& iRh& iRh& iR\& iR\& iRV& iRI& iRB& iRB& iR>& iR>& iR4& iR,& iR,& iR*&z iR&& iR"&~ iR&} iR& iR&y iR&x iR& iR& iQ& iQ&| iQ&{ iQ&j iQ&p iQ&s iQ&o iQ&v iQ&n iQ&r iQ&q iQ&m iQ&u iQ&w iQ&l iQ&k iQ&t iN % iN% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iM% iMv% iMr% iMn% iMd% iM^% iM\% iMR% iM>% iM&% iM"% iM"% iM"% iM% iM% iM% iL% iL% iL% iL% iL% iR& iL% iL% iL% iL% iL% iL% iL% iL% iL% iLr% iLr% iLn% iLl% iLh% iLd% iL`% iLX% iLV% iLV% iLT%} iLB%~ iL8%| iL2% iL0% iL&% iL %{ iL% iL%u iL%t iL %y iL %x iK%w iK%z iK%s iK%v iK%q iK%p iK%o iK%n iK%m iK%l iK%r   % 2 X  -?% ossec13001iO-Exim Auth failed2025-11-18 07:49:16 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:46510: 535 Incorrect authentication data (set_id=financeiro)182.78.73.941269750 Sq' ossec11000iOULogin failed on the cpanel service.[2025-11-18 07:49:56 -0300] info [cpaneld] 185.213.83.10 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password185.213.83.101643084~  -=) ossec13001iOQExim Auth failed2025-11-18 07:49:52 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:41674: 535 Incorrect authentication data (set_id=isabellylisboa)179.48.229.1173469034s}  -s' ossec13001iOGExim Auth failed2025-11-18 07:49:41 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:37702: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)193.46.192.202510769||  -+ ossec13001iO3Exim Auth failed2025-11-18 07:49:23 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:58864: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)115.247.159.1061269750f{  -]# ossec13001iOExim Auth failed2025-11-18 07:48:48 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:39505: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)187.93.2.863469034z  W' ossec9708iODovecot Aborted Login with empty userNov 18 07:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9mQ+NtxDXoOxV3kv>177.87.121.473469034y  - ) ossec13001iOExim Auth failed2025-11-18 07:48:50 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:56340: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)57.132.150.1626252001'x  e%' ossec9710iNDovecot Auth failed on disconnected session.Nov 18 07:48:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991(w  e'' ossec9710iNDovecot Auth failed on disconnected session.Nov 18 07:48:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084ov  -k' ossec13001iOExim Auth failed2025-11-18 07:49:02 dovecot_login authenticator failed for ([37.79.241.214]) [37.79.241.214]:49542: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)37.79.241.2142017370Yu  -?' ossec13001iOExim Auth failed2025-11-18 07:48:59 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:49438: 535 Incorrect authentication data (set_id=financeiro)191.59.187.133469034st  -o+ ossec13001iNExim Auth failed2025-11-18 07:48:07 dovecot_login authenticator failed for ([119.205.188.194]) [119.205.188.194]:59552: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)119.205.188.1941835841\s  -C) ossec13001iOExim Auth failed2025-11-18 07:48:54 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:44449: 535 Incorrect authentication data (set_id=financeiro)112.25.140.2111814991#r  e!# ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:48:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483    }N4 r  -s% ossec13001iOExim Auth failed2025-11-18 07:50:39 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:58748: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)98.161.232.962520013  e9+ ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:50:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822&  e%% ossec9710iOyDovecot Auth failed on disconnected session.Nov 18 07:50:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991 W' ossec9708iOyDovecot Aborted Login with empty userNov 18 07:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e+) ossec9710iOyDovecot Auth failed on disconnected session.Nov 18 07:50:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841,  e-) ossec9710iOgDovecot Auth failed on disconnected session.Nov 18 07:50:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<0UJqOtxDJr6d5hjP>157.230.24.2072921044^  ;=% ossec13008iOMail Recipient rejected2025-11-18 07:50:58 H=(195.3.134.135) [179.0.178.53]:64100 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:64100 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034W  -;) ossec13001iOExim Auth failed2025-11-18 07:51:06 dovecot_login authenticator failed for ([78.101.217.177]) [78.101.217.177]:56626: 535 Incorrect authentication data (set_id=rafael)78.101.217.177289688$  e' ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:51:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001H  -) ossec13001iO1Exim Auth failed2025-11-18 07:49:20 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:60240: 535 Incorrect authentication data90.161.217.2282510769/  e5' ossec9710iO-Dovecot Auth failed on disconnected session.Nov 18 07:49:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991V  -9' ossec13001iOUExim Auth failed2025-11-18 07:49:57 dovecot_login authenticator failed for ([112.168.38.78]) [112.168.38.78]:39682: 535 Incorrect authentication data (set_id=adriana)112.168.38.781835841 W' ossec9708iO=Dovecot Aborted Login with empty userNov 18 07:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w  -w+ ossec13001iO1Exim Auth failed2025-11-18 07:49:21 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:32890: 535 Incorrect authentication data (set_id=atualizacoes)122.187.240.2101269750 7 y_11M7Z  -A' ossec13001iOExim Auth failed2025-11-18 07:52:19 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:36106: 535 Incorrect authentication data (set_id=venesselume)27.24.141.11218149914  e?' ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:53:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<2AReRNxD9qVn9M4G>103.244.206.61643084`  -I+ ossec13001iP Exim Auth failed2025-11-18 07:53:01 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:60226: 535 Incorrect authentication data (set_id=programador)121.131.220.1521835841|  -+ ossec13001iP Exim Auth failed2025-11-18 07:52:57 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:46342: 535 Incorrect authentication data (set_id=novalondrina)212.120.163.1102017370*  -]+ ossec13001iOExim Auth failed2025-11-18 07:52:43 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:55348: 535 Incorrect authentication data (set_id=programador@radiosarabrasil.fm.br)200.175.201.1673469034 W' ossec9708iODovecot Aborted Login with empty userNov 18 07:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  e' ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:51:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822%  e!' ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:51:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991  W' ossec9708iODovecot Aborted Login with empty userNov 18 07:52:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k  -g# ossec13001iOExim Auth failed2025-11-18 07:51:58 dovecot_login authenticator failed for (58-115-14-2.twt1.com.tw) [58.115.14.2]:39096: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)58.115.14.21668284i  -e% ossec13001iOExim Auth failed2025-11-18 07:51:48 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:38558: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)65.20.158.1099237  k' ossec9709iOMultiple Dovecot Aborted Logins with empty userNov 18 07:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1kQvP9xDZsqxV3kv>177.87.121.473469034f  -U+ ossec13001iOExim Auth failed2025-11-18 07:51:03 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52349: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.14134690340  e9% ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:50:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001 ? | N <0Y?* W' ossec9708iP-Dovecot Aborted Login with empty userNov 18 07:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,)  e++ ossec9710iPIDovecot Auth failed on disconnected session.Nov 18 07:54:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841#(  3K) ossec11301iPNew FTP connection.Nov 18 07:53:10 hosting pure-ftpd: (?@148.113.206.49) [INFO] New connection from 148.113.206.49148.113.206.496251999\'  -C) ossec13001iOExim Auth failed2025-11-18 07:52:13 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:56055: 535 Incorrect authentication data (set_id=formula316)61.145.163.1641814991(&  e#+ ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:52:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001S%  -7# ossec13001iPExim Auth failed2025-11-18 07:52:48 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:44072: 535 Incorrect authentication data (set_id=contato)182.95.47.21269750d$  -W% ossec13001iOExim Auth failed2025-11-18 07:52:31 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:50312: 535 Incorrect authentication data (set_id=novalondrina@cieadep.com)111.26.63.871814991g#  -_# ossec13001iOExim Auth failed2025-11-18 07:52:19 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:52720: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)187.8.17.3834690340"  e9% ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:52:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.418358410! e5' ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:52:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730*  e)) ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387+  e-' ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:52:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<2XhSQdxDnJktPZWl>45.61.149.1656252001*  e-% ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841#  e+ ossec9710iODovecot Auth failed on disconnected session.Nov 18 07:52:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758 , gw^$K(,b9  -O) ossec13001iPSExim Auth failed2025-11-18 07:54:11 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:46632: 535 Incorrect authentication data (set_id=contato)188.81.132.1142264397e8  -U+ ossec13001iPyExim Auth failed2025-11-18 07:54:48 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:64551: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795o7  -i) ossec13001iPuExim Auth failed2025-11-18 07:54:45 dovecot_login authenticator failed for ([219.139.39.106]) [219.139.39.106]:58102: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)219.139.39.106181499166  eA) ossec9710iPkDovecot Auth failed on disconnected session.Nov 18 07:54:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197305  k' ossec9709iPiMultiple Dovecot Aborted Logins with empty userNov 18 07:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U4  -7) ossec13001iPcExim Auth failed2025-11-18 07:54:25 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:36565: 535 Incorrect authentication data (set_id=bqtz)80.227.138.21429055763  eA) ossec9710iPmDovecot Auth failed on disconnected session.Nov 18 07:54:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697502  W' ossec9708iPDovecot Aborted Login with empty userNov 18 07:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l1  -c) ossec13001iPExim Auth failed2025-11-18 07:55:01 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [103.135.46.118]:34372: 535 Incorrect authentication data (set_id=contato)103.135.46.1181269750$0  e## ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:54:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483v/  -y' ossec13001iPKExim Auth failed2025-11-18 07:54:01 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:58990: 535 Incorrect authentication data (set_id=bqtz@iemif.com)108.30.14.2216252001..  e1) ossec9710iPKDovecot Auth failed on disconnected session.Nov 18 07:54:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044j-  -a' ossec13001iPIExim Auth failed2025-11-18 07:53:59 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:35291: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)5.140.212.1442017370%,  e#% ossec9710iP=Dovecot Auth failed on disconnected session.Nov 18 07:53:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370*+  e)) ossec9710iP;Dovecot Auth failed on disconnected session.Nov 18 07:53:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750 . F , h^H -E) ossec13001iPExim Auth failed2025-11-18 07:56:17 dovecot_login authenticator failed for (User) [177.74.174.120]:49447: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)177.74.174.12034690342G  e7+ ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:56:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001lF  -c) ossec13001iQExim Auth failed2025-11-18 07:57:05 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:60820: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)195.222.57.1833277605&E  e%% ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:57:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001XD  -E! ossec13001iPExim Auth failed2025-11-18 07:56:16 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:56645: 535 Incorrect authentication data (set_id=rodrigo)89.67.37.2798544"C  e) ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:56:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=152.53.188.1442921044.B  e1) ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:55:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001.A  e5% ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:55:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841k@  -c' ossec13001iPExim Auth failed2025-11-18 07:56:05 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:60370: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)103.68.52.2101269750i?  -a% ossec13001iPExim Auth failed2025-11-18 07:55:55 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:46112: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)115.77.111.21562822.>  e/+ ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:55:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001= W' ossec9708iPDovecot Aborted Login with empty userNov 18 07:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d<  -[# ossec13001iPExim Auth failed2025-11-18 07:55:24 dovecot_login authenticator failed for ([95.3.36.154]) [95.3.36.154]:60449: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)95.3.36.154298795^; -E) ossec13001iPExim Auth failed2025-11-18 07:56:01 dovecot_login authenticator failed for (User) [177.74.174.120]:49447: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)177.74.174.1203469034l:  -i# ossec13001iPExim Auth failed2025-11-18 07:56:00 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:57383: 535 Incorrect authentication data (set_id=sec.geral)189.56.0.193469034 L JBmT[yzfLW W' ossec9708iQYDovecot Aborted Login with empty userNov 18 07:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340V  e5) ossec9710iQsDovecot Auth failed on disconnected session.Nov 18 07:58:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387\U  -G% ossec13001iQkExim Auth failed2025-11-18 07:58:50 dovecot_login authenticator failed for ([58.211.39.86]) [58.211.39.86]:46460: 535 Incorrect authentication data (set_id=ieqcampocomprido)58.211.39.861814991{T  -% ossec13001iQkExim Auth failed2025-11-18 07:58:50 dovecot_plain authenticator failed for c-68-37-40-218.hsd1.mi.comcast.net (colows) [68.37.40.218]:48812: 535 Incorrect authentication data (set_id=design@inovasite.com)68.37.40.2186252001^S  -G) ossec13001iQgExim Auth failed2025-11-18 07:58:46 dovecot_plain authenticator failed for (bolvings) [90.160.139.163]:49411: 535 Incorrect authentication data (set_id=design@inovasite.com)90.160.139.1632510769uR  -u) ossec13001iQ?Exim Auth failed2025-11-18 07:58:06 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:42546: 535 Incorrect authentication data (set_id=compras@highqualityautoparts.com.br)120.157.65.1082077456Q  W' ossec9708iQ;Dovecot Aborted Login with empty userNov 18 07:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034QP  -5% ossec13001iQExim Auth failed2025-11-18 07:57:31 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:42088: 535 Incorrect authentication data (set_id=contato)65.20.251.5399237O  -) ossec13001iQExim Auth failed2025-11-18 07:57:21 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:60810: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)42.200.196.14118197306N  eE' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 07:57:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.74.225.186, lip=200.150.196.245, session=62.74.225.186390903)M  e') ossec9710iQDovecot Auth failed on disconnected session.Nov 18 07:57:33 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=182.75.215.245, lip=200.150.196.245, TLS, session=182.75.215.2451269750[L  -C' ossec13001iQExim Auth failed2025-11-18 07:57:34 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:33034: 535 Incorrect authentication data (set_id=atualizacoes)182.95.46.1781269750K  k' ossec9709iQMultiple Dovecot Aborted Logins with empty userNov 18 07:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034J W' ossec9708iPDovecot Aborted Login with empty userNov 18 07:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/I  e3+ ossec9710iPDovecot Auth failed on disconnected session.Nov 18 07:56:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758  .f  e5% ossec9710iQDovecot Auth failed on disconnected session.Nov 18 07:59:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001e  -' ossec13001iQExim Auth failed2025-11-18 07:59:20 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:64443: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)77.106.78.2152017370#d  k+ ossec9709iQMultiple Dovecot Aborted Logins with empty userNov 18 08:00:02 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=<4xyUXdxDf/mxm8ew>177.155.199.1763469034Sc  -7# ossec13001iQExim Auth failed2025-11-18 07:59:42 dovecot_login authenticator failed for ([59.6.75.186]) [59.6.75.186]:59586: 535 Incorrect authentication data (set_id=financeiro)59.6.75.1861835841b  -) ossec13001iQExim Auth failed2025-11-18 07:59:10 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60502: 535 Incorrect authentication data (set_id=ieqcampocomprido)109.195.166.622017370pa  -s# ossec13001iQExim Auth failed2025-11-18 08:00:03 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:54246: 535 Incorrect authentication data (set_id=contato@89fmjoinville.com.br)89.67.37.52798544` W' ossec9708iQDovecot Aborted Login with empty userNov 18 07:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034__  -G+ ossec13001iQExim Auth failed2025-11-18 07:59:31 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:46442: 535 Incorrect authentication data (set_id=marialuiza)197.219.228.2421036973o^  -k' ossec13001iQExim Auth failed2025-11-18 07:59:28 dovecot_login authenticator failed for ([95.66.178.169]) [95.66.178.169]:38069: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)95.66.178.1692017370+]  e+) ossec9710iQDovecot Auth failed on disconnected session.Nov 18 07:59:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822X\  -A# ossec13001iQ[Exim Auth failed2025-11-18 07:58:35 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:50635: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999/[  e1+ ossec9710iQUDovecot Auth failed on disconnected session.Nov 18 07:58:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001lZ  -e' ossec13001iQOExim Auth failed2025-11-18 07:58:22 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:34052: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)118.121.234.51814991gY  -[' ossec13001iQqExim Auth failed2025-11-18 07:58:56 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:41626: 535 Incorrect authentication data (set_id=compras)78.66.119.13926618861X  e;' ossec9710iQgDovecot Auth failed on disconnected session.Nov 18 07:58:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758  ywLo4jt  -]+ ossec13001iQExim Auth failed2025-11-18 08:00:08 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:43286: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)123.209.106.19020774567s  eE' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:00:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.20462520015r  e?) ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:00:37 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=35.130.111.146, lip=200.150.196.245, TLS, session=35.130.111.1466252001q W' ossec9708iQDovecot Aborted Login with empty userNov 18 08:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4WxqX9xDqMSxV3kv>177.87.121.4734690347p  eE' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:01:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651Yo  -?' ossec13001iQExim Auth failed2025-11-18 08:00:43 dovecot_login authenticator failed for ([175.10.38.108]) [175.10.38.108]:49046: 535 Incorrect authentication data (set_id=marialuiza)175.10.38.1081814991'n  e)# ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:00:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001~m  -) ossec13001iQExim Auth failed2025-11-18 08:00:30 dovecot_login authenticator failed for 110-25-112-152.adsl.fetnet.net [110.25.112.152]:46365: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)110.25.112.1521668284+l  e-' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:00:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.11015628222k  e7+ ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:00:17 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=178.216.165.187, lip=200.150.196.245, session=178.216.165.1872017370j  e ' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:01:06 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=61.136.142.13, lip=200.150.196.245, TLS, session=<6DXrX9xDOpg9iI4N>61.136.142.131814991ei  -U) ossec13001iQExim Auth failed2025-11-18 07:59:43 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:58924: 535 Incorrect authentication data (set_id=vendas.luiz)222.252.21.2401562822h W+ ossec9708iQDovecot Aborted Login with empty userNov 18 08:00:01 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034sg  -q) ossec13001iQExim Auth failed2025-11-18 07:59:20 dovecot_login authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:48660: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)110.25.104.1011668284 k|pdXL@4( k~qdWJ=0# z m ` S F 9 ,    w | p d X L @ 4 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )  597427/ 6251999/ 597427. 597427.4 6251999- 6251999- 6251999-N 6251999+ 6251999+{ 597427+! 6251999+ 6251999* 6251999)h 597427' 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001~ 6252001| 6252001o 6252001W 6252001B 6252001% 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001{ 6252001x 6252001p 6252001m 6252001f 6252001U 6252001P 6252001N 6252001? 6252001" 6252001 6252001 6252001 6252001 6252001 6252001 6252001| 6252001U 6252001G 6252001. 6252001, 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001t 6252001m 6252001k 6252001d 6252001X 6252001K 62520012 6252001+ 6252001 6252001 6252001 6252001 6251999&\ 6251999&( 6251999% 6251999% 6251999%@ 6251999%$ 6251999$/ 6251999" 6251999!z 6251999 L 6251999 6251999c 6251999 6251999 6251999K 6251999 6251999y 6251999A 6251999 6251999 6251999 6251999 6251999& 6251999 6251999 6251999 6251999 6251999 6251999 6251999] 6251999 6251999 6251999 6251999 6251999 6251999V 614540> 614540 * 614540 597427 597427U 597427 597427 597427a 597427 597427 597427 597427 597427 597427 597427 597427 597427 597427 597427 597427 597427 597427 597427Y 597427 597427 597427 597427 597427 597427 597427   i r  -o) ossec13001iR,Exim Auth failed2025-11-18 08:02:03 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:57432: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)182.95.222.1781269750i  -c# ossec13001iR,Exim Auth failed2025-11-18 08:02:03 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:41406: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)64.53.7.2316252001`  -O% ossec13001iRExim Auth failed2025-11-18 08:01:43 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:40214: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)61.72.58.2421835841_  -G+ ossec13001iRExim Auth failed2025-11-18 08:01:27 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52267: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034e  -W' ossec13001iR&Exim Auth failed2025-11-18 08:01:57 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:39812: 535 Incorrect authentication data (set_id=adm)123.194.136.31668284[~  -G' ossec13001iR"Exim Auth failed2025-11-18 08:01:53 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:40443: 535 Incorrect authentication data (set_id=isabellylisboa)65.20.251.17099237^}  -K' ossec13001iRExim Auth failed2025-11-18 08:01:48 dovecot_login authenticator failed for ([41.65.118.172]) [41.42.206.123]:56692: 535 Incorrect authentication data (set_id=marcelo.pinheiro)41.42.206.123357994-| e/' ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:01:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<3OCaYdxDKLotPZWl>45.61.149.16562520011{  e7) ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:01:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<6QKJYdxDWMV2wSaf>118.193.38.1591819730,z  e-) ossec9710iR*Dovecot Auth failed on disconnected session.Nov 18 08:02:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730y  -)) ossec13001iRExim Auth failed2025-11-18 08:01:42 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:52153: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)122.187.226.131269750ix  -e! ossec13001iRExim Auth failed2025-11-18 08:01:34 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:47788: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)61.2.44.541269750Yw  -=) ossec13001iQExim Auth failed2025-11-18 08:00:21 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:44696: 535 Incorrect authentication data (set_id=contato)182.149.67.2001814991rv  -o) ossec13001iQExim Auth failed2025-11-18 08:00:38 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:53386: 535 Incorrect authentication data (set_id=fabio.vendas)24.233.210.1886252001*u  e)) ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:00:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<95UIX9xDwCeKxX03>138.197.125.556252001 M  C _<S:Z\.+JMy  -}) ossec13001iRvExim Auth failed2025-11-18 08:03:17 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:59455: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)103.168.241.321269750]  -O ossec13001iRExim Auth failed2025-11-18 08:03:58 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:37734: 535 Incorrect authentication data (set_id=edna)81.43.3.12510769  -+ ossec13001iRExim Auth failed2025-11-18 08:03:32 dovecot_login authenticator failed for (175-182-108-150.adsl.dynamic.seed.net.tw) [175.182.108.150]:55838: 535 Incorrect authentication data (set_id=andressa.financeiro)175.182.108.1501668284*  e/# ossec9710iRBDovecot Auth failed on disconnected session.Nov 18 08:02:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001z  -' ossec13001iR4Exim Auth failed2025-11-18 08:02:11 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:52783: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)172.90.128.976252001\  -A+ ossec13001iRhExim Auth failed2025-11-18 08:03:02 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:33675: 535 Incorrect authentication data (set_id=contato)202.142.148.1621168579  W' ossec9708iRhDovecot Aborted Login with empty userNov 18 08:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  -[# ossec13001iR\Exim Auth failed2025-11-18 08:02:50 dovecot_login authenticator failed for ([92.55.3.238]) [92.55.3.238]:63892: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)92.55.3.2382017370  k' ossec9709iRIMultiple Dovecot Aborted Logins with empty userNov 18 08:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`  -O' ossec13001iR>Exim Auth failed2025-11-18 08:02:21 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53588: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795T  -9# ossec13001iR>Exim Auth failed2025-11-18 08:02:20 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:52305: 535 Incorrect authentication data (set_id=vendas.luiz)113.59.34.51814991[  -C' ossec13001iR\Exim Auth failed2025-11-18 08:02:51 dovecot_login authenticator failed for ([218.107.0.188]) [218.107.0.188]:35578: 535 Incorrect authentication data (set_id=fabio.vendas)218.107.0.1881814991m  -k# ossec13001iRVExim Auth failed2025-11-18 08:02:45 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:47906: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)14.54.22.111835841V  -7) ossec13001iRBExim Auth failed2025-11-18 08:02:24 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:46312: 535 Incorrect authentication data (set_id=edna)152.52.244.2021269750 W' ossec9708iRDovecot Aborted Login with empty userNov 18 08:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  e# ossec9710iQDovecot Auth failed on disconnected session.Nov 18 08:01:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750   W4 n!  -g) ossec13001iS Exim Auth failed2025-11-18 08:05:47 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:53022: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)115.241.228.3412697503  e?% ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:05:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382  k' ossec9709iRMultiple Dovecot Aborted Logins with empty userNov 18 08:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340  e7' ossec9710iRDovecot Auth failed on disconnected session.Nov 18 08:04:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991 W' ossec9708iRDovecot Aborted Login with empty userNov 18 08:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o  -o% ossec13001iRExim Auth failed2025-11-18 08:04:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53606: 535 Incorrect authentication data (set_id=administrativo2@cleservicosindustriais.com.br)62.60.131.40130758}  -' ossec13001iR~Exim Auth failed2025-11-18 08:03:25 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (humon) [174.59.253.88]:58686: 535 Incorrect authentication data (set_id=design@inovasite.com)174.59.253.886252001n  -m# ossec13001iR|Exim Auth failed2025-11-18 08:03:22 dovecot_plain authenticator failed for 68.129.5.84.rev.sfr.net (spling) [84.5.129.68]:58750: 535 Incorrect authentication data (set_id=design@inovasite.com)84.5.129.6830173826  e?+ ossec9710iRDovecot Auth failed on disconnected session.Nov 18 08:04:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822$  e) ossec9710iRDovecot Auth failed on disconnected session.Nov 18 08:04:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841q  -o' ossec13001iRExim Auth failed2025-11-18 08:03:41 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:36754: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)93.241.232.142921044 W' ossec9708iRDovecot Aborted Login with empty userNov 18 08:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8JsbatxDlKmxV3kv>177.87.121.473469034Y  -C% ossec13001iRExim Auth failed2025-11-18 08:03:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61419: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758#  e% ossec9710iRzDovecot Auth failed on disconnected session.Nov 18 08:03:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060   6  A,; 0  -+ ossec13001iS|Exim Auth failed2025-11-18 08:07:38 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:32241: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)107.135.117.24562520015/  e?) ossec9710iSlDovecot Auth failed on disconnected session.Nov 18 08:07:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387$.  e!' ossec9710iSfDovecot Auth failed on disconnected session.Nov 18 08:07:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758m-  -e) ossec13001iS^Exim Auth failed2025-11-18 08:07:10 dovecot_plain authenticator failed for 28.244.inn361.ru (emend) [193.169.28.244]:52287: 535 Incorrect authentication data (set_id=info@inovasite.com.br)193.169.28.2442017370k,  -c' ossec13001iS^Exim Auth failed2025-11-18 08:07:09 dovecot_login authenticator failed for ([121.129.34.91]) [121.129.34.91]:47348: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)121.129.34.911835841\+  -A+ ossec13001iS&Exim Auth failed2025-11-18 08:06:13 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:57364: 535 Incorrect authentication data (set_id=rodrigo)190.143.133.1263595528* W' ossec9708iS8Dovecot Aborted Login with empty userNov 18 08:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034()  e'' ossec9710iS6Dovecot Auth failed on disconnected session.Nov 18 08:06:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001X(  -A# ossec13001iS*Exim Auth failed2025-11-18 08:06:17 dovecot_plain authenticator failed for (apiciumist) [46.8.245.34]:39368: 535 Incorrect authentication data (set_id=info@inovasite.com)46.8.245.342017370'  W' ossec9708iSDovecot Aborted Login with empty userNov 18 08:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V&  -9' ossec13001iSExim Auth failed2025-11-18 08:06:00 dovecot_login authenticator failed for ([220.192.75.11]) [220.192.75.11]:35736: 535 Incorrect authentication data (set_id=rodrigo)220.192.75.111814991c%  -U% ossec13001iSExim Auth failed2025-11-18 08:05:59 dovecot_login authenticator failed for ([125.90.72.62]) [125.90.72.62]:34370: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)125.90.72.621814991q$  -k+ ossec13001iRExim Auth failed2025-11-18 08:05:33 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:53582: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)203.172.213.1661605651g# -U+ ossec13001iRExim Auth failed2025-11-18 08:05:33 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51976: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1413469034%"  e%# ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<8G4tctxDKoeUcQQF>148.113.4.51269750 j ^kj?  k' ossec9709iSMultiple Dovecot Aborted Logins with empty userNov 18 08:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z>  -A' ossec13001iSExim Auth failed2025-11-18 08:09:06 dovecot_login authenticator failed for (p187-43.samaralan.ru) [85.236.187.43]:51600: 535 Incorrect authentication data (set_id=cpanel)85.236.187.432017370o=  -m% ossec13001iSExim Auth failed2025-11-18 08:08:23 dovecot_login authenticator failed for ([111.26.62.39]) [111.26.62.39]:40858: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)111.26.62.391814991)<  e') ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:08:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750-;  e1' ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:09:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<2oTxfdxDUu1SczCz>82.115.48.1791522867b:  -U# ossec13001iSExim Auth failed2025-11-18 08:08:54 dovecot_login authenticator failed for ([101.13.5.49]) [101.13.5.49]:55748: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)101.13.5.491668284a9  -M) ossec13001iSExim Auth failed2025-11-18 08:08:51 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:53625: 535 Incorrect authentication data (set_id=paulinho.vendas)210.219.232.34183584118  e7) ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:08:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<6JX4e9xDVueB4kCN>129.226.64.1411819730.7  e1) ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:08:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<376+e9xDUtXSchJs>210.114.18.1081835841y6  -' ossec13001iSExim Auth failed2025-11-18 08:08:07 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:12362: 535 Incorrect authentication data (set_id=administrativo1)77.106.78.21520173705  -+ ossec13001iSExim Auth failed2025-11-18 08:07:55 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:40914: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)121.202.195.1941819730[4  -C' ossec13001iSExim Auth failed2025-11-18 08:07:50 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:63680: 535 Incorrect authentication data (set_id=sandromiguel)209.16.71.25462520013 W' ossec9708iSvDovecot Aborted Login with empty userNov 18 08:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8zpreNxDssKxV3kv>177.87.121.473469034_2  -O# ossec13001iSjExim Auth failed2025-11-18 08:07:21 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:49205: 535 Incorrect authentication data (set_id=contato)58.27.253.61168579+1  e/% ossec9710iS~Dovecot Auth failed on disconnected session.Nov 18 08:07:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841 ]7 P C 6 )    s f Y L ? 2 %  | o b U H ; . ! Dh[NA G   y l _ R E 8 +   uh[NA4' u z m ~qdWJ=0# zm`SF9,vi\OB5(7 . ! re TXK>1$i  sg[OC7+Q a ;  v]5)~qdWJ=0# 3175395 34 3175395*J 3017382( 337996' 3469034 3374766)Y 3469034 3469034 3469034 3469034 3469034 3382998V 337996'R 337996#6 337996!o 337996~ 337996< 3379967 337996 337996x 337996 337996 337996= 337996 337996 337996 337996/ 337996 337996 337996 337996) 337996 < 337996  337996 D 337996  337996 337996 337996u 337996o 337996? 337996" 337996! 3374766$ 3374766 3374766 3374766 : 3374766 3277605&F 3277605%d 3277605$ 3277605!( 3277605' 3277605R 3277605& 3277605 3277605 3277605 3277605 3277605 3277605 3202326R 3175395'& 3175395' 3175395' 3175395' 3175395' 3175395' 3175395' 3175395' 3175395' 3175395& 3175395$ 3175395 3175395u 3175395$ 31753957 3175395( 3175395 31753953 3175395 3175395; 3175395 3175395 3175395+ 3175395 3175395a 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 q 3175395 3175395 _ 3175395 F 3175395 W 3175395 3175395 3175395 3175395P 3175395Z 3175395= 3175395 3175395 3144096') 3144096%5 3144096% 3144096$ 3144096!? 3144096! 3144096 3144096 3144096 3144096 3144096 3144096V 3144096 3144096 3144096G 3144096 3144096 3144096 3144096{ 3144096 3144096n 3144096h 3144096 3144096 3144096x 3144096 o 3144096  3144096 3144096 k 3144096 31440969 3144096 3144096 3144096 3144096 3144096 3144096 3144096 3144096 3144096 3144096 31440963 3144096 3144096 3144096. 3077311 3077311 3057568 3017382' 3017382' 3017382& 3017382& 3017382%0 3017382$Q 3017382# 3017382# 3017382# 3017382#t 3017382" 3017382" 3017382"{ 3017382!p 3017382!] 3017382!+ 3017382! 3017382! 3017382  3017382y 30173826 3017382 3017382 3017382} 3017382T 3017382" 3017382 3017382 3017382 3017382 3017382 3017382 3017382* 3017382 3017382{ 3017382k 3017382 3017382f 3017382+ 3017382 3017382 3017382 3017382L 3017382d 3017382A5 3144096/y 3175395/i 337996/c 3017382/ 3144096. 3374766.P 3017382.B 3175395.0 3194884. 3017382. 3374766- 3175395-/ 3175395, 337996, 3017382, 3277605,{ 337996,a 3144096,# 3144096, 3144096+ 3382998+ 3144096+ 3144096+j 3194884+@ 3175395* 3144096* 3144096* 3144096*w 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034y 3469034w 3469034v 3469034e 3469034b 3469034] 3469034V 3469034U 3469034E 3469034< 34690341 3469034/ 3469034& 3017382) 3017382) 3017382) 3017382) 3144096) 3017382) 337996( 3017382( 3017382( 3374766( 3144096(e 3277605- 3017382(# G *  0 G_85E6SvG+O  e/% ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:09:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841YN  -;+ ossec13001iSExim Auth failed2025-11-18 08:09:33 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:39210: 535 Incorrect authentication data (set_id=info)121.142.165.1111835841_M  -I) ossec13001iSExim Auth failed2025-11-18 08:09:29 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:49098: 535 Incorrect authentication data (set_id=rogerioamorim)61.184.176.2521814991dL  -W% ossec13001iSExim Auth failed2025-11-18 08:09:08 dovecot_login authenticator failed for ([60.21.209.27]) [60.21.209.27]:50067: 535 Incorrect authentication data (set_id=rogerioamorim@ieq.com.br)60.21.209.271814991#K  e% ossec9710iTDovecot Auth failed on disconnected session.Nov 18 08:09:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991lJ  -e' ossec13001iSExim Auth failed2025-11-18 08:09:49 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:33312: 535 Incorrect authentication data (set_id=alex.vendas)73.128.151.926252001I  - ) ossec13001iSExim Auth failed2025-11-18 08:09:31 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:53310: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)45.136.194.1202510769#H  e!# ossec9710iSDovecot Auth failed on disconnected session.Nov 18 08:09:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001dG  -U' ossec13001iSExim Auth failed2025-11-18 08:09:17 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:54264: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)85.117.232.422017370eF  -S+ ossec13001iSExim Auth failed2025-11-18 08:09:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64657: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651\E  -A+ ossec13001iSExim Auth failed2025-11-18 08:09:33 dovecot_login authenticator failed for ([211.116.107.220]) [211.116.107.220]:47246: 535 Incorrect authentication data (set_id=contato)211.116.107.2201835841D W' ossec9708iSDovecot Aborted Login with empty userNov 18 08:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[C  -I! ossec13001iSExim Auth failed2025-11-18 08:09:31 dovecot_login authenticator failed for ([78.36.7.89]) [78.36.7.89]:35011: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)78.36.7.892017370cB  -W% ossec13001iSExim Auth failed2025-11-18 08:09:22 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:5962: 535 Incorrect authentication data (set_id=info@89fmjoinville.com.br)41.220.3.101226074sA  -s' ossec13001iSExim Auth failed2025-11-18 08:09:50 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:36734: 535 Incorrect authentication data (set_id=marialuiza)212.51.34.2292510769@  W' ossec9708iSDovecot Aborted Login with empty userNov 18 08:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 . 4 B ( ]g_^  -M% ossec13001iTExim Auth failed2025-11-18 08:12:40 dovecot_plain authenticator failed for (cappe) [95.79.108.51]:43661: 535 Incorrect authentication data (set_id=info@fkrepresentacoes.com.br)95.79.108.512017370r]  -s% ossec13001iTExim Auth failed2025-11-18 08:12:52 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:40048: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)103.90.27.831643084\  e) ossec9710iTDovecot Auth failed on disconnected session.Nov 18 08:12:09 hosting dovecot: imap-login: Disconnected: Connection closed: read(size=368) failed: Connection reset by peer (user disabled): user=, method=PLAIN, rip=113.10.156.230, lip=200.150.196.245, TLS: read(size=368) failed: Connection reset by peer, session=113.10.156.2301819730[  k' ossec9709iTfMultiple Dovecot Aborted Logins with empty userNov 18 08:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3m3BhtxDmNWxV3kv>177.87.121.473469034fZ  -_! ossec13001iTdExim Auth failed2025-11-18 08:11:31 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:34240: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)59.51.87.91814991rY  -o) ossec13001iTNExim Auth failed2025-11-18 08:11:09 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:60750: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)121.171.95.1121835841X  W' ossec9708iTDovecot Aborted Login with empty userNov 18 08:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qW  -k+ ossec13001iT|Exim Auth failed2025-11-18 08:11:56 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:35376: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)122.185.176.1261269750[V  -C' ossec13001iTxExim Auth failed2025-11-18 08:11:51 dovecot_login authenticator failed for ([172.92.187.68]) [172.92.187.68]:52128: 535 Incorrect authentication data (set_id=fabio.vendas)172.92.187.686252001:U  eG+ ossec9710iT,Dovecot Auth failed on disconnected session.Nov 18 08:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001T W' ossec9708iT(Dovecot Aborted Login with empty userNov 18 08:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nS  -e+ ossec13001iT"Exim Auth failed2025-11-18 08:10:25 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41574: 535 Incorrect authentication data (set_id=bruno)188.219.104.2103175395vR  -w) ossec13001iTExim Auth failed2025-11-18 08:10:13 dovecot_login authenticator failed for ([122.185.152.199]) [182.95.178.158]:53346: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)182.95.178.1581269750lQ  -a+ ossec13001iTLExim Auth failed2025-11-18 08:11:07 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:52162: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.2311605651^P  -E+ ossec13001iSExim Auth failed2025-11-18 08:09:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51834: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.1413469034  m  W' ossec9708iU8Dovecot Aborted Login with empty userNov 18 08:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vl  -9' ossec13001iTExim Auth failed2025-11-18 08:13:07 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:38428: 535 Incorrect authentication data (set_id=contato)182.95.115.701269750k W' ossec9708iTDovecot Aborted Login with empty userNov 18 08:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8GbhjdxDoquxV3kv>177.87.121.473469034|j  -% ossec13001iTExim Auth failed2025-11-18 08:13:12 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (refory) [24.15.216.41]:35206: 535 Incorrect authentication data (set_id=info@inovasite.com.br)24.15.216.416252001si  -u% ossec13001iTExim Auth failed2025-11-18 08:14:06 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:39934: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)1.82.135.1541814991*h  e)) ossec9710iTDovecot Auth failed on disconnected session.Nov 18 08:13:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251_g  -G+ ossec13001iTExim Auth failed2025-11-18 08:13:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51957: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034Vf  -7) ossec13001iTExim Auth failed2025-11-18 08:13:18 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:40262: 535 Incorrect authentication data (set_id=edna)121.189.198.6018358414e  e?' ossec9710iTDovecot Auth failed on disconnected session.Nov 18 08:13:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822d W' ossec9708iTDovecot Aborted Login with empty userNov 18 08:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9XpIitxDsIKxV3kv>177.87.121.473469034fc  -W) ossec13001iTExim Auth failed2025-11-18 08:12:21 dovecot_login authenticator failed for (100.42.171.206.douglasfast.net) [100.42.171.206]:38087: 535 Incorrect authentication data (set_id=xavier)100.42.171.2066252001db  -Q+ ossec13001iTExim Auth failed2025-11-18 08:12:14 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51435: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034Sa  -3' ossec13001iTExim Auth failed2025-11-18 08:12:55 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:47884: 535 Incorrect authentication data (set_id=edna)121.73.163.192186224U`  ;+% ossec13008iTMail Recipient rejected2025-11-18 08:12:49 H=(195.3.134.135) [179.0.178.53]:50370 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:50370 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034q_  -m) ossec13001iTExim Auth failed2025-11-18 08:12:39 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:52276: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)177.135.67.1893469034  _|  -M% ossec13001iUDExim Auth failed2025-11-18 08:15:15 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:33890: 535 Incorrect authentication data (set_id=andressa.financeiro)111.26.63.8718149911{  e9' ossec9710iUlDovecot Auth failed on disconnected session.Nov 18 08:15:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<3P1VltxDgs0rmxBp>43.155.16.1051819730mz  -k# ossec13001iUVExim Auth failed2025-11-18 08:15:33 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:56870: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)46.44.40.822017370y W' ossec9708iUVDovecot Aborted Login with empty userNov 18 08:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<950OldxDiO2xV3kv>177.87.121.473469034Ux  -7' ossec13001iUFExim Auth failed2025-11-18 08:15:18 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:42008: 535 Incorrect authentication data (set_id=envios)152.52.245.381269750/w  e3) ossec9710iUrDovecot Auth failed on disconnected session.Nov 18 08:16:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730Vv  -9' ossec13001iUlExim Auth failed2025-11-18 08:15:56 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:49339: 535 Incorrect authentication data (set_id=contato)112.27.30.2531814991qu  -u% ossec13001iU2Exim Auth failed2025-11-18 08:14:58 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:36254: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)65.20.175.7599237ct  -U% ossec13001iUExim Auth failed2025-11-18 08:14:38 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:48378: 535 Incorrect authentication data (set_id=envios@comercial.art.br)78.81.209.762017370_s  -M% ossec13001iU Exim Auth failed2025-11-18 08:14:20 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:48164: 535 Incorrect authentication data (set_id=andressa.financeiro)94.50.162.6620173700r  e5) ossec9710iU(Dovecot Auth failed on disconnected session.Nov 18 08:14:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730^q  -E+ ossec13001iUExim Auth failed2025-11-18 08:14:33 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:54532: 535 Incorrect authentication data (set_id=sec.geral)160.191.124.2011269750p  k' ossec9709iUMultiple Dovecot Aborted Logins with empty userNov 18 08:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qo  -k+ ossec13001iUExim Auth failed2025-11-18 08:14:21 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:44446: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)197.219.228.2421036973&n  e!) ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:14:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387 a~q ~qdWJ=0#zm`SF9,vi\OB5(reXK1$ {ndWJ=0# >az nbUH;.! x k ^ Q D 7 *    t g Z M @ 3 &  } p c V I < / "   y l _ R E 8 +    u h [ N A 4 '  1821275/ 1819730/ 1819730/ 1819730/ 1819730/ 1819730/Y 1819730/T 1819730/7 1819730/ 1819730. 1819730. 1819730.h 1819730.C 1819730." 1819730. 1819730- 1819730- 1821275- 1819730- 1819730-f 1819730-V 1819730-J 1819730-5 1819730-* 1819730, 1819730, 1819730, 1819730, 1819730,6 1819730, 1819730+ 1819730+ 1819730+ 1819730+ 1819730+a 1819730+] 1819730+ 1819730+ 1819730+ 1819730+ 1819730* 1819730* 1819730* 1819730* 1819730* 1819730* 1819730* 1819730* 1819730* 1819730*r 1819730*` 1819730*I 1819730*A 1819730*9 1819730*. 1819730* 1819730* 1819730* 1819730) 1819730) 1819730) 1819730) 1819730) 1819730) 1819730)o 1819730)Q 1820814)& 1819730) 1819730( 1819730( 1819730( 1819730( 1831722( 1819730( 1819730( 1819730( 1819730( 1819730( 1819730(} 1819730(c 1819730(U 1819730(E 1819730(& 1819730( 1819730' 1819730' 1819730' 1819730' 1819730'a 1819730'4 1819730'# 1819730& 1819730& 1835841_ 1835841V 1835841T 1835841R 1835841> 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841v 1835841g 1835841e 1835841Z 1835841R 1835841I 1835841H 18358415 18358410 1835841' 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841f 1835841Z 1835841N 1835841A 1835841< 18358419 18358416 1835841! 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841} 1835841s 1835841l 1835841h 1835841M 18358418 18358410 1835841, 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841l 1835841b 18358418 1835841. 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841~ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841t 1835841f 1835841N 1835841K 1835841% 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1831722#3 1831722! 1831722  1831722M 1831722w 1831722 1831722k 1821275 1820814@ 1820814W 1820814: 18208143 1820814# 1820814k 1820814V 1820814 1820814 1820814 1820814 1819730& 1819730& 1819730& 1819730& 1819730&{ 1819730&z 1819730&O 1819730&6 1819730&! 1819730% 1819730%   X r X *;"0  e5) ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:18:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044  W' ossec9708iUDovecot Aborted Login with empty userNov 18 08:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -=' ossec13001iUExim Auth failed2025-11-18 08:17:41 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:39511: 535 Incorrect authentication data (set_id=sec.geral)65.20.237.19199237]  -I% ossec13001iUExim Auth failed2025-11-18 08:17:40 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@inovasite.com)8.243.166.663686110  k' ossec9709iUMultiple Dovecot Aborted Logins with empty userNov 18 08:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0k8qnNxDQL+xV3kv>177.87.121.473469034\  -I% ossec13001iUExim Auth failed2025-11-18 08:16:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:65333: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758t  -w% ossec13001iU{Exim Auth failed2025-11-18 08:16:09 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:40564: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)115.77.111.215628225  eA' ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:17:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=150.95.31.1581605651*  e)) ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:16:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841 W' ossec9708iUDovecot Aborted Login with empty userNov 18 08:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b  -Q' ossec13001iUExim Auth failed2025-11-18 08:16:30 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:48620: 535 Incorrect authentication data (set_id=andressa.financeiro)65.191.211.336252001&  3O+ ossec11301iUNew FTP connection.Nov 18 08:16:28 hosting pure-ftpd: (?@165.227.134.101) [INFO] New connection from 165.227.134.101165.227.134.1012921044#  3K) ossec11301iUNew FTP connection.Nov 18 08:16:27 hosting pure-ftpd: (?@164.92.206.255) [INFO] New connection from 164.92.206.255164.92.206.2552921044%~  e+ ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:16:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001*}  e'+ ossec9710iUPDovecot Auth failed on disconnected session.Nov 18 08:15:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991 ` (`Vz` W' ossec9708iVEDovecot Aborted Login with empty userNov 18 08:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  _' ossec11321iV/Active Response. FTP brute force attack (Port 21 is protected)Nov 18 08:19:10 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]31.57.112.16431753954 A_' ossec11302iV/FTP Authentication failed.Nov 18 08:19:10 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]31.57.112.1643175395:  gG' ossec11307iVMultiple connection attempts from same sourceNov 18 08:18:54 hosting pure-ftpd: (?@31.57.112.164) [INFO] New connection from 31.57.112.16431.57.112.1643175395X  _' ossec11321iVActive Response. FTP brute force attack (Port 21 is protected)Nov 18 08:18:48 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]31.57.112.16431753954 A_' ossec11302iUFTP Authentication failed.Nov 18 08:18:14 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]31.57.112.1643175395! 3G' ossec11301iU New FTP connection.Nov 18 08:18:10 hosting pure-ftpd: (?@31.57.112.164) [INFO] New connection from 31.57.112.16431.57.112.1643175395u  -w' ossec13001iV+Exim Auth failed2025-11-18 08:19:06 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:3186: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)175.115.29.391835841&  e'% ossec9710iV+Dovecot Auth failed on disconnected session.Nov 18 08:19:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=69.62.65.113, lip=200.150.196.245, session=69.62.65.1135974277  I_' ossec11331iV) Stealth FTP brute force attackNov 18 08:19:04 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]31.57.112.1643175395  S' ossec211321iVPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 31.57.112.16431.57.112.1643175395 W' ossec9708iVDovecot Aborted Login with empty userNov 18 08:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e)) ossec9710iVDovecot Auth failed on disconnected session.Nov 18 08:18:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<4Ro0n9xDvrKYNbyQ>152.53.188.1442921044S  -3' ossec13001iUExim Auth failed2025-11-18 08:17:50 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:33768: 535 Incorrect authentication data (set_id=info)83.239.84.1302017370*  e)) ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:17:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750  - ) ossec13001iUExim Auth failed2025-11-18 08:17:25 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:35444: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)35.130.111.1466252001*  e-% ossec9710iUDovecot Auth failed on disconnected session.Nov 18 08:17:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841 * x n d Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &   ~ t j ` V L B 8 . $    H > z p 4 * f \ R  vlbXND:@0|rh&^J6T,"xndZPF<2 (t~j`V.LB8$pfz\RH>4*    | r h ^ T J @ 6 , "    vlbXND:0& iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iX' iXo' iXc' iXc' iXa' iX[' iX}' iXy' iX' iX='~ iX''} iX%'| iX '{ iX 'z iX'y iW'x iW'w iW'v iW'u iW't iX's iW'r iW'q iW'p iW'o iW'n iW'm iW'l iW'k iW'j iW'i iW'h iW'g iW'f iW'e iW'd iWq'c iWi'b iWi'a iWg'` iWS'_ iW;'^ iW-'] iW7'\ iW5'[ iW''Z iW'Y iWS'X iWM'W iWK'V iW'U iW 'T iV'S iV'R iV'Q iV'P iV'O iV'N iV'M iV'L iV'K iV'J iV'I iV'H iV'G iV'F iV'E iV'D iV'C iV'B iV'A iV'@ iV'? iV'> iV'= iV'< iV'; iV': iV'9 iV'8 iV'7 iV'6 iV'5 iV'4 iV'3 iV'2 iV'1 iV'0 iV'/ iV'. iV'- iV', iVw'+ iV'* iV{') iV9'( iV/'' iV.'& iV_'% iVQ'$ iV='# iV;'" iVg'! iVe' iVS' iVM' iVK' iVE' iV/' iV/' iV' iV' iU' iU' iV+' iV+' iV)' iV' iV' iV' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU' iU& iU& iU{' iUr& iUl& iUl& iUV& iUV& iUP& iUF& iUD& iU8& iU2& iU(& iU& iU& iU& iU& iU & iU& iT& iT& iS6& iS*& iS&& iS& iS& iS& iS& iS & iS& iR& iR& iR& iR& iR& iR& iR& iR& iR& iR& iR& iY' iY' iY' iY' iYo' iYc' iYW' iYU' iYQ' iYO' iYO' iYE' iYA' iY9' iY7' iY3' iY1' iY+' iY)' iY'' iY#' iY' iY' iY' iY' iY' iY' iY' iY ' iY' iY' iX' iX' iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT& iT|& iTx& iTf& iTd& iTN& iTL& iT,& iT(& iT"& iT& iT& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS&d iY' iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS& iS~& iS|& iSv& iSl& iSj& iSf& iS^& iS^& iS8&   ,<'+  e%' ossec9710iVwDovecot Auth failed on disconnected session.Nov 18 08:20:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084l*  -c) ossec13001iVExim Auth failed2025-11-18 08:20:55 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:45510: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)164.164.117.231269750[)  -E% ossec13001iV{Exim Auth failed2025-11-18 08:20:25 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:37712: 535 Incorrect authentication data (set_id=contato)84.211.19.123144096`(  -O' ossec13001iV9Exim Auth failed2025-11-18 08:19:19 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:49846: 535 Incorrect authentication data (set_id=info)46.30.161.197690791o'  -g+ ossec13001iV/Exim Auth failed2025-11-18 08:19:09 dovecot_login authenticator failed for ([122.187.230.141]) [122.187.230.141]:49430: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)122.187.230.1411269750&  S' ossec211321iV.Preventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 31.57.112.16431.57.112.1643175395&%  e%% ossec9710iV_Dovecot Auth failed on disconnected session.Nov 18 08:19:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841_$  -G+ ossec13001iVQExim Auth failed2025-11-18 08:19:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52023: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034*#  e)) ossec9710iV=Dovecot Auth failed on disconnected session.Nov 18 08:19:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3JCtotxDqtKB4rs4>129.226.187.561819730b"  -Q' ossec13001iV;Exim Auth failed2025-11-18 08:19:22 dovecot_login authenticator failed for ([78.111.147.32]) [78.111.147.32]:49398: 535 Incorrect authentication data (set_id=andressa.financeiro)78.111.147.322017370,!  e++ ossec9710iVgDovecot Auth failed on disconnected session.Nov 18 08:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822i  -c# ossec13001iVeExim Auth failed2025-11-18 08:20:04 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:57716: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)182.95.47.21269750-  e-+ ossec9710iVSDovecot Auth failed on disconnected session.Nov 18 08:19:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841Y ;-) ossec13008iVMMail Recipient rejected2025-11-18 08:19:39 H=(localhost) [170.82.133.153]:19111 F= rejected RCPT : Sender verify failed170.82.133.15334690340  e;# ossec9710iVKDovecot Auth failed on disconnected session.Nov 18 08:19:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483   (#eKbti;  -_' ossec13001iVExim Auth failed2025-11-18 08:21:54 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:52476: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.95.115.381269750j:  -_) ossec13001iVExim Auth failed2025-11-18 08:21:17 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:39520: 535 Incorrect authentication data (set_id=adriana)81.233.235.2032661886e9  -Y% ossec13001iVExim Auth failed2025-11-18 08:21:50 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:60927: 535 Incorrect authentication data (set_id=financeiro)111.70.32.1016682848 W' ossec9708iVDovecot Aborted Login with empty userNov 18 08:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034:7  gG' ossec11307iVMultiple connection attempts from same sourceNov 18 08:21:23 hosting pure-ftpd: (?@138.68.104.64) [INFO] New connection from 138.68.104.64138.68.104.642921044g6  -Y) ossec13001iVExim Auth failed2025-11-18 08:21:16 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:45414: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)192.34.128.20262520015  e' ossec9710iVDovecot Auth failed on disconnected session.Nov 18 08:22:05 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=61.136.142.13, lip=200.150.196.245, session=61.136.142.131814991`4  -M' ossec13001iVExim Auth failed2025-11-18 08:21:45 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58143: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730u3  -y' ossec13001iVExim Auth failed2025-11-18 08:21:32 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:37858: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)95.158.39.201690791^2  -G) ossec13001iVExim Auth failed2025-11-18 08:21:21 dovecot_login authenticator failed for ([124.197.22.130]) [124.197.22.130]:46116: 535 Incorrect authentication data (set_id=sandromiguel)124.197.22.13015628221  W' ossec9708iVDovecot Aborted Login with empty userNov 18 08:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m0  -c+ ossec13001iVExim Auth failed2025-11-18 08:20:54 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:37742: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)190.238.101.2093932488/  -' ossec13001iVExim Auth failed2025-11-18 08:20:47 dovecot_login authenticator failed for (ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:55388: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)45.155.146.332017370].  -E) ossec13001iVExim Auth failed2025-11-18 08:20:43 dovecot_login authenticator failed for ([176.118.17.101]) [176.118.17.101]:46482: 535 Incorrect authentication data (set_id=vendas.luiz)176.118.17.1012017370-  k' ossec9709iVMultiple Dovecot Aborted Logins with empty userNov 18 08:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,  -% ossec13001iVExim Auth failed2025-11-18 08:20:29 dovecot_login authenticator failed for 20.red-88-28-219.staticip.rima-tde.net [88.28.219.20]:33094: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)88.28.219.202510769   % .LcpK  -) ossec13001iVExim Auth failed2025-11-18 08:21:45 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:49380: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)90.160.139.1632510769^J -E) ossec13001iVExim Auth failed2025-11-18 08:21:11 dovecot_login authenticator failed for (User) [177.74.174.120]:63840: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)177.74.174.1203469034}I  -' ossec13001iVExim Auth failed2025-11-18 08:21:41 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:50748: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)108.30.14.2216252001TH  -3) ossec13001iVExim Auth failed2025-11-18 08:22:00 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:33470: 535 Incorrect authentication data (set_id=adm)125.19.194.1661269750oG  -o% ossec13001iVExim Auth failed2025-11-18 08:21:35 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:57191: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)95.87.213.16732800eF  -W' ossec13001iVExim Auth failed2025-11-18 08:21:31 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:48530: 535 Incorrect authentication data (set_id=eliezer)173.17.163.446252001^E  -I' ossec13001iVExim Auth failed2025-11-18 08:21:27 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:47664: 535 Incorrect authentication data (set_id=administrativo1)83.136.176.122510769bD  -S% ossec13001iVExim Auth failed2025-11-18 08:21:25 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:46768: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)115.77.111.21562822YC  -;+ ossec13001iVExim Auth failed2025-11-18 08:21:12 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:35480: 535 Incorrect authentication data (set_id=info)154.144.255.2092542007B  -) ossec13001iVExim Auth failed2025-11-18 08:21:22 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:36189: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)186.97.203.1653686110&A  e#' ossec9710iVDovecot Auth failed on disconnected session.Nov 18 08:21:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841!@ 3G' ossec11301iV New FTP connection.Nov 18 08:21:18 hosting pure-ftpd: (?@138.68.104.64) [INFO] New connection from 138.68.104.64138.68.104.642921044y?  -}) ossec13001iVExim Auth failed2025-11-18 08:22:04 dovecot_login authenticator failed for ([183.245.232.31]) [183.245.232.31]:37712: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)183.245.232.3118149917>  eA+ ossec9710iVDovecot Auth failed on disconnected session.Nov 18 08:21:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.187.229.194, lip=200.150.196.245, TLS, session=122.187.229.1941269750=  -) ossec13001iVExim Auth failed2025-11-18 08:21:17 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:41542: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)43.245.186.1211643084p<  -q# ossec13001iVExim Auth failed2025-11-18 08:21:55 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:49764: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)50.4.40.2476252001 / < " = ] ~hy[  k' ossec9709iW5Multiple Dovecot Aborted Logins with empty userNov 18 08:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_Z  -G+ ossec13001iW'Exim Auth failed2025-11-18 08:23:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52037: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1413469034]Y  -G) ossec13001iWExim Auth failed2025-11-18 08:23:08 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:42664: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549X  W' ossec9708iWSDovecot Aborted Login with empty userNov 18 08:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YW  -=) ossec13001iWMExim Auth failed2025-11-18 08:23:56 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:50384: 535 Incorrect authentication data (set_id=contato)111.26.177.2161814991TV  -7% ossec13001iWKExim Auth failed2025-11-18 08:23:54 dovecot_login authenticator failed for ([61.79.227.51]) [61.79.227.51]:39944: 535 Incorrect authentication data (set_id=eleicoes)61.79.227.511835841^U  -K% ossec13001iWExim Auth failed2025-11-18 08:22:53 dovecot_login authenticator failed for (89.20.106.40.permonline.ru) [89.20.106.40]:36838: 535 Incorrect authentication data (set_id=rafael)89.20.106.402017370kT  -a) ossec13001iW Exim Auth failed2025-11-18 08:22:48 dovecot_login authenticator failed for (125.234.135.54.hcm.viettel.vn) [125.234.135.54]:43742: 535 Incorrect authentication data (set_id=atualizacoes)125.234.135.541562822S  e ossec9710iVDovecot Auth failed on disconnected session.Nov 18 08:22:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=5.32.61.6, lip=200.150.196.245, TLS, session=<42uSrNxDN4QFID0G>5.32.61.6290557[R  -A+ ossec13001iVExim Auth failed2025-11-18 08:22:20 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:39526: 535 Incorrect authentication data (set_id=eliezer)196.189.124.229337996\Q  -A+ ossec13001iVExim Auth failed2025-11-18 08:22:08 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:35485: 535 Incorrect authentication data (set_id=contato)194.179.135.1742661886aP  -K+ ossec13001iVExim Auth failed2025-11-18 08:22:34 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:38309: 535 Incorrect authentication data (set_id=atualizacoes)211.198.128.1241835841O W' ossec9708iVDovecot Aborted Login with empty userNov 18 08:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oN  -g+ ossec13001iVExim Auth failed2025-11-18 08:22:30 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35518: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)197.219.228.2421036973`M  -K) ossec13001iVExim Auth failed2025-11-18 08:22:17 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:53276: 535 Incorrect authentication data (set_id=isabellylisboa)217.195.94.2432017370iL  -[+ ossec13001iVExim Auth failed2025-11-18 08:22:08 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:59727: 535 Incorrect authentication data (set_id=financeiro)150.249.252.2371861060  o9)i  e') ossec9710iWDovecot Auth failed on disconnected session.Nov 18 08:25:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750Eh  -' ossec13001iWExim Auth failed2025-11-18 08:25:38 dovecot_login authenticator failed for ([115.94.121.82]) [115.94.121.82]:50809: 535 Incorrect authentication data115.94.121.821835841}g  -' ossec13001iWExim Auth failed2025-11-18 08:26:02 dovecot_login authenticator failed for ppp85-141-77-192.pppoe.mtu-net.ru [85.141.77.192]:44086: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)85.141.77.19220173700f  e3+ ossec9710iWDovecot Auth failed on disconnected session.Nov 18 08:26:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822se  -o+ ossec13001iWExim Auth failed2025-11-18 08:25:03 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:54215: 535 Incorrect authentication data (set_id=rebecakessler@prafebrum.com.br)121.168.116.1501835841)d  e%+ ossec9710iWDovecot Auth failed on disconnected session.Nov 18 08:25:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841c W' ossec9708iWqDovecot Aborted Login with empty userNov 18 08:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342b  e;' ossec9710iWiDovecot Auth failed on disconnected session.Nov 18 08:24:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822*a  e)) ossec9710iWiDovecot Auth failed on disconnected session.Nov 18 08:24:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730$`  e!' ossec9710iWgDovecot Auth failed on disconnected session.Nov 18 08:24:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<6kJ7tNxD6Ig+PIOL>62.60.131.139130758*_ U7' ossec11001iWSDeferred login on the cpanel service[2025-11-18 08:24:02 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034e^  -W' ossec13001iW;Exim Auth failed2025-11-18 08:23:37 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:50888: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)60.166.31.1981814991,]  e++ ossec9710iW-Dovecot Auth failed on disconnected session.Nov 18 08:23:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822p\  -i+ ossec13001iW7Exim Auth failed2025-11-18 08:23:34 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:53827: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)222.108.177.1101835841 v vir=%8]vcx  -W' ossec13001iWExim Auth failed2025-11-18 08:26:13 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:42494: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)65.20.171.11699237Ww  -?# ossec13001iWExim Auth failed2025-11-18 08:26:24 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:57987: 535 Incorrect authentication data (set_id=financeiro)187.8.17.383469034iv  -]) ossec13001iWExim Auth failed2025-11-18 08:26:15 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:45088: 535 Incorrect authentication data (set_id=atualizacoes)192.46.237.1332921044gu  -[' ossec13001iWExim Auth failed2025-11-18 08:26:14 dovecot_login authenticator failed for ([95.105.52.153]) [95.105.52.153]:53394: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)95.105.52.1532017370)t  e-# ossec9710iWDovecot Auth failed on disconnected session.Nov 18 08:26:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.9962520011s  e;% ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:26:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0OHNvdxD6pJvAEul>111.0.75.1651814991sr  -s' ossec13001iWExim Auth failed2025-11-18 08:26:36 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:35253: 535 Incorrect authentication data (set_id=aureovieira)177.27.76.2103469034q  k' ossec9709iWMultiple Dovecot Aborted Logins with empty userNov 18 08:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034fp  -Y' ossec13001iWExim Auth failed2025-11-18 08:26:30 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:40568: 535 Incorrect authentication data (set_id=rene)123.194.136.316682845o e=) ossec9710iWDovecot Auth failed on disconnected session.Nov 18 08:25:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044n W' ossec9708iWDovecot Aborted Login with empty userNov 18 08:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340m  e3+ ossec9710iWDovecot Auth failed on disconnected session.Nov 18 08:26:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822ll  -c) ossec13001iWExim Auth failed2025-11-18 08:25:45 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:35076: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)128.185.242.741269750k  -' ossec13001iWExim Auth failed2025-11-18 08:25:43 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (unkeed) [174.59.253.88]:52528: 535 Incorrect authentication data (set_id=inovasite.com@inovasite.com)174.59.253.886252001j  -' ossec13001iWExim Auth failed2025-11-18 08:25:39 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (blingra) [24.91.103.202]:49560: 535 Incorrect authentication data (set_id=inovasite.com@inovasite.com)24.91.103.2026252001  o Dc,0  - ) ossec13001iXoExim Auth failed2025-11-18 08:28:46 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:54506: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)24.233.210.1886252001,  e++ ossec9710iXcDovecot Auth failed on disconnected session.Nov 18 08:28:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841)  e%+ ossec9710iXcDovecot Auth failed on disconnected session.Nov 18 08:28:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001 W' ossec9708iXaDovecot Aborted Login with empty userNov 18 08:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e'' ossec9710iX[Dovecot Auth failed on disconnected session.Nov 18 08:28:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084x  -}' ossec13001iX}Exim Auth failed2025-11-18 08:29:01 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (synasts) [87.103.126.54]:31752: 535 Incorrect authentication data (set_id=admin@inovasite.com)87.103.126.5422643973  e?% ossec9710iXyDovecot Auth failed on disconnected session.Nov 18 08:28:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001]  -G' ossec13001iXExim Auth failed2025-11-18 08:27:25 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:38407: 535 Incorrect authentication data (set_id=isabellylisboa)117.6.226.1221562822'~ e'% ossec9710iX=Dovecot Auth failed on disconnected session.Nov 18 08:27:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.332721030}  e5) ossec9710iX'Dovecot Auth failed on disconnected session.Nov 18 08:27:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044| W' ossec9708iX%Dovecot Aborted Login with empty userNov 18 08:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034){  e') ossec9710iX Dovecot Auth failed on disconnected session.Nov 18 08:27:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=157.230.24.2072921044yz  -}) ossec13001iX Exim Auth failed2025-11-18 08:27:04 dovecot_login authenticator failed for ([197.251.249.72]) [197.251.249.72]:40331: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)197.251.249.722300660y  W' ossec9708iXDovecot Aborted Login with empty userNov 18 08:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 m  k{X[mj  -]+ ossec13001iXExim Auth failed2025-11-18 08:30:21 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:51603: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)190.143.133.1263595528y  -# ossec13001iXExim Auth failed2025-11-18 08:30:52 dovecot_login authenticator failed for ppp005055099226.access.hol.gr [5.55.99.226]:43616: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)5.55.99.226390903  k' ossec9709iXMultiple Dovecot Aborted Logins with empty userNov 18 08:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$  e## ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:29:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483  W' ossec9708iXDovecot Aborted Login with empty userNov 18 08:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6LbkyNxDKJixV3kv>177.87.121.473469034  -' ossec13001iXExim Auth failed2025-11-18 08:29:44 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:47602: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)200.89.159.593865483g  -[' ossec13001iXExim Auth failed2025-11-18 08:29:26 dovecot_login authenticator failed for (93.102.226.83.rev.optimus.pt) [93.102.226.83]:51677: 535 Incorrect authentication data (set_id=atendimento)93.102.226.832264397[ ;3' ossec13008iXMail Recipient rejected2025-11-18 08:29:19 H=(localhost) [186.235.124.8]:44407 F= rejected RCPT : Sender verify failed186.235.124.83469034[  -E% ossec13001iXExim Auth failed2025-11-18 08:29:54 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:34708: 535 Incorrect authentication data (set_id=administrativo1)187.12.48.703469034,  e++ ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:29:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.20562520011  e5+ ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:29:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822.  e3' ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:30:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001[  -C' ossec13001iXExim Auth failed2025-11-18 08:29:53 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:36962: 535 Incorrect authentication data (set_id=atendimento)122.187.59.261269750+  e++ ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:29:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758l  -g% ossec13001iXExim Auth failed2025-11-18 08:29:52 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:39738: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)160.25.58.191643084   =`xe%  -[# ossec13001iY)Exim Auth failed2025-11-18 08:31:52 dovecot_login authenticator failed for 81.5.83.207.dhcp.mipt-telecom.ru [81.5.83.207]:31934: 535 Incorrect authentication data (set_id=vendas.luiz)81.5.83.2072017370v$  -y' ossec13001iY'Exim Auth failed2025-11-18 08:31:50 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:59763: 535 Incorrect authentication data (set_id=marcelo.pinheiro)88.11.230.1602510769r#  -o) ossec13001iYExim Auth failed2025-11-18 08:31:41 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:34632: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)223.166.87.1451814991o"  -o# ossec13001iYExim Auth failed2025-11-18 08:31:38 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:52152: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)187.8.64.943469034d!  -W% ossec13001iYExim Auth failed2025-11-18 08:31:18 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:36825: 535 Incorrect authentication data (set_id=eliezer)91.126.40.542510769Y  -C% ossec13001iXExim Auth failed2025-11-18 08:30:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:52550: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758\  -C) ossec13001iXExim Auth failed2025-11-18 08:30:30 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:55628: 535 Incorrect authentication data (set_id=financeiro)216.194.174.276252001h  -]' ossec13001iXExim Auth failed2025-11-18 08:30:12 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:37627: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)168.92.115.736252001W  -?# ossec13001iXExim Auth failed2025-11-18 08:30:57 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:57044: 535 Incorrect authentication data (set_id=alex.vendas)182.95.47.21269750d  -Q+ ossec13001iXExim Auth failed2025-11-18 08:30:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51970: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034)  e+' ossec9710iXDovecot Auth failed on disconnected session.Nov 18 08:30:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758r  -q' ossec13001iXExim Auth failed2025-11-18 08:31:05 dovecot_login authenticator failed for (host91-146-28-230.etth.mark-itt.net) [91.146.28.230]:60000: 535 Incorrect authentication data (set_id=paulinho.vendas)91.146.28.2302017370  Sw) ossec11000iXLogin failed on the cpanel service.[2025-11-18 08:30:55 -0300] info [cpaneld] 185.230.138.34 - lixadora "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadora (has_cpuser_file failed)185.230.138.343017382]  -E) ossec13001iXExim Auth failed2025-11-18 08:30:38 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:39690: 535 Incorrect authentication data (set_id=atendimento)121.73.169.1492186224 W' ossec9708iXDovecot Aborted Login with empty userNov 18 08:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001iXExim Auth failed2025-11-18 08:30:42 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:59302: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)77.37.162.1172017370 8 ] 2 4  k' ossec9709iYQMultiple Dovecot Aborted Logins with empty userNov 18 08:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e3  -W' ossec13001iYOExim Auth failed2025-11-18 08:32:31 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:42482: 535 Incorrect authentication data (set_id=contato)189.218.82.493996063-2 e/' ossec9710iYODovecot Auth failed on disconnected session.Nov 18 08:32:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730 1  3G' ossec11301iYNew FTP connection.Nov 18 08:31:39 hosting pure-ftpd: (?@39.41.232.228) [INFO] New connection from 39.41.232.22839.41.232.22811685790  -) ossec13001iY Exim Auth failed2025-11-18 08:31:21 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:50383: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)116.48.151.1361819730)/  e%+ ossec9710iY7Dovecot Auth failed on disconnected session.Nov 18 08:32:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<8Jwv0NxDWENo7MS0>104.236.196.1806252001*.  e+' ossec9710iY+Dovecot Auth failed on disconnected session.Nov 18 08:31:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149913-  A_' ossec11302iYFTP Authentication failed.Nov 18 08:31:43 hosting pure-ftpd: (?@39.41.232.228) [WARNING] Authentication failed for user [anonymous]39.41.232.2281168579, W' ossec9708iYDovecot Aborted Login with empty userNov 18 08:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'+  e%' ossec9710iYDovecot Auth failed on disconnected session.Nov 18 08:31:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001.*  e3' ossec9710iY1Dovecot Auth failed on disconnected session.Nov 18 08:32:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991')  e%' ossec9710iY#Dovecot Auth failed on disconnected session.Nov 18 08:31:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822W(  -=% ossec13001iYExim Auth failed2025-11-18 08:31:41 dovecot_login authenticator failed for (sindeesfort.com.br) [60.2.243.174]:52280: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991Y'  -=) ossec13001iYExim Auth failed2025-11-18 08:31:31 dovecot_login authenticator failed for ([188.247.63.174]) [188.247.63.174]:52876: 535 Incorrect authentication data (set_id=adriana)188.247.63.1742017370g&  -Y) ossec13001iY3Exim Auth failed2025-11-18 08:32:03 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:43294: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)220.180.204.321814991  Q7$B  e!% ossec9710iYDovecot Auth failed on disconnected session.Nov 18 08:34:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370tA  -u' ossec13001iYExim Auth failed2025-11-18 08:33:57 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:36838: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)213.41.173.773017382@  -5+ ossec13001iYExim Auth failed2025-11-18 08:33:47 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:39792: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)122.170.105.21912697504?  e?' ossec9710iYDovecot Auth failed on disconnected session.Nov 18 08:33:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084,>  e-) ossec9710iYDovecot Auth failed on disconnected session.Nov 18 08:33:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001= W' ossec9708iYDovecot Aborted Login with empty userNov 18 08:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,<  e-) ossec9710iYDovecot Auth failed on disconnected session.Nov 18 08:33:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387.;  e1) ossec9710iY9Dovecot Auth failed on disconnected session.Nov 18 08:32:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841:  - ) ossec13001iYWExim Auth failed2025-11-18 08:32:39 dovecot_login authenticator failed for pool-108-51-205-170.washdc.fios.verizon.net [108.51.205.170]:42924: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)108.51.205.1706252001*9  e-% ossec9710iYUDovecot Auth failed on disconnected session.Nov 18 08:32:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841h8  -_% ossec13001iYEExim Auth failed2025-11-18 08:32:21 dovecot_login authenticator failed for (sindeesfort.com.br) [60.2.243.174]:53418: 535 Incorrect authentication data (set_id=admin@sindeesfort.com.br)60.2.243.1741814991(7  e)% ossec9710iYADovecot Auth failed on disconnected session.Nov 18 08:32:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.16518149916  W' ossec9708iYoDovecot Aborted Login with empty userNov 18 08:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f5  -]# ossec13001iYcExim Auth failed2025-11-18 08:32:50 dovecot_login authenticator failed for host87-250-9-098.etth.mark-itt.net [87.250.9.98]:41716: 535 Incorrect authentication data (set_id=marialuiza)87.250.9.982017370 9 Y 1 jkRX&3P  e9+ ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001.O  e5% ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<8S013NxDWtJ3xBIC>119.196.18.21835841vN  -y' ossec13001iYExim Auth failed2025-11-18 08:35:27 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:59720: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)36.135.100.481814991M  W' ossec9708iZ$Dovecot Aborted Login with empty userNov 18 08:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{L  -' ossec13001iZ Exim Auth failed2025-11-18 08:35:40 dovecot_login authenticator failed for (h17.83.184.173.dynamic.ip.windstream.net) [173.184.83.17]:34298: 535 Incorrect authentication data (set_id=andressa.financeiro)173.184.83.176252001%K  e%# ossec9710iZ Dovecot Auth failed on disconnected session.Nov 18 08:35:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<5RDA3NxDaOVCYSpH>66.97.42.713865483J  k' ossec9709iZMultiple Dovecot Aborted Logins with empty userNov 18 08:35:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034I W' ossec9708iYDovecot Aborted Login with empty userNov 18 08:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034H  -) ossec13001iYExim Auth failed2025-11-18 08:34:32 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:53141: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)61.245.141.2252077456RG  ;%% ossec13008iYMail Recipient rejected2025-11-18 08:34:17 H=(195.3.134.135) [179.0.178.53]:65184 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:65184 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034$F  e' ossec9710iYDovecot Auth failed on disconnected session.Nov 18 08:34:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991\E  -C) ossec13001iYExim Auth failed2025-11-18 08:34:11 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:49262: 535 Incorrect authentication data (set_id=vendas.luiz)125.19.253.1541269750XD  -;) ossec13001iYExim Auth failed2025-11-18 08:34:44 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:55756: 535 Incorrect authentication data (set_id=xavier)92.126.223.1752017370gC  -Y) ossec13001iYExim Auth failed2025-11-18 08:34:19 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:57180: 535 Incorrect authentication data (set_id=vendas3)45.136.194.1202510769   ` / > =#+=*.Q7 (^  e%) ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:39:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=138.197.125.556252001] W' ossec9708iZ~Dovecot Aborted Login with empty userNov 18 08:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y\  -A% ossec13001iZxExim Auth failed2025-11-18 08:37:27 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:54542: 535 Incorrect authentication data (set_id=atualizacoes1)77.41.156.642017370x[  -{) ossec13001iZExim Auth failed2025-11-18 08:38:06 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:39246: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)85.247.230.1322264397Z  -+' ossec13001iZExim Auth failed2025-11-18 08:37:49 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (rialiblury) [73.53.254.168]:39560: 535 Incorrect authentication data (set_id=design.user.finance@inovasite.com)73.53.254.1686252001jY  -a' ossec13001iZExim Auth failed2025-11-18 08:37:46 dovecot_plain authenticator failed for (prompaist) [76.190.155.43]:42886: 535 Incorrect authentication data (set_id=design.user.finance@inovasite.com)76.190.155.436252001tX  -u' ossec13001iZHExim Auth failed2025-11-18 08:36:38 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:33710: 535 Incorrect authentication data (set_id=andressa.financeiro)98.220.97.1886252001W W' ossec9708iZBDovecot Aborted Login with empty userNov 18 08:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}V  - % ossec13001iZ:Exim Auth failed2025-11-18 08:36:25 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:43698: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)103.90.27.831643084mU  -e) ossec13001iZ\Exim Auth failed2025-11-18 08:36:58 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:38784: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)122.184.127.861269750-T  e/) ossec9710iZDDovecot Auth failed on disconnected session.Nov 18 08:36:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750.S  e/+ ossec9710iZDDovecot Auth failed on disconnected session.Nov 18 08:36:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.18562520016R  eA) ossec9710iZ<Dovecot Auth failed on disconnected session.Nov 18 08:36:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.12212697500Q  e3+ ossec9710iZHDovecot Auth failed on disconnected session.Nov 18 08:36:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001  xvb/XYhWm  -9) ossec13001i[0Exim Auth failed2025-11-18 08:40:31 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:47124: 535 Incorrect authentication data (set_id=contato)152.52.236.1221269750ml  -g) ossec13001i[Exim Auth failed2025-11-18 08:40:05 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:41266: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)196.191.142.67337996{k  -) ossec13001i[Exim Auth failed2025-11-18 08:40:02 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:32842: 535 Incorrect authentication data (set_id=envios@comercial.art.br)24.105.160.1006252001Sj  -5% ossec13001i[ Exim Auth failed2025-11-18 08:39:54 dovecot_login authenticator failed for ([45.148.10.39]) [45.148.10.39]:65467: 535 Incorrect authentication data (set_id=default)45.148.10.392750405/i  e5' ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:39:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001$h  e## ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:39:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001hg  -]' ossec13001i[Exim Auth failed2025-11-18 08:40:05 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:50798: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)218.78.112.811814991f W' ossec9708iZDovecot Aborted Login with empty userNov 18 08:39:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034de  -U' ossec13001iZExim Auth failed2025-11-18 08:39:15 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:62190: 535 Incorrect authentication data (set_id=contato)202.82.20.2411819730d  W' ossec9708iZDovecot Aborted Login with empty userNov 18 08:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  -' ossec13001iZExim Auth failed2025-11-18 08:38:53 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:58718: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)58.169.37.16320774561b  e;% ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:38:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001da  -U' ossec13001iZExim Auth failed2025-11-18 08:38:41 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:38748: 535 Incorrect authentication data (set_id=xavier)111.70.23.2461668284`  k' ossec9709iZMultiple Dovecot Aborted Logins with empty userNov 18 08:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#_  e+ ossec9710iZDovecot Auth failed on disconnected session.Nov 18 08:38:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758 -7 a ` ^ KoU}qX}  -?% ossec13001i[pExim Auth failed2025-11-18 08:41:34 dovecot_login authenticator failed for ([45.148.10.34]) [45.148.10.34]:61726: 535 Incorrect authentication data (set_id=distribution)45.148.10.342750405|  k' ossec9709i[nMultiple Dovecot Aborted Logins with empty userNov 18 08:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{  W' ossec9708i[Dovecot Aborted Login with empty userNov 18 08:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034xz  -y+ ossec13001i[.Exim Auth failed2025-11-18 08:40:29 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:50374: 535 Incorrect authentication data (set_id=kgl@kglsolucoes.com)223.197.153.1381819730Py  -/% ossec13001i[$Exim Auth failed2025-11-18 08:40:19 dovecot_login authenticator failed for ([45.148.10.26]) [45.148.10.26]:52141: 535 Incorrect authentication data (set_id=1111)45.148.10.262750405Tx  -7% ossec13001i["Exim Auth failed2025-11-18 08:40:18 dovecot_login authenticator failed for ([45.148.10.25]) [45.148.10.25]:65465: 535 Incorrect authentication data (set_id=intranet)45.148.10.252750405w W' ossec9708i[0Dovecot Aborted Login with empty userNov 18 08:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Xv  -;) ossec13001i[ Exim Auth failed2025-11-18 08:40:16 dovecot_login authenticator failed for ([175.125.68.208]) [175.125.68.208]:46687: 535 Incorrect authentication data (set_id=envios)175.125.68.20818358412u  e;' ossec9710i[:Dovecot Auth failed on disconnected session.Nov 18 08:40:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001Yt  -A% ossec13001i[4Exim Auth failed2025-11-18 08:40:36 dovecot_login authenticator failed for ([45.148.10.29]) [45.148.10.29]:51846: 535 Incorrect authentication data (set_id=administrator)45.148.10.292750405(s  e%) ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:40:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822Rr  -1' ossec13001i[PExim Auth failed2025-11-18 08:41:02 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:35414: 535 Incorrect authentication data (set_id=kgl)152.89.135.302017370}q  -' ossec13001i[NExim Auth failed2025-11-18 08:41:00 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (anthionpil) [68.193.149.88]:45476: 535 Incorrect authentication data (set_id=design@inovasite.com)68.193.149.886252001Rp  -3% ossec13001i[NExim Auth failed2025-11-18 08:41:01 dovecot_login authenticator failed for ([45.148.10.31]) [45.148.10.31]:52286: 535 Incorrect authentication data (set_id=daniel)45.148.10.312750405ro  -q' ossec13001i[JExim Auth failed2025-11-18 08:40:57 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:33175: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)103.148.92.471168579On  --% ossec13001i[JExim Auth failed2025-11-18 08:40:57 dovecot_login authenticator failed for ([45.148.10.30]) [45.148.10.30]:59590: 535 Incorrect authentication data (set_id=bob)45.148.10.302750405  w N v [pz  -' ossec13001i[Exim Auth failed2025-11-18 08:43:21 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:54220: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)89.179.78.2472017370 W' ossec9708i[Dovecot Aborted Login with empty userNov 18 08:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  -m) ossec13001i[Exim Auth failed2025-11-18 08:42:33 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:50837: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)190.110.36.1273508796/  e3) ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:42:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730S  -5% ossec13001i[Exim Auth failed2025-11-18 08:42:14 dovecot_login authenticator failed for ([45.148.10.35]) [45.148.10.35]:51237: 535 Incorrect authentication data (set_id=kitchen)45.148.10.352750405S  -5% ossec13001i[Exim Auth failed2025-11-18 08:42:09 dovecot_login authenticator failed for ([45.148.10.36]) [45.148.10.36]:63503: 535 Incorrect authentication data (set_id=mailing)45.148.10.362750405Z  -A' ossec13001i[Exim Auth failed2025-11-18 08:42:52 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:34274: 535 Incorrect authentication data (set_id=venesselume)182.95.52.2061269750g  -[' ossec13001i[Exim Auth failed2025-11-18 08:42:33 dovecot_plain authenticator failed for (provellims) [12.150.243.22]:16204: 535 Incorrect authentication data (set_id=design.user.ceo@inovasite.com)12.150.243.226252001)  e') ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044j  -_) ossec13001i[Exim Auth failed2025-11-18 08:42:27 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:59022: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)209.66.120.2376252001T  -7% ossec13001i[Exim Auth failed2025-11-18 08:42:18 dovecot_login authenticator failed for ([45.148.10.37]) [45.148.10.37]:59135: 535 Incorrect authentication data (set_id=scanuser)45.148.10.372750405%  e#% ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:43:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060/  e3+ ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:43:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758.  e1) ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:41:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387 ~  e# ossec9710i[~Dovecot Auth failed on disconnected session.Nov 18 08:41:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750 k u o z"9Yk  W' ossec9708i\>Dovecot Aborted Login with empty userNov 18 08:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3HWE/txD1pKxV3kv>177.87.121.473469034Q  -1% ossec13001i\2Exim Auth failed2025-11-18 08:44:50 dovecot_login authenticator failed for ([45.148.10.98]) [45.148.10.98]:50005: 535 Incorrect authentication data (set_id=alpha)45.148.10.982750405\  -I% ossec13001i\Exim Auth failed2025-11-18 08:44:26 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56783: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758e -Q+ ossec13001i\ Exim Auth failed2025-11-18 08:44:09 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56315: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651S  -3' ossec13001i\ Exim Auth failed2025-11-18 08:44:10 dovecot_login authenticator failed for ([45.148.10.124]) [45.148.10.124]:63232: 535 Incorrect authentication data (set_id=lucy)45.148.10.1242750405R  -3% ossec13001i\Exim Auth failed2025-11-18 08:44:07 dovecot_login authenticator failed for ([45.148.10.64]) [45.148.10.64]:54518: 535 Incorrect authentication data (set_id=nicole)45.148.10.642750405V  -9' ossec13001i\BExim Auth failed2025-11-18 08:45:06 dovecot_login authenticator failed for ([45.148.10.118]) [45.148.10.118]:53617: 535 Incorrect authentication data (set_id=advokat)45.148.10.1182750405S  -5% ossec13001i\4Exim Auth failed2025-11-18 08:44:51 dovecot_login authenticator failed for ([45.148.10.97]) [45.148.10.97]:50608: 535 Incorrect authentication data (set_id=wangkun)45.148.10.972750405  k' ossec9709i\ Multiple Dovecot Aborted Logins with empty userNov 18 08:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1Ya7/NxDdomxV3kv>177.87.121.473469034S  -3' ossec13001i[Exim Auth failed2025-11-18 08:43:52 dovecot_login authenticator failed for ([45.148.10.122]) [45.148.10.122]:61333: 535 Incorrect authentication data (set_id=iris)45.148.10.1222750405q  -o' ossec13001i[Exim Auth failed2025-11-18 08:43:38 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:40256: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)77.206.93.1073017382(  e'' ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:43:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822V  -9' ossec13001i[Exim Auth failed2025-11-18 08:43:52 dovecot_login authenticator failed for ([45.148.10.120]) [45.148.10.120]:62405: 535 Incorrect authentication data (set_id=dovecot)45.148.10.12027504054  e;+ ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:43:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822 W' ossec9708i[Dovecot Aborted Login with empty userNov 18 08:43:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345  eA' ossec9710i[Dovecot Auth failed on disconnected session.Nov 18 08:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651 d+W j 3Li~|d(,  e+# ossec9710i\Dovecot Auth failed on disconnected session.Nov 18 08:46:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750n+  -g) ossec13001i\Exim Auth failed2025-11-18 08:46:40 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:60958: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)209.66.120.2376252001* W' ossec9708i\Dovecot Aborted Login with empty userNov 18 08:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\)  -A+ ossec13001i\Exim Auth failed2025-11-18 08:46:59 dovecot_login authenticator failed for ([223.166.105.105]) [223.166.105.105]:42450: 535 Incorrect authentication data (set_id=contato)223.166.105.1051814991$(  e) ossec9710i\Dovecot Auth failed on disconnected session.Nov 18 08:46:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841V'  -;% ossec13001i\Exim Auth failed2025-11-18 08:46:21 dovecot_login authenticator failed for ([45.148.10.81]) [45.148.10.81]:60664: 535 Incorrect authentication data (set_id=consultant)45.148.10.812750405g&  -W+ ossec13001i\`Exim Auth failed2025-11-18 08:45:35 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:33474: 535 Incorrect authentication data (set_id=envios)121.202.146.1441819730_%  -G+ ossec13001i\PExim Auth failed2025-11-18 08:45:19 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51875: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034c$  -U% ossec13001i\PExim Auth failed2025-11-18 08:45:20 dovecot_login authenticator failed for ([111.26.62.45]) [111.26.62.46]:56202: 535 Incorrect authentication data (set_id=envios@comercial.art.br)111.26.62.4618149913#  e?% ossec9710i\JDovecot Auth failed on disconnected session.Nov 18 08:45:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=51.77.141.293017382("  e'' ossec9710i\rDovecot Auth failed on disconnected session.Nov 18 08:45:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001! W' ossec9708i\^Dovecot Aborted Login with empty userNov 18 08:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0UdVAN1DDKOxV3kv>177.87.121.473469034P  -/% ossec13001i\XExim Auth failed2025-11-18 08:45:28 dovecot_login authenticator failed for ([45.148.10.44]) [45.148.10.44]:56637: 535 Incorrect authentication data (set_id=bill)45.148.10.442750405O  --% ossec13001i\PExim Auth failed2025-11-18 08:45:19 dovecot_login authenticator failed for ([45.148.10.69]) [45.148.10.69]:56359: 535 Incorrect authentication data (set_id=cam)45.148.10.692750405P  -/% ossec13001i\Exim Auth failed2025-11-18 08:44:08 dovecot_login authenticator failed for ([45.148.10.87]) [45.148.10.87]:57210: 535 Incorrect authentication data (set_id=smtp)45.148.10.872750405Q  -/' ossec13001i\DExim Auth failed2025-11-18 08:45:07 dovecot_login authenticator failed for ([45.148.10.119]) [45.148.10.119]:56207: 535 Incorrect authentication data (set_id=zy)45.148.10.1192750405     * ?miq@ o;  -i) ossec13001i]Exim Auth failed2025-11-18 08:48:24 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:43896: 535 Incorrect authentication data (set_id=paulinho.vendas)136.53.199.16062520013:  e;) ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:48:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<2mE/Ct1DKtql0xnK>165.211.25.202223338739  e=' ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:48:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991-8  e1' ossec9710i\Dovecot Auth failed on disconnected session.Nov 18 08:48:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867t7  -s) ossec13001i\Exim Auth failed2025-11-18 08:48:14 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:36924: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)122.184.120.9812697506  W' ossec9708i\Dovecot Aborted Login with empty userNov 18 08:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g5  -a# ossec13001i\Exim Auth failed2025-11-18 08:47:38 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:38739: 535 Incorrect authentication data (set_id=marcelo.pinheiro)31.41.84.98798544N4  --# ossec13001i\Exim Auth failed2025-11-18 08:47:22 dovecot_login authenticator failed for ([62.79.146.1]) [62.79.146.1]:40142: 535 Incorrect authentication data (set_id=lucas)62.79.146.12623032g3  -]% ossec13001i\Exim Auth failed2025-11-18 08:47:09 dovecot_login authenticator failed for ([111.26.63.85]) [111.26.63.85]:55980: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)111.26.63.851814991q2  -m) ossec13001i\Exim Auth failed2025-11-18 08:47:57 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:51281: 535 Incorrect authentication data (set_id=vendas.luiz)67.241.128.1976252001T1  -5' ossec13001i\Exim Auth failed2025-11-18 08:47:39 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:54214: 535 Incorrect authentication data (set_id=lucas)222.104.76.9418358410  k' ossec9709i\Multiple Dovecot Aborted Logins with empty userNov 18 08:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u/  -u) ossec13001i\Exim Auth failed2025-11-18 08:47:09 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:42970: 535 Incorrect authentication data (set_id=postmaster@hosting.inovasite.com.br)173.245.250.166252001s.  -q) ossec13001i\Exim Auth failed2025-11-18 08:47:03 dovecot_login authenticator failed for (pc169.zz.ha.cn) [61.168.104.169]:35250: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)61.168.104.1691814991r-  -o) ossec13001i\Exim Auth failed2025-11-18 08:46:59 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:33720: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)125.17.233.2461269750 7 3 7\J  -A+ ossec13001i]AExim Auth failed2025-11-18 08:49:19 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:39104: 535 Incorrect authentication data (set_id=contato)169.211.232.1821835841ZI  -A' ossec13001i]=Exim Auth failed2025-11-18 08:49:16 dovecot_login authenticator failed for ([14.35.209.208]) [14.35.209.208]:43238: 535 Incorrect authentication data (set_id=venesselume)14.35.209.2081835841~H  -+ ossec13001i]7Exim Auth failed2025-11-18 08:49:09 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:44355: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)187.115.144.1033469034xG  -% ossec13001i]7Exim Auth failed2025-11-18 08:49:09 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:42430: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)75.80.65.2146252001\F  -G' ossec13001i]jExim Auth failed2025-11-18 08:50:02 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:55377: 535 Incorrect authentication data (set_id=bqtz@iemif.com)94.201.22.1582905575E  e?) ossec9710i]`Dovecot Auth failed on disconnected session.Nov 18 08:49:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730#D  e' ossec9710i]NDovecot Auth failed on disconnected session.Nov 18 08:49:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758]C  -E) ossec13001i]FExim Auth failed2025-11-18 08:49:26 dovecot_login authenticator failed for ([219.129.105.50]) [219.129.105.50]:50972: 535 Incorrect authentication data (set_id=faturamento)219.129.105.501814991_B  -G+ ossec13001i]CExim Auth failed2025-11-18 08:49:22 dovecot_login authenticator failed for ([211.101.233.154]) [211.101.233.154]:58688: 535 Incorrect authentication data (set_id=formula316)211.101.233.1541814991aA  ;?) ossec13008i]5Mail Recipient rejected2025-11-18 08:49:07 H=(localhost) [138.122.133.28]:41414 F= rejected RCPT : Sender verify failed138.122.133.283469034q@  -m) ossec13001i],Exim Auth failed2025-11-18 08:48:59 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:37072: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)190.110.36.1273508796g?  ;K) ossec13008i] Mail Recipient rejected2025-11-18 08:48:47 H=(localhost) [138.122.133.28]:41414 F= rejected RCPT : Sender verify failed138.122.133.283469034>  -) ossec13001i]Exim Auth failed2025-11-18 08:48:46 dovecot_login authenticator failed for m106153181080.v4.enabler.ne.jp [106.153.181.80]:47438: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)106.153.181.801861060 =  e# ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:48:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=167.99.8.956252001< W' ossec9708i]Dovecot Aborted Login with empty userNov 18 08:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H  > 4 * :bX0NvDl&|h^TJ@6r,"xnZP <2F(d~tjVLB8.`$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& ia( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`( i`~( i`v( i`Y( i`Y( i`I( i`E( i`x( i`5( i`'( i`( i`( i`( i` ( i` ( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i_( i__( i_[( i_e( i_Q( i_Q( i_{( i_s( i_m( i_i( i_K( i_?( i_+(~ i_(} i_K(| i_K({ i_=(z i_=(y i_-(x i_(w i_(v i_(u i^(t i^(s i^(r i^(q i_(p i^(o i^(n i^(m i^(l i^(k i^(j i^y(i i^o(h i^c(g i^[(f i^U(e i^I(d i^I(c i^=(b i^ (a i^(` i](_ i](^ i](] i](\ i]([ i](Z i](Y i](X i](W i](V i](U i](T i](S i]{(R i](Q i](P i](O i]{(N i]u(M i](L i]L(K i]A(J i]=(I i]7(H i]7(G i]j(F i]`(E i]N(D i]F(C i]C(B i]5(A i],(@ i] (? i](> i](9 i](= i](< i](; i](: i\(8 i\(7 i\(6 i\(2 i\(1 i\(5 i\(0 i\(4 i\(3 i\(/ i\(. i\(- i\() i\(( i\(, i\(+ i\(* i\(' i\r(" i\`(& i\^(! i\X( i\P(% i\P($ i\P( i\J(# i\D( i\B( i\>( i\4( i\2( i\ ( i\( i\ ( i\ ( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( ia( iaz( ial( iaV( iaV( iaN( iaL( iaJ( iaF( ia@( ia>( ia>( ia4( ia2( ia0( ia,( ia ( ia ( ia( ia( ia( ia( i\( i\( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[( i[' i[' i[~' i[p' i[n' i[P' i[N' i[N' i[J' i[J' i[:' i[4' i[0' i[0' i[.' i[$' i["' i[ ' i[' i[' ia( i[' i[' i[ ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ' iZ~' iZx' iZ\' iZH' iZH' iZD' iZD' iZB' iZ<' iZ:' iZ$' iZ ' iZ ' iZ' iZ' iZ' iY' iY' iY' iY' iY' iY' iY' iY' iY'   A ()Y W' ossec9708i]Dovecot Aborted Login with empty userNov 18 08:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*X  e/# ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:51:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<460jFd1DRqgXXz9j>23.95.63.996252001W  - ) ossec13001i]Exim Auth failed2025-11-18 08:52:06 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:49465: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)201.173.216.683996063lV  -c+ ossec13001i]Exim Auth failed2025-11-18 08:51:50 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12114: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)195.142.106.177298795.U  e1) ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:51:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<1WquFd1DVsOB4kCN>129.226.64.1411819730+T  e/% ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:50:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841NS  --# ossec13001i]Exim Auth failed2025-11-18 08:50:37 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:60807: 535 Incorrect authentication data (set_id=bruno)77.34.2.1792017370)R  e') ossec9710i]{Dovecot Auth failed on disconnected session.Nov 18 08:50:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750Q  W' ossec9708i]Dovecot Aborted Login with empty userNov 18 08:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#P  3K) ossec11301i]New FTP connection.Nov 18 08:50:53 hosting pure-ftpd: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1182750405O  k' ossec9709i]Multiple Dovecot Aborted Logins with empty userNov 18 08:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034N  - ) ossec13001i]{Exim Auth failed2025-11-18 08:50:18 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:49466: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)206.217.141.776252001~M  - % ossec13001i]uExim Auth failed2025-11-18 08:50:11 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:37129: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)111.70.8.1431668284RL  -3% ossec13001i]Exim Auth failed2025-11-18 08:50:44 dovecot_login authenticator failed for ([83.239.0.202]) [83.239.0.202]:56186: 535 Incorrect authentication data (set_id=cpanel)83.239.0.2022017370K W' ossec9708i]LDovecot Aborted Login with empty userNov 18 08:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  ]{bzZh  -=+ ossec13001i^oExim Auth failed2025-11-18 08:54:22 dovecot_login authenticator failed for ([222.170.228.150]) [222.170.228.150]:54429: 535 Incorrect authentication data (set_id=lucas)222.170.228.1501814991dg  -Y# ossec13001i^cExim Auth failed2025-11-18 08:54:10 dovecot_login authenticator failed for ([101.13.1.75]) [101.13.1.75]:34524: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)101.13.1.751668284f  W' ossec9708i^[Dovecot Aborted Login with empty userNov 18 08:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^e  -I' ossec13001i^UExim Auth failed2025-11-18 08:53:55 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:35134: 535 Incorrect authentication data (set_id=adriana)84.213.189.273144096*d  e)) ossec9710i^IDovecot Auth failed on disconnected session.Nov 18 08:53:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251c  -) ossec13001i^IExim Auth failed2025-11-18 08:53:43 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:54947: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)121.202.143.881819730b  k' ossec9709i^=Multiple Dovecot Aborted Logins with empty userNov 18 08:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^a  -G) ossec13001i^ Exim Auth failed2025-11-18 08:52:40 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:41998: 535 Incorrect authentication data (set_id=venesselume)216.194.174.276252001` W' ossec9708i^Dovecot Aborted Login with empty userNov 18 08:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034t_  -w% ossec13001i]Exim Auth failed2025-11-18 08:52:25 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:61906: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)49.207.15.251269750u^  -{# ossec13001i]Exim Auth failed2025-11-18 08:52:07 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:54491: 535 Incorrect authentication data (set_id=formula316)46.14.24.5026584347]  eA+ ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:51:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001.\  e1) ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 08:51:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841_[  -M% ossec13001i]Exim Auth failed2025-11-18 08:51:52 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:50772: 535 Incorrect authentication data (set_id=andressa.financeiro)160.25.58.191643084 Z  -!) ossec13001i]Exim Auth failed2025-11-18 08:51:33 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:53537: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)179.125.169.773469034 / y\UpW/$w  e) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 08:57:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387v  W' ossec9708i_Dovecot Aborted Login with empty userNov 18 08:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034au  -O' ossec13001i_Exim Auth failed2025-11-18 08:57:03 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:52516: 535 Incorrect authentication data (set_id=adm)94.255.255.262661886, rip=177.87.121.47, lip=200.150.196.245, session=<1gOoJ91DEMmxV3kv>177.87.121.473469034vp  -u+ ossec13001i_Exim Auth failed2025-11-18 08:57:05 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52380: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)181.191.136.1413469034/o U?) ossec11001i^Deferred login on the cpanel service[2025-11-18 08:55:50 -0300] info [webmaild] 200.66.119.172 - sat.integracao@kglsolucoes.com "GET /cpsess7848880021/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect200.66.119.1723469034&n  e+ ossec9710i^Dovecot Auth failed on disconnected session.Nov 18 08:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001fm  -U+ ossec13001i^Exim Auth failed2025-11-18 08:55:41 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51827: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1413469034l W' ossec9708i^Dovecot Aborted Login with empty userNov 18 08:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#k  e% ossec9710i^Dovecot Auth failed on disconnected session.Nov 18 08:55:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991aj  -U% ossec13001i^Exim Auth failed2025-11-18 08:55:16 dovecot_plain authenticator failed for (frotornath) [65.20.191.12]:37535: 535 Incorrect authentication data (set_id=neemias.piler@arkson.com.br)65.20.191.1299237i W' ossec9708i^yDovecot Aborted Login with empty userNov 18 08:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+pGGIN1DbISxV3kv>177.87.121.473469034   8 < B  e]% ossec9710i_QDovecot Auth failed on disconnected session.Nov 18 08:58:07 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.84.107.55, lip=200.150.196.245, TLS: Connection closed, session=45.84.107.552661886{  -% ossec13001i_QExim Auth failed2025-11-18 08:58:08 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:51602: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)121.44.0.1442077456a  -Q% ossec13001i_{Exim Auth failed2025-11-18 08:58:50 dovecot_login authenticator failed for (1075fm.com.br) [206.82.9.238]:62371: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)206.82.9.2386252001/  e7% ossec9710i_sDovecot Auth failed on disconnected session.Nov 18 08:58:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841  -) ossec13001i_mExim Auth failed2025-11-18 08:58:37 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:60462: 535 Incorrect authentication data (set_id=marcelo.pinheiro)122.170.99.1951269750 W' ossec9708i_iDovecot Aborted Login with empty userNov 18 08:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -E' ossec13001i_KExim Auth failed2025-11-18 08:58:02 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:52134: 535 Incorrect authentication data (set_id=atualizacoes1)193.46.192.202510769k  -c' ossec13001i_?Exim Auth failed2025-11-18 08:57:51 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:35769: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)83.239.84.1302017370~  -1' ossec13001i_+Exim Auth failed2025-11-18 08:57:30 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52296: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)70.91.135.18162520014}  e?' ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 08:57:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730x|  -y+ ossec13001i_KExim Auth failed2025-11-18 08:58:03 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:39242: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)177.135.223.1233469034Y{  -;+ ossec13001i_KExim Auth failed2025-11-18 08:58:02 dovecot_login authenticator failed for ([121.170.218.142]) [121.170.218.142]:46390: 535 Incorrect authentication data (set_id=info)121.170.218.1421835841bz  -Q' ossec13001i_=Exim Auth failed2025-11-18 08:57:48 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:55626: 535 Incorrect authentication data (set_id=andressa.financeiro)152.52.245.381269750gy  -]% ossec13001i_=Exim Auth failed2025-11-18 08:57:49 dovecot_login authenticator failed for ([36.96.36.174]) [36.96.36.174]:64582: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)36.96.36.1741814991x W' ossec9708i_-Dovecot Aborted Login with empty userNov 18 08:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  - ! {P/j  -_) ossec13001i_Exim Auth failed2025-11-18 08:59:32 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:59362: 535 Incorrect authentication data (set_id=marcos)70.118.112.2306252001  -+ ossec13001i_Exim Auth failed2025-11-18 08:59:28 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:50735: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)223.197.153.1431819730  W' ossec9708i_Dovecot Aborted Login with empty userNov 18 09:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e)) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 08:59:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750^  -I' ossec13001i_Exim Auth failed2025-11-18 08:59:46 dovecot_login authenticator failed for ([111.26.95.253]) [111.26.95.254]:35322: 535 Incorrect authentication data (set_id=paulinho.vendas)111.26.95.2541814991;  S[) ossec11000i_Login failed on the cpanel service.[2025-11-18 08:59:35 -0300] info [webmaild] 201.21.155.132 - josiane@schneidersglass.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User josiane@schneidersglass.com.br has their account suspended. Login blocked.201.21.155.1323469034'  e#) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 08:59:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841  -' ossec13001i_Exim Auth failed2025-11-18 08:59:11 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:44003: 535 Incorrect authentication data (set_id=marcos@maringasoldas.com.br)212.51.34.2292510769/  e3) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 08:59:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730-  e-+ ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 09:00:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.15418149916  eA) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 08:59:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<3DFZMN1DdM12wSaf>118.193.38.1591819730  -' ossec13001i__Exim Auth failed2025-11-18 08:58:22 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47136: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)213.124.221.22750405X  -=' ossec13001i_[Exim Auth failed2025-11-18 08:58:19 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:51363: 535 Incorrect authentication data (set_id=novamanha)125.17.185.941269750s  -u% ossec13001i_eExim Auth failed2025-11-18 08:58:29 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:38164: 535 Incorrect authentication data (set_id=andressa.financeiro)75.80.65.2146252001  | I  " W' ossec9708i`Dovecot Aborted Login with empty userNov 18 09:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&!  e%% ossec9710i`Dovecot Auth failed on disconnected session.Nov 18 09:01:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<+f9mOd1DN+l3xBIC>119.196.18.21835841^ -E) ossec13001i`Exim Auth failed2025-11-18 09:01:25 dovecot_login authenticator failed for (User) [177.74.174.120]:65499: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)177.74.174.1203469034+  e-' ossec9710i` Dovecot Auth failed on disconnected session.Nov 18 09:01:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001o  -i) ossec13001i` Exim Auth failed2025-11-18 09:01:12 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:52639: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)27.212.198.2261814991U  -7' ossec13001i_Exim Auth failed2025-11-18 09:00:45 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:43076: 535 Incorrect authentication data (set_id=rafael)121.73.162.152186224 W' ossec9708i_Dovecot Aborted Login with empty userNov 18 09:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034c  -W# ossec13001i_Exim Auth failed2025-11-18 09:00:31 dovecot_login authenticator failed for ([58.17.128.7]) [58.17.128.7]:57501: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)58.17.128.71814991-  e1' ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 09:00:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867)  U9% ossec11001i_Deferred login on the cpanel service[2025-11-18 09:00:18 -0300] info [webmaild] 177.4.64.247 - xavier@projetocircense.com.br "GET /cpsess9988883684/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect177.4.64.2473469034/  e1+ ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 09:00:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.14615628221  e=# ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 09:00:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483(  e%) ossec9710i_Dovecot Auth failed on disconnected session.Nov 18 09:00:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730  k' ossec9709i_Multiple Dovecot Aborted Logins with empty userNov 18 08:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6xllMt1DIqaxV3kv>177.87.121.473469034 #> % T_b/q0  -m) ossec13001i`Exim Auth failed2025-11-18 09:04:06 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:44908: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)113.219.177.951814991*/  e'+ ossec9710i`Dovecot Auth failed on disconnected session.Nov 18 09:03:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.11915628220. UC' ossec11001i`Deferred login on the cpanel service[2025-11-18 09:03:37 -0300] info [webmaild] 138.94.168.28 - hipercestafrota@hipercesta.com.br "GET /cpsess1583503987/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034/-  e1+ ossec9710i`Dovecot Auth failed on disconnected session.Nov 18 09:03:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841y,  -{+ ossec13001i`Exim Auth failed2025-11-18 09:03:10 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:39310: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)197.219.228.2421036973q+  -m) ossec13001i`~Exim Auth failed2025-11-18 09:03:09 dovecot_login authenticator failed for ([116.246.31.172]) [116.246.31.172]:33432: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)116.246.31.1721814991,*  e3# ossec9710i`vDovecot Auth failed on disconnected session.Nov 18 09:03:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750)  k' ossec9709i`YMultiple Dovecot Aborted Logins with empty userNov 18 09:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+X4iPd1DpoexV3kv>177.87.121.473469034( W+ ossec9708i`YDovecot Aborted Login with empty userNov 18 09:02:33 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=177.155.199.1763469034''  e%' ossec9710i`IDovecot Auth failed on disconnected session.Nov 18 09:02:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084,&  e++ ossec9710i`EDovecot Auth failed on disconnected session.Nov 18 09:02:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<07LHO91DDIp9gnHM>125.130.113.2041835841%  W' ossec9708i`xDovecot Aborted Login with empty userNov 18 09:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a$  -O' ossec13001i`5Exim Auth failed2025-11-18 09:01:56 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62845: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730Y#  -=) ossec13001i`'Exim Auth failed2025-11-18 09:01:42 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:56079: 535 Incorrect authentication data (set_id=contato)83.239.108.2182017370 d  !3j|d?  k' ossec9709iaMultiple Dovecot Aborted Logins with empty userNov 18 09:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q>  -m) ossec13001i`Exim Auth failed2025-11-18 09:04:22 dovecot_login authenticator failed for ([197.255.134.56]) [197.255.134.56]:34478: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)197.255.134.563374766j=  -a' ossec13001i`Exim Auth failed2025-11-18 09:04:21 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:63446: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)209.16.71.2546252001E< Um' ossec11001i`Deferred login on the cpanel service[2025-11-18 09:04:15 -0300] info [webmaild] 138.94.168.28 - hipercestafrota@hipercesta.com.br "GET /cpsess9926606530/3rdparty/roundcube/?_task=mail&_action=search&_interval=&_q=1316810&_headers=text&_layout=widescreen&_filter=ALL&_scope=base&_mbox=INBOX&_remote=1&_unlock=loading1763467454867&_=1763467284904 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034j;  -c% ossec13001i`Exim Auth failed2025-11-18 09:05:03 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:50685: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)119.6.108.131814991V:  -9' ossec13001i`Exim Auth failed2025-11-18 09:04:50 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:45480: 535 Incorrect authentication data (set_id=leandro)45.250.249.121269750r9  -o) ossec13001i`Exim Auth failed2025-11-18 09:04:40 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:41617: 535 Incorrect authentication data (set_id=junior.gomes)90.160.139.1632510769e8  -S+ ossec13001i`Exim Auth failed2025-11-18 09:04:37 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:52155: 535 Incorrect authentication data (set_id=leandro)207.200.180.17462520017 W' ossec9708i`Dovecot Aborted Login with empty userNov 18 09:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d6  -Q+ ossec13001i`Exim Auth failed2025-11-18 09:04:59 dovecot_login authenticator failed for ([219.135.168.148]) [219.135.168.148]:47105: 535 Incorrect authentication data (set_id=administrativo1)219.135.168.14818149915  -+ ossec13001i`Exim Auth failed2025-11-18 09:04:38 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:38542: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)175.100.107.2381831722&4  e#' ossec9710i`Dovecot Auth failed on disconnected session.Nov 18 09:04:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841g3  -[) ossec13001i`Exim Auth failed2025-11-18 09:03:36 dovecot_login authenticator failed for dynamic-216-81.keskikaista.fi [185.131.216.81]:51612: 535 Incorrect authentication data (set_id=alex.vendas)185.131.216.816600132 W' ossec9708i`Dovecot Aborted Login with empty userNov 18 09:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f1  -U+ ossec13001i`Exim Auth failed2025-11-18 09:03:21 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:33664: 535 Incorrect authentication data (set_id=adriana)187.115.144.1033469034 -zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C:->1$ {naT~qdreXKWJ=0# vi\OB5( 6 )     z n b V I < / "  yl_RE8+uh[NA4' ~qdWJ=0# Gzm`SF9, 3469034. 3469034. 3686110. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3686110. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034/^ 3469034/Z 3469034/X 3469034/R 3469034/M 3579143/K 3469034/F 3469034/C 3469034/A 3469034/: 3469034/9 3469034/6 3469034/3 3469034/0 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3865483 3865483 3865483 3865483 3865483w 3865483 3865483 3865483 3865483 3865483 3865483 3865483 3865483 x 3865483 % 3865483 3865483 ] 3865483 3865483k 3865483 3865483 3865483 3865483P 3703430+A 3703430 3703430 3703430% 3686110.d 3686110.5 3686110, 3686110,j 3686110+ 3686110* 3686110*e 3686110*% 3686110'B 3686110' 3686110$ 3686110$O 3686110$ 3686110# 3686110#/ 3686110# 3686110 3686110 3686110 3686110 3686110 3686110V 3686110 3686110 3686110} 3686110 3686110 3686110 W 3686110 3686110 | 3686110 3686110 3686110  3686110A 3686110 3686110o 3686110 3686110@ 3686110 3686110 3686110D 3686110 3658394. 3658394 3658394M 3658394 3658394R 3625428 3625428i 3625428 3625428 3625428 3625428 3625428 3624060 3617476# 3617476 3595528+Q 3595528' 3595528& 3595528$" 3595528! 3595528 , 3595528 3595528 3595528 ' 3595528 3582678) 357994&} 357994$ 357994" 357994"/ 357994 357994 ? 357994 ; 357994Z 357994 357994 3579143- 3579143 3573591 3573591 3573591 3508796) 3508796(@ 3508796( 3508796 3469034. 3469034. 3469034. 3469034. 3469034. 3469034.| 3469034.{ 3469034.y 3469034.u 3469034.n 3469034.m 3469034.f 3469034.c 3469034.Y 3469034.S 3469034.O 3469034.L 3469034.K 3469034.J 3469034.F 3469034.9 3469034.2 3469034.+ 3469034.' 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034. 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034- 3469034-w 3469034-r 3469034-n 3469034-e 3469034-d 3469034-_ 3469034-^ 3469034-X 3469034-S 3469034-P 3469034-O 3469034-M 3469034-L 3469034-B 3469034-< 3469034-4 3469034-3 3469034-, 3469034-& 3469034-% 3469034- 3469034- 3469034- 3469034- 3469034- 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034, 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3686110/ 3469034/ 3469034/ 3469034/{ 3469034/u 3469034/t 3469034/p 3469034/n 3469034/h 3469034/b 3469034// 3469034/. 3469034/* 3469034/" 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034/ 3469034.   !B(VN  -;% ossec13001iaNExim Auth failed2025-11-18 09:06:36 dovecot_login authenticator failed for ([111.26.62.42]) [111.26.62.42]:44514: 535 Incorrect authentication data (set_id=financeiro)111.26.62.4218149913M  e9+ ossec9710iaLDovecot Auth failed on disconnected session.Nov 18 09:06:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822L W' ossec9708iaJDovecot Aborted Login with empty userNov 18 09:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[K  -C' ossec13001ia>Exim Auth failed2025-11-18 09:06:20 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:52329: 535 Incorrect authentication data (set_id=atualizacoes)188.231.3.2463017382XJ  -=' ossec13001ia4Exim Auth failed2025-11-18 09:06:11 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:41040: 535 Incorrect authentication data (set_id=sec.geral)182.95.224.621269750pI  -m' ossec13001ia2Exim Auth failed2025-11-18 09:06:08 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:57082: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)51.68.226.1713017382yH  -}) ossec13001ialExim Auth failed2025-11-18 09:07:06 dovecot_login authenticator failed for ([222.75.225.206]) [222.75.225.206]:44069: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)222.75.225.2061814991G  W' ossec9708ia,Dovecot Aborted Login with empty userNov 18 09:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YF  -?' ossec13001ia Exim Auth failed2025-11-18 09:05:51 dovecot_login authenticator failed for ([219.248.4.146]) [219.248.4.146]:39260: 535 Incorrect authentication data (set_id=financeiro)219.248.4.1461835841E  - ) ossec13001ia Exim Auth failed2025-11-18 09:05:51 dovecot_login authenticator failed for 46.208.113.136.bc.googleusercontent.com [136.113.208.46]:43634: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)136.113.208.4662520011D  e7) ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:05:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730kC  -c' ossec13001iaExim Auth failed2025-11-18 09:05:38 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:43200: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)47.247.80.2271269750SB  -5% ossec13001ia0Exim Auth failed2025-11-18 09:06:06 dovecot_login authenticator failed for ([111.26.62.38]) [111.26.62.39]:59586: 535 Incorrect authentication data (set_id=contato)111.26.62.391814991lA -_+ ossec13001iaExim Auth failed2025-11-18 09:05:44 dovecot_plain authenticator failed for ([151.243.109.221]) [151.243.109.221]:52290: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)151.243.109.2212750405(@  e'' ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:05:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001 G   4"GW^  -=' ossec13001iaExim Auth failed2025-11-18 09:08:46 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:41682: 535 Incorrect authentication data (set_id=sec.geral)37.210.246.54289688J]  -'! ossec13001iaExim Auth failed2025-11-18 09:08:34 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:48641: 535 Incorrect authentication data (set_id=info)14.33.96.31835841~\  - ' ossec13001iaExim Auth failed2025-11-18 09:08:31 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:56754: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)219.76.191.291819730|[  -' ossec13001iaExim Auth failed2025-11-18 09:08:23 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:36046: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)5.185.176.195798544rZ  -q' ossec13001iaExim Auth failed2025-11-18 09:08:35 dovecot_login authenticator failed for (92x255x166x13.static-business.tmn.ertelecom.ru) [92.255.166.13]:40380: 535 Incorrect authentication data (set_id=info)92.255.166.132017370Y  -) ossec13001iaExim Auth failed2025-11-18 09:08:23 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:57146: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)220.246.42.2121819730X W' ossec9708iaDovecot Aborted Login with empty userNov 18 09:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(W  e#+ ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:07:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841]V  -G' ossec13001iazExim Auth failed2025-11-18 09:07:21 dovecot_login authenticator failed for ([111.26.95.126]) [111.26.95.126]:58068: 535 Incorrect authentication data (set_id=isabellylisboa)111.26.95.1261814991kU  -c' ossec13001iaExim Auth failed2025-11-18 09:07:45 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:49474: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)27.223.98.1171814991^T -E) ossec13001iaExim Auth failed2025-11-18 09:07:39 dovecot_login authenticator failed for (User) [177.74.174.120]:51872: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)177.74.174.1203469034S  -A' ossec13001iaVExim Auth failed2025-11-18 09:06:44 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (boebiumble) [68.46.148.180]:55070: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)68.46.148.1806252001\R  -C) ossec13001iaVExim Auth failed2025-11-18 09:06:44 dovecot_login authenticator failed for ([106.247.22.181]) [106.247.22.181]:57978: 535 Incorrect authentication data (set_id=assessoria)106.247.22.1811835841sQ  -q) ossec13001iaFExim Auth failed2025-11-18 09:06:29 dovecot_login authenticator failed for ([87.229.254.207]) [87.229.254.207]:49824: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)87.229.254.2072017370.P  e/+ ossec9710ia@Dovecot Auth failed on disconnected session.Nov 18 09:06:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822oO  -k' ossec13001ia>Exim Auth failed2025-11-18 09:06:21 dovecot_login authenticator failed for ([182.78.93.170]) [182.78.93.170]:41018: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)182.78.93.1701269750 6  I & Yi6/m  e5' ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:09:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001ll  -c) ossec13001ibExim Auth failed2025-11-18 09:10:04 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:40090: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)121.73.169.16721862244k  e;+ ossec9710ibDovecot Auth failed on disconnected session.Nov 18 09:10:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822)j  e%+ ossec9710ibDovecot Auth failed on disconnected session.Nov 18 09:09:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001i W' ossec9708iaDovecot Aborted Login with empty userNov 18 09:09:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.h  e5% ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:09:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991dg  -U' ossec13001iaExim Auth failed2025-11-18 09:08:43 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.206]:21653: 535 Incorrect authentication data (set_id=compras)154.47.20.20618610600f  e9% ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:08:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001e  k' ossec9709iaMultiple Dovecot Aborted Logins with empty userNov 18 09:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Qd  -1% ossec13001iaExim Auth failed2025-11-18 09:08:29 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:60635: 535 Incorrect authentication data (set_id=rafael)61.72.58.2421835841, rip=177.87.121.47, lip=200.150.196.245, session=<4rxjVN1D3tmxV3kv>177.87.121.473469034/_  e5' ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:08:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822  ~ N T + '{  - ) ossec13001ib^Exim Auth failed2025-11-18 09:11:10 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:55330: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)182.239.80.1551819730$z  e' ossec9710ibDovecot Auth failed on disconnected session.Nov 18 09:11:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001y  k' ossec9709ibvMultiple Dovecot Aborted Logins with empty userNov 18 09:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\x  -I% ossec13001ibtExim Auth failed2025-11-18 09:11:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64981: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758w  - + ossec13001ibTExim Auth failed2025-11-18 09:10:59 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:42552: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)122.184.118.1261269750Sv  -5% ossec13001ibLExim Auth failed2025-11-18 09:10:52 dovecot_login authenticator failed for ([111.26.63.88]) [111.26.63.89]:49638: 535 Incorrect authentication data (set_id=contato)111.26.63.891814991u W' ossec9708ib8Dovecot Aborted Login with empty userNov 18 09:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)t  e-# ossec9710ib0Dovecot Auth failed on disconnected session.Nov 18 09:10:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001%s  e#% ossec9710ib$Dovecot Auth failed on disconnected session.Nov 18 09:10:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060vr  -y) ossec13001ibNExim Auth failed2025-11-18 09:10:54 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:58404: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)196.188.187.85337996,q  e++ ossec9710ib6Dovecot Auth failed on disconnected session.Nov 18 09:10:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001(p  e'' ossec9710ib*Dovecot Auth failed on disconnected session.Nov 18 09:10:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084'o  e)# ossec9710ib$Dovecot Auth failed on disconnected session.Nov 18 09:10:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483'n  e#) ossec9710iaDovecot Auth failed on disconnected session.Nov 18 09:09:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750 #    6%Dix W' ossec9708ibDovecot Aborted Login with empty userNov 18 09:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<80p8ZN1DpLmxV3kv>177.87.121.473469034`  -Q% ossec13001ibExim Auth failed2025-11-18 09:13:14 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:54566: 535 Incorrect authentication data (set_id=vendas.luiz)83.166.63.13453733b  -Q' ossec13001ibExim Auth failed2025-11-18 09:13:12 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:46348: 535 Incorrect authentication data (set_id=contato)82.65.140.2183017382r  -o) ossec13001ibExim Auth failed2025-11-18 09:12:26 dovecot_login authenticator failed for ([182.135.122.79]) [182.135.122.79]:58328: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)182.135.122.791814991m  -c+ ossec13001ibExim Auth failed2025-11-18 09:12:17 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.123]:59306: 535 Incorrect authentication data (set_id=bqtz)116.193.128.1231269750W  -=% ossec13001ibExim Auth failed2025-11-18 09:13:05 dovecot_login authenticator failed for ([36.135.92.35]) [36.135.92.36]:37726: 535 Incorrect authentication data (set_id=vendas.luiz)36.135.92.361814991]  -E) ossec13001ibExim Auth failed2025-11-18 09:12:43 dovecot_login authenticator failed for ([222.122.98.135]) [222.122.98.135]:54417: 535 Incorrect authentication data (set_id=vendas.luiz)222.122.98.1351835841s  -u% ossec13001ibExim Auth failed2025-11-18 09:12:43 dovecot_login authenticator failed for (58-115-14-34.twt1.com.tw) [58.115.14.34]:45860: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)58.115.14.341668284 W' ossec9708ibDovecot Aborted Login with empty userNov 18 09:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -?' ossec13001ibhExim Auth failed2025-11-18 09:11:19 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:18716: 535 Incorrect authentication data (set_id=escritura1)58.57.154.1461814991d  -Q+ ossec13001ibExim Auth failed2025-11-18 09:12:06 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52367: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1413469034  W' ossec9708ibDovecot Aborted Login with empty userNov 18 09:12:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{  -) ossec13001ibExim Auth failed2025-11-18 09:12:00 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:53202: 535 Incorrect authentication data (set_id=bqtz@iemif.com)162.84.155.1906252001]~  -C+ ossec13001ibExim Auth failed2025-11-18 09:11:44 dovecot_login authenticator failed for ([121.170.218.142]) [121.170.218.142]:56734: 535 Incorrect authentication data (set_id=recepcao)121.170.218.1421835841+}  e)+ ossec9710ibvDovecot Auth failed on disconnected session.Nov 18 09:11:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<5rVAXd1DLt5o7MS0>104.236.196.1806252001Y|  -=) ossec13001ibhExim Auth failed2025-11-18 09:11:20 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:15833: 535 Incorrect authentication data (set_id=contato)223.167.203.561814991 % % h=%f -W' ossec13001ic$Exim Auth failed2025-11-18 09:14:27 dovecot_login authenticator failed for (freshtools.to) [185.66.142.41]:52244: 535 Incorrect authentication data (set_id=araca@adportobelo.com.br)185.66.142.413582678*  e-% ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:14:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841'  e%' ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:14:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822  W' ossec9708icFDovecot Aborted Login with empty userNov 18 09:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690345  e=+ ossec9710ic@Dovecot Auth failed on disconnected session.Nov 18 09:14:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001* U7' ossec11001ic6Deferred login on the cpanel service[2025-11-18 09:14:45 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034h  -]' ossec13001ic&Exim Auth failed2025-11-18 09:14:29 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:33572: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)128.185.231.61269750^  -G) ossec13001ic Exim Auth failed2025-11-18 09:14:04 dovecot_login authenticator failed for ([61.191.145.123]) [61.191.145.123]:48769: 535 Incorrect authentication data (set_id=junior.gomes)61.191.145.1231814991   -%' ossec13001ic Exim Auth failed2025-11-18 09:14:03 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (pseyfy) [68.46.148.180]:48806: 535 Incorrect authentication data (set_id=jomma@contabilidadefollador.com.br)68.46.148.18062520010 e5' ossec9710ibDovecot Auth failed on disconnected session.Nov 18 09:13:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730w  -y) ossec13001ibExim Auth failed2025-11-18 09:13:48 dovecot_login authenticator failed for vps-f9a28e39.vps.ovh.net [51.195.117.220]:20097: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)51.195.117.2203017382,  e1% ossec9710ibDovecot Auth failed on disconnected session.Nov 18 09:13:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841a  -S' ossec13001ibExim Auth failed2025-11-18 09:13:25 dovecot_plain authenticator failed for (bitainid) [65.20.205.197]:48495: 535 Incorrect authentication data (set_id=amarildo@brilhometal.com.br)65.20.205.19799237r  -q' ossec13001ic Exim Auth failed2025-11-18 09:14:03 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:59043: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)178.232.65.993144096  (  -) ossec13001icvExim Auth failed2025-11-18 09:15:50 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:33276: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)37.235.140.1632017370''  e%' ossec9710iczDovecot Auth failed on disconnected session.Nov 18 09:15:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991\&  -A+ ossec13001icpExim Auth failed2025-11-18 09:15:43 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:60410: 535 Incorrect authentication data (set_id=contato)119.160.166.2371820814s%  -s' ossec13001icdExim Auth failed2025-11-18 09:15:31 dovecot_login authenticator failed for ([182.78.93.170]) [182.78.93.170]:35708: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)182.78.93.1701269750u$  -u) ossec13001icTExim Auth failed2025-11-18 09:15:15 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:49830: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)182.151.45.1361814991s#  -s' ossec13001icvExim Auth failed2025-11-18 09:15:49 dovecot_login authenticator failed for pppoe-78-111-249-76.dynamic.tvingo.ru [78.111.249.76]:36038: 535 Incorrect authentication data (set_id=marcelo.pinheiro)78.111.249.762017370+"  e-' ossec9710ic^Dovecot Auth failed on disconnected session.Nov 18 09:15:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991l!  -i' ossec13001ic:Exim Auth failed2025-11-18 09:14:50 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:47073: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)65.20.250.18099237U  -7' ossec13001ic2Exim Auth failed2025-11-18 09:14:42 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:45772: 535 Incorrect authentication data (set_id=cpanel)74.196.184.786252001%  e#% ossec9710ic0Dovecot Auth failed on disconnected session.Nov 18 09:14:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<2mBLaN1DSK5vAEul>111.0.75.1651814991  -+) ossec13001ic(Exim Auth failed2025-11-18 09:14:32 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (artek) [98.204.134.124]:53072: 535 Incorrect authentication data (set_id=andre.parisenti@calcautomacao.com.br)98.204.134.1246252001V  -9' ossec13001icExim Auth failed2025-11-18 09:14:15 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:58073: 535 Incorrect authentication data (set_id=leandro)213.154.80.362245662n  -e+ ossec13001icLExim Auth failed2025-11-18 09:15:08 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:54008: 535 Incorrect authentication data (set_id=junior.gomes)185.183.103.1212635167%  e#% ossec9710icBDovecot Auth failed on disconnected session.Nov 18 09:14:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370  k' ossec9709ic(Multiple Dovecot Aborted Logins with empty userNov 18 09:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 . . C ) L 907  e3+ ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:16:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=132.148.140.1216252001X6  -?% ossec13001icExim Auth failed2025-11-18 09:16:08 dovecot_login authenticator failed for ([36.135.62.94]) [36.135.62.95]:51490: 535 Incorrect authentication data (set_id=atualizacoes)36.135.62.951814991#5  3K) ossec11301icNew FTP connection.Nov 18 09:17:06 hosting pure-ftpd: (?@46.101.109.199) [INFO] New connection from 46.101.109.19946.101.109.1992921044m4 -a+ ossec13001icExim Auth failed2025-11-18 09:16:47 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51370: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651n3  -g) ossec13001icExim Auth failed2025-11-18 09:16:36 dovecot_login authenticator failed for ([178.178.222.47]) [178.178.222.47]:43998: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)178.178.222.4720173702 W' ossec9708icDovecot Aborted Login with empty userNov 18 09:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(1  e+# ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:16:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.71386548340  e?' ossec9710icdDovecot Auth failed on disconnected session.Nov 18 09:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084+/  e+) ossec9710icdDovecot Auth failed on disconnected session.Nov 18 09:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841Y.  -=) ossec13001icjExim Auth failed2025-11-18 09:15:37 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:56944: 535 Incorrect authentication data (set_id=leandro)221.224.133.981814991- W' ossec9708icfDovecot Aborted Login with empty userNov 18 09:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034g,  -]% ossec13001ic\Exim Auth failed2025-11-18 09:15:23 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:45468: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)78.81.209.762017370|+  -+ ossec13001icXExim Auth failed2025-11-18 09:15:19 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:60591: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)113.158.205.2251861060i*  -_' ossec13001icExim Auth failed2025-11-18 09:16:04 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:58199: 535 Incorrect authentication data (set_id=compras)24.97.253.2466252001a)  -K+ ossec13001ic|Exim Auth failed2025-11-18 09:15:56 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51937: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034 ; ;[G  -A) ossec13001idExim Auth failed2025-11-18 09:18:14 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:47320: 535 Incorrect authentication data (set_id=financeiro)125.20.228.1461269750bF  -M+ ossec13001idExim Auth failed2025-11-18 09:18:11 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51992: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.1413469034ZE  -C' ossec13001icExim Auth failed2025-11-18 09:17:47 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:53536: 535 Incorrect authentication data (set_id=sandromiguel)45.82.109.136660013uD  -s+ ossec13001icExim Auth failed2025-11-18 09:17:40 dovecot_login authenticator failed for ([218.203.179.228]) [218.203.179.228]:35346: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)218.203.179.2281814991SC  -9# ossec13001icExim Auth failed2025-11-18 09:17:52 dovecot_login authenticator failed for ([93.84.78.69]) [93.84.78.69]:48774: 535 Incorrect authentication data (set_id=vendas.luiz)93.84.78.69630336bB -K+ ossec13001icExim Auth failed2025-11-18 09:17:26 dovecot_plain authenticator failed for (CBSALA-FP6e) [177.221.107.252]:31321: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)177.221.107.2523469034~A  -) ossec13001icExim Auth failed2025-11-18 09:17:57 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:55203: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)136.53.199.1606252001+@  e++ ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:17:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758!?  e' ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:17:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991>  3C% ossec11301icNew FTP connection.Nov 18 09:17:06 hosting pure-ftpd: (?@159.89.3.129) [INFO] New connection from 159.89.3.129159.89.3.1292921044=  W' ossec9708icDovecot Aborted Login with empty userNov 18 09:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a<  -K+ ossec13001icExim Auth failed2025-11-18 09:17:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51508: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034.;  e/+ ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:17:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001:  k' ossec9709icMultiple Dovecot Aborted Logins with empty userNov 18 09:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3sbKct1DSs2xV3kv>177.87.121.473469034l9  -k# ossec13001icExim Auth failed2025-11-18 09:17:22 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:55468: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)89.67.38.27798544.8  e5% ossec9710icDovecot Auth failed on disconnected session.Nov 18 09:17:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841  k`)gU  -Y) ossec13001idYExim Auth failed2025-11-18 09:19:36 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:40666: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)180.137.151.931814991|T  - # ossec13001idUExim Auth failed2025-11-18 09:19:32 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:53230: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)58.8.48.17816056513S  e=' ossec9710idhDovecot Auth failed on disconnected session.Nov 18 09:19:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.16562520013R  e=' ossec9710idfDovecot Auth failed on disconnected session.Nov 18 09:19:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.20462520010Q  e5) ossec9710id]Dovecot Auth failed on disconnected session.Nov 18 09:19:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730P W' ossec9708idWDovecot Aborted Login with empty userNov 18 09:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034XO  -A# ossec13001idhExim Auth failed2025-11-18 09:19:52 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:52732: 535 Incorrect authentication data (set_id=misterthomas)187.8.64.943469034]N  -G) ossec13001id3Exim Auth failed2025-11-18 09:18:57 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:47388: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.2267985490M  e7' ossec9710id.Dovecot Auth failed on disconnected session.Nov 18 09:18:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001_L  -K' ossec13001id(Exim Auth failed2025-11-18 09:18:47 dovecot_login authenticator failed for ([61.246.66.225]) [182.95.174.18]:58170: 535 Incorrect authentication data (set_id=marcelo.pinheiro)182.95.174.1812697506K  eA) ossec9710idDovecot Auth failed on disconnected session.Nov 18 09:18:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750J W' ossec9708idDovecot Aborted Login with empty userNov 18 09:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034tI  -s) ossec13001idExim Auth failed2025-11-18 09:18:28 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:59434: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)152.52.246.1781269750.H  e5% ossec9710id Dovecot Auth failed on disconnected session.Nov 18 09:18:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001  nd  -m# ossec13001ie Exim Auth failed2025-11-18 09:22:31 dovecot_login authenticator failed for ([101.13.6.86]) [101.13.6.86]:56104: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)101.13.6.861668284Yc  -C% ossec13001ieExim Auth failed2025-11-18 09:22:24 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49698: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758Wb  -;) ossec13001idExim Auth failed2025-11-18 09:21:20 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:44556: 535 Incorrect authentication data (set_id=cpfnc2)102.214.44.117149590pa  -o% ossec13001idExim Auth failed2025-11-18 09:22:01 dovecot_login authenticator failed for ([60.15.194.58]) [60.15.194.58]:47869: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)60.15.194.581814991` W' ossec9708idDovecot Aborted Login with empty userNov 18 09:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034#_  e% ossec9710id{Dovecot Auth failed on disconnected session.Nov 18 09:20:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=162.0.224.386252001+^  e+) ossec9710idDovecot Auth failed on disconnected session.Nov 18 09:20:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750g] -U+ ossec13001idExim Auth failed2025-11-18 09:20:20 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52183: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1413469034o\  -m% ossec13001idExim Auth failed2025-11-18 09:20:17 dovecot_login authenticator failed for ([36.135.62.82]) [36.135.62.83]:40822: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)36.135.62.831814991s[  -q) ossec13001idExim Auth failed2025-11-18 09:21:06 dovecot_login authenticator failed for ([120.198.61.146]) [120.198.61.146]:59188: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)120.198.61.1461814991Z  W' ossec9708idDovecot Aborted Login with empty userNov 18 09:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_Y  -K' ossec13001idExim Auth failed2025-11-18 09:20:46 dovecot_login authenticator failed for ([154.203.70.75]) [154.203.70.75]:33896: 535 Incorrect authentication data (set_id=marcelo.pinheiro)154.203.70.753374766PX  -1# ossec13001idExim Auth failed2025-11-18 09:20:33 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:40572: 535 Incorrect authentication data (set_id=contato)113.59.34.51814991W  k' ossec9709idMultiple Dovecot Aborted Logins with empty userNov 18 09:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690341V  e;' ossec9710iddDovecot Auth failed on disconnected session.Nov 18 09:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758  7\r  -C) ossec13001ieIExim Auth failed2025-11-18 09:23:35 dovecot_login authenticator failed for ([24.149.120.254]) [24.149.120.254]:36810: 535 Incorrect authentication data (set_id=escritura1)24.149.120.2546252001q  k' ossec9709ieEMultiple Dovecot Aborted Logins with empty userNov 18 09:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5/Q8iN1DYKyxV3kv>177.87.121.473469034yp  -' ossec13001ie7Exim Auth failed2025-11-18 09:23:17 dovecot_login authenticator failed for (undefined.sevstar.net) [31.28.253.144]:60404: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)31.28.253.144690791-o  e/) ossec9710ie1Dovecot Auth failed on disconnected session.Nov 18 09:23:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<8ETaht1DIK2B4rs4>129.226.187.561819730n  e# ossec9710ie1Dovecot Auth failed on disconnected session.Nov 18 09:23:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<7ZLjht1D+oKUcQQF>148.113.4.51269750m  W' ossec9708iecDovecot Aborted Login with empty userNov 18 09:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3XD+id1DnL6xV3kv>177.87.121.473469034#l  e% ossec9710ie+Dovecot Auth failed on disconnected session.Nov 18 09:23:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060Tk  ;)% ossec13008ie)Mail Recipient rejected2025-11-18 09:23:05 H=(195.3.134.135) [179.0.178.53]:54197 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:54197 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034j W' ossec9708ie Dovecot Aborted Login with empty userNov 18 09:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+i  e+) ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:22:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822Vh  -9' ossec13001idExim Auth failed2025-11-18 09:22:20 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:43685: 535 Incorrect authentication data (set_id=adriana)147.92.66.1886251999ng  -m# ossec13001ieExim Auth failed2025-11-18 09:22:50 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:27244: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)61.32.68.661835841+f  e/% ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:22:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841)e  e%+ ossec9710ie Dovecot Auth failed on disconnected session.Nov 18 09:22:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H 4 *   >vlND:bX&0|rh^T6J,"@ZPF<xdn 2(j~`VtLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih) ih@) ihj) ihV) ihR) ihH) ihD) ih2) ih0) ih) ih ) ih) ih) ih ) ih ) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) ig) igb) ig`) ig`) igZ) igt) ig) igj) igV) ig) ig) ig) igG) ig&) ig) if) if) if) if) if) if) if) if) if) if) if) if) if) if) if) if) ifq) ifq) ifk) ifg) ifc) ifc) if[) ifs) ifY) if3) if1) if) ifM) ifK) if5) if) ie) ie) ie) ie) if) ie) ie) ie) ie) ie) ie) ie) ie) ie) ie{)~ ie)} ie)| ie){ ie)z ieu)y iei)x iei)w ie)v ie)u ie)t ieO)s ieI)r ieE)q ie7)p ie1)o ie1)n iec)m ie+)l ie))k ie)g ie)f ie )e ie )j ie )d ie)i ie)c id)h id)a id)` id)b id)[ id)Z id)Y id)X id)^ id)W id)] id)\ id{)_ idh)S idh)O idf)R idd)V id])Q idY)U idW)P idU)T id3)N id.)M id()L id)K id)J id)I id )H id)G id)F ic)= ic)A ic)C ic)@ ic)E ij&* ij* ij* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii* ii) ii) ii* ii) ii) ii) ii) ii~* ii|* ii|) iiv) iir* iin) iih) iiT) iiB) ii<) ii6) ii6) ii*) ii() ii) ii) ih) ih) ic)< ic); ic)D ic)? ic): ic)B ic)9 ic)> ic)8 ic)5 ic)4 ic)3 ic)2 ic)1 ic)7 ic)6 ic)* ic|)) icz)' icv)( icv)# icp)& icj). icf)- icd)0 icd)/ icd)% ic^)" ic\), icX)+ icT)$ icL) icF) icB) ic@) ic:)! ic6) ic2) ic0) ic() ic() ic&) ij0* ic$) ic) ic) ic) ic ) ic ) ic ) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib) ib( ib( ib( ibv( ibv( ibt( ibh) ibh( ib^( ibT( ibN( ibL( ib8( ib6( ib0( ib*( ib$( ib$( ib( ib( 8 +  = `/@ 1  A]% ossec11302ieFTP Authentication failed.Nov 18 09:24:48 hosting pure-ftpd: (?@34.140.71.81) [WARNING] Authentication failed for user [anonymous]34.140.71.8128023613  e?% ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:24:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<7VIOjN1DMM4zTY0d>51.77.141.293017382 W' ossec9708ieDovecot Aborted Login with empty userNov 18 09:24:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034~  -) ossec13001ie{Exim Auth failed2025-11-18 09:24:27 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:58252: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)195.142.25.1832987950}  e5) ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:24:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387k|  -c' ossec13001ieExim Auth failed2025-11-18 09:24:48 dovecot_login authenticator failed for ([14.29.179.121]) [14.29.179.121]:45136: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)14.29.179.1211814991-{  e/) ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:24:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044z 3C% ossec11301ieNew FTP connection.Nov 18 09:24:42 hosting pure-ftpd: (?@34.140.71.81) [INFO] New connection from 34.140.71.8134.140.71.8128023617y  eA+ ossec9710ieuDovecot Auth failed on disconnected session.Nov 18 09:24:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822Rx  -3% ossec13001ieiExim Auth failed2025-11-18 09:24:08 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:40934: 535 Incorrect authentication data (set_id=cpanel)61.72.59.1061835841iw  -]+ ossec13001ieiExim Auth failed2025-11-18 09:24:08 dovecot_login authenticator failed for (ADMIN) [217.199.146.204]:56665: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)217.199.146.204192950'v  e'% ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:24:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<74iljN1DsoOiAOAm>162.0.224.386252001 u  -' ossec13001ieExim Auth failed2025-11-18 09:24:54 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (brozen) [73.195.211.98]:58478: 535 Incorrect authentication data (set_id=design.user.legal@inovasite.com)73.195.211.986252001Ut  -9% ossec13001ieExim Auth failed2025-11-18 09:24:49 dovecot_login authenticator failed for ([36.135.92.36]) [36.135.92.36]:54158: 535 Incorrect authentication data (set_id=sec.geral)36.135.92.361814991ks  -a) ossec13001ieOExim Auth failed2025-11-18 09:23:41 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:48962: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)182.95.176.1301269750  sLP-PdJ3 e9) ossec9710ifKDovecot Auth failed on disconnected session.Nov 18 09:27:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044 W' ossec9708if5Dovecot Aborted Login with empty userNov 18 09:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -_% ossec13001ifExim Auth failed2025-11-18 09:26:43 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:64999: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)84.54.33.2052750405Y  -=) ossec13001ieExim Auth failed2025-11-18 09:26:36 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:57902: 535 Incorrect authentication data (set_id=eduardo)58.228.105.1921835841  k' ossec9709ieMultiple Dovecot Aborted Logins with empty userNov 18 09:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034x  -{) ossec13001ieExim Auth failed2025-11-18 09:26:18 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:49604: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)179.185.29.2333469034#  e+ ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:26:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758  W' ossec9708ifDovecot Aborted Login with empty userNov 18 09:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)  e)' ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:25:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001 W' ossec9708ieDovecot Aborted Login with empty userNov 18 09:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y  -=) ossec13001ieExim Auth failed2025-11-18 09:25:28 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:53084: 535 Incorrect authentication data (set_id=contato)31.148.174.23420173705  eA' ossec9710ieDovecot Auth failed on disconnected session.Nov 18 09:26:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651* U7' ossec11001ieDeferred login on the cpanel service[2025-11-18 09:25:50 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034e  -W) ossec13001ieExim Auth failed2025-11-18 09:25:00 dovecot_plain authenticator failed for (premi) [213.207.250.28]:57974: 535 Incorrect authentication data (set_id=design.user.legal@inovasite.com)213.207.250.28130758 +  -M"*IdJ@N+  k' ossec9709ifMultiple Dovecot Aborted Logins with empty userNov 18 09:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0Lusnd1DuISxV3kv>177.87.121.473469034n  -k% ossec13001ifExim Auth failed2025-11-18 09:29:30 dovecot_login authenticator failed for ([162.243.8.74]) [162.243.8.74]:53214: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)162.243.8.746252001  -) ossec13001ifExim Auth failed2025-11-18 09:29:04 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:34612: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)149.210.41.172390903 W' ossec9708ifqDovecot Aborted Login with empty userNov 18 09:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -M) ossec13001ifqExim Auth failed2025-11-18 09:28:33 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:35031: 535 Incorrect authentication data (set_id=administrativo1)190.110.36.1273508796]  -E) ossec13001ifkExim Auth failed2025-11-18 09:28:27 dovecot_login authenticator failed for ([117.175.160.58]) [117.175.160.58]:54038: 535 Incorrect authentication data (set_id=alex.vendas)117.175.160.581814991t  -u' ossec13001ifgExim Auth failed2025-11-18 09:28:22 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:36712: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)83.239.84.1302017370'  e)# ossec9710ifcDovecot Auth failed on disconnected session.Nov 18 09:28:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750\  -E' ossec13001ifcExim Auth failed2025-11-18 09:28:19 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:46786: 535 Incorrect authentication data (set_id=colonialrodas)108.143.69.792750405Y  -A' ossec13001if[Exim Auth failed2025-11-18 09:28:10 dovecot_plain authenticator failed for (spiato) [178.16.90.176]:43425: 535 Incorrect authentication data (set_id=design@inovasite.com)178.16.90.176690791r  -o) ossec13001ifsExim Auth failed2025-11-18 09:28:34 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:59326: 535 Incorrect authentication data (set_id=alex.vendas)34.126.114.2391880251g  -[' ossec13001ifYExim Auth failed2025-11-18 09:28:08 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:34417: 535 Incorrect authentication data (set_id=colonialrodas@ieq.com.br)193.46.192.202510769.  e3' ossec9710if3Dovecot Auth failed on disconnected session.Nov 18 09:27:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867b  -O) ossec13001if1Exim Auth failed2025-11-18 09:27:29 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:39207: 535 Incorrect authentication data (set_id=andre.nascimento)112.196.52.1071269750  -) ossec13001ifExim Auth failed2025-11-18 09:27:10 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:50501: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)180.129.66.1341880251n  -i' ossec13001ifMExim Auth failed2025-11-18 09:27:57 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:53698: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)110.14.192.201835841 ^ cUxox^. W' ossec9708ig&Dovecot Aborted Login with empty userNov 18 09:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9MrWpN1DeMWxV3kv>177.87.121.473469034'-  e%' ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:31:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822],  -E) ossec13001ifExim Auth failed2025-11-18 09:30:49 dovecot_login authenticator failed for ([116.246.31.172]) [116.246.31.172]:39324: 535 Incorrect authentication data (set_id=alex.vendas)116.246.31.1721814991g+  -Y) ossec13001ifExim Auth failed2025-11-18 09:30:37 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:40292: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)121.73.161.1432186224* W' ossec9708ifDovecot Aborted Login with empty userNov 18 09:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k)  -e% ossec13001ifExim Auth failed2025-11-18 09:30:28 dovecot_login authenticator failed for ([27.24.141.95]) [27.24.141.95]:48074: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)27.24.141.951814991Y(  -=) ossec13001ifExim Auth failed2025-11-18 09:30:53 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:50396: 535 Incorrect authentication data (set_id=contato)221.209.48.2031814991 '  -!' ossec13001ifExim Auth failed2025-11-18 09:30:51 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (untolan) [85.225.19.144]:50188: 535 Incorrect authentication data (set_id=design.user.finance@inovasite.com)85.225.19.1442661886/&  e3+ ossec9710ifDovecot Auth failed on disconnected session.Nov 18 09:30:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<2iYgot1DfOzBl4nP>193.151.137.207130758%  W' ossec9708ifDovecot Aborted Login with empty userNov 18 09:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$$  e) ossec9710ifDovecot Auth failed on disconnected session.Nov 18 09:29:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841e#  -S+ ossec13001ifExim Auth failed2025-11-18 09:29:45 dovecot_login authenticator failed for ([112.186.241.102]) [112.186.241.102]:36428: 535 Incorrect authentication data (set_id=rsimoesdiretoria)112.186.241.1021835841\"  -C) ossec13001ifExim Auth failed2025-11-18 09:29:42 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:60230: 535 Incorrect authentication data (set_id=financeiro)178.178.222.562017370*!  e)) ossec9710ifDovecot Auth failed on disconnected session.Nov 18 09:29:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730.  e1) ossec9710ifDovecot Auth failed on disconnected session.Nov 18 09:29:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044  t w\h9)< e+% ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:33:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103$;  e!' ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:33:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<5VkFrN1D5Nw+PIOJ>62.60.131.137130758:  k' ossec9709igbMultiple Dovecot Aborted Logins with empty userNov 18 09:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+9  e/% ossec9710ig`Dovecot Auth failed on disconnected session.Nov 18 09:32:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841p8  -k) ossec13001ig`Exim Auth failed2025-11-18 09:32:31 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:33134: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)172.191.74.151625200177  eA+ ossec9710igZDovecot Auth failed on disconnected session.Nov 18 09:32:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001h6  -[) ossec13001igtExim Auth failed2025-11-18 09:32:50 dovecot_login authenticator failed for ([183.104.220.84]) [183.104.220.84]:59094: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)183.104.220.841835841p5  -k) ossec13001igExim Auth failed2025-11-18 09:33:03 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:47556: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)110.77.137.2361605651y4  -{+ ossec13001igjExim Auth failed2025-11-18 09:32:40 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:46929: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)180.188.143.1661819730)3  e') ossec9710igVDovecot Auth failed on disconnected session.Nov 18 09:32:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750]2  -I% ossec13001igExim Auth failed2025-11-18 09:33:06 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:48650: 535 Incorrect authentication data (set_id=adriana)103.90.27.83164308401  e7' ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:33:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149910  W' ossec9708igDovecot Aborted Login with empty userNov 18 09:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-/  e5# ossec9710igGDovecot Auth failed on disconnected session.Nov 18 09:32:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<1//Cpt1DRuQXXz9j>23.95.63.996252001   %FXZ(qK  -m) ossec13001igExim Auth failed2025-11-18 09:35:00 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:55616: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)182.95.176.1941269750J  -' ossec13001igExim Auth failed2025-11-18 09:34:50 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:49802: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)213.124.221.22750405.I  e1) ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:34:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730H W' ossec9708igDovecot Aborted Login with empty userNov 18 09:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.G  e1) ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:34:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841zF  -' ossec13001igExim Auth failed2025-11-18 09:34:12 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:49712: 535 Incorrect authentication data (set_id=jornalismo@89fmjoinville.com.br)82.65.140.2183017382jE  -a' ossec13001igExim Auth failed2025-11-18 09:35:06 dovecot_login authenticator failed for ([70.174.168.27]) [70.174.168.27]:53910: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)70.174.168.276252001[D  -G% ossec13001igExim Auth failed2025-11-18 09:35:01 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:40019: 535 Incorrect authentication data (set_id=xavier)37.57.69.227690791lC  -e' ossec13001igExim Auth failed2025-11-18 09:34:39 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:51310: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)111.26.61.2441814991VB  -;% ossec13001igExim Auth failed2025-11-18 09:34:22 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:33030: 535 Incorrect authentication data (set_id=jornalismo)13.68.214.346252001A W' ossec9708igDovecot Aborted Login with empty userNov 18 09:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e@  -W) ossec13001igExim Auth failed2025-11-18 09:33:30 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:38059: 535 Incorrect authentication data (set_id=eleicoes)82.102.165.200294640W?  -;' ossec13001igExim Auth failed2025-11-18 09:33:17 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:55016: 535 Incorrect authentication data (set_id=eleicoes)111.26.79.1121814991>  - ) ossec13001igExim Auth failed2025-11-18 09:33:11 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (bremon) [196.47.172.253]:55143: 535 Incorrect authentication data (set_id=amarildo@brilhometal.com.br)196.47.172.2532287781*=  e)) ossec9710igDovecot Auth failed on disconnected session.Nov 18 09:33:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251  % K ! J ' >%LK1Tq4,Z  e++ ossec9710ihDovecot Auth failed on disconnected session.Nov 18 09:37:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.24218358419Y  eG) ossec9710ih@Dovecot Auth failed on disconnected session.Nov 18 09:36:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.251814991_X  -O# ossec13001ihjExim Auth failed2025-11-18 09:36:58 dovecot_login authenticator failed for ([61.169.6.99]) [61.169.6.99]:40768: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)61.169.6.991814991YW  -=) ossec13001ihVExim Auth failed2025-11-18 09:36:36 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:40350: 535 Incorrect authentication data (set_id=contato)189.113.185.143469034V W' ossec9708ihRDovecot Aborted Login with empty userNov 18 09:36:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}U  -+ ossec13001ihHExim Auth failed2025-11-18 09:36:23 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:51578: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)121.202.146.1441819730UT  -7' ossec13001ihDExim Auth failed2025-11-18 09:36:20 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:53844: 535 Incorrect authentication data (set_id=cpanel)106.0.165.2191605651S  W' ossec9708ih2Dovecot Aborted Login with empty userNov 18 09:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034eR  -Y% ossec13001ih0Exim Auth failed2025-11-18 09:35:59 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:49967: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)58.16.201.521814991Q  k' ossec9709ihMultiple Dovecot Aborted Logins with empty userNov 18 09:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034SP  -5% ossec13001ih Exim Auth failed2025-11-18 09:35:22 dovecot_login authenticator failed for ([60.172.225.5]) [60.172.225.5]:55228: 535 Incorrect authentication data (set_id=contato)60.172.225.51814991&O  e+ ossec9710ihDovecot Auth failed on disconnected session.Nov 18 09:35:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<5cYjst1DlKOElIx5>132.148.140.1216252001VN  -=% ossec13001ihExim Auth failed2025-11-18 09:35:36 dovecot_login authenticator failed for ([31.56.60.121]) [31.56.60.121]:60422: 535 Incorrect authentication data (set_id=vendas.luiz)31.56.60.121298795aM  -O' ossec13001ih Exim Auth failed2025-11-18 09:35:22 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:34172: 535 Incorrect authentication data (set_id=vendas.luiz)51.68.226.1713017382rL  -o) ossec13001ih Exim Auth failed2025-11-18 09:35:20 dovecot_login authenticator failed for ([117.175.160.58]) [117.175.160.58]:34288: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)117.175.160.581814991 3% th\PD8, xl`TH<0$ |pdXL@4(th\PD8,  x l ` T H < 0 $  wkRF"{V=1}qeY3 :.b y l _ R E 8 +    u h [ N A 4 '  ~ q d W^nIL? K > 1 $   ~ q d W J = 0 # 130758/ 1522867/ 1522867/1 130758/ 130758/ 130758. 130758. 130758. 130758; 1307586 130758 130758 130758 130758 130758 130758 130758 130758y 130758o 130758b 130758/ 130758.i 130758.< 1522867.- 130758- 149590- 1522867- 130758- 1512440-s 130758-0 130758- 130758, 130758, 130758, 130758, 130758 130758 130758 130758 130758m 130758k 130758f 130758` 130758^ 130758W 130758Q 130758; 1307587 130758- 130758+ 130758* 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758n 130758d 130758X 130758T 130758P 1522867, 1512440, 130758, 130758, 130758, 1522867,` 1527747,Z 1512440,T 1512440,) 130758,( 149590, 149590, 130758+ 130758+ 1522867+l 130758+P 130758+M 1522867+J 130758++ 130758+) 1522867* 130758* 130758* 130758*d 130758*< 130758*# 130758*! 1522867) 1527747) 130758) 1562822 1562822 1562822c 1562822X 1562822G 1562822> 1562822 1562822 1562822] 1562822 1562822 1562822F 1562822n 1562822F 15628227 1527747% 1527747H 1527747> 1527747 1527747 1527747 1527747p 1527747 1527747 1522867) 1522867( 1522867(8 1522867& 1522867% 1522867%g 1522867$| 1522867# 1522867# 1522867" 1522867! 1522867!O 1522867 2 1522867 1522867^ 1522867 1522867 1522867 1522867 1522867> 1522867{ 1522867/ 1522867F 1522867 1522867 1522867 1522867 1522867X 1522867] 1522867 1522867) 1522867 1522867 1522867i 1522867z 1522867 15228673 1522867 1512440l 1512440 1512440 1512440X 1512440 1512440 1512440 149590)b 149590%D 149590! 149590 149590 b 149590 X 146669j 146669 146669 130758) 130758) 130758) 130758) 130758)c 130758)V 130758)@ 130758( 130758(r 130758(D 130758( 130758( 130758' 130758' 130758' 130758' 130758'` 130758' 130758& 130758& 130758& 130758&X 130758&I 130758& 130758% 130758% 130758% 130758%) 130758% 130758% 130758$ 130758$ 130758$ 130758$ 130758$~ 130758$m 130758$4 130758$ 130758# 130758# 130758# 130758#n 130758" 130758" 130758" 130758" 130758"x 130758"8 130758"$ 130758! 130758! 130758! 130758!f 130758!B 130758! 130758! 130758 130758 130758 130758 130758  130758 130758 (6  ) 7  =)H\(0j UA) ossec11001ihDeferred login on the cpanel service[2025-11-18 09:38:52 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034hi  -Y+ ossec13001ihExim Auth failed2025-11-18 09:38:46 dovecot_login authenticator failed for ([117.175.235.243]) [117.175.235.243]:49248: 535 Incorrect authentication data (set_id=andressa.financeiro)117.175.235.2431814991]h  -E) ossec13001ihExim Auth failed2025-11-18 09:38:27 dovecot_login authenticator failed for ([179.185.29.233]) [179.185.29.233]:56288: 535 Incorrect authentication data (set_id=aureovieira)179.185.29.2333469034jg  -]+ ossec13001ihExim Auth failed2025-11-18 09:38:28 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:53720: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)197.219.228.2421036973tf  -w% ossec13001ihExim Auth failed2025-11-18 09:38:26 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:36334: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)115.77.111.21562822le  -g% ossec13001ihExim Auth failed2025-11-18 09:38:59 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:51216: 535 Incorrect authentication data (set_id=envios@comercial.art.br)116.94.0.1591861060^d  -M% ossec13001ihExim Auth failed2025-11-18 09:38:56 dovecot_login authenticator failed for (212.35.70.26.ua.batelco.jo) [212.35.70.26]:34543: 535 Incorrect authentication data (set_id=eliezer)212.35.70.262488165c  eA' ossec9710ihDovecot Auth failed on disconnected session.Nov 18 09:38:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730b  k' ossec9709ihMultiple Dovecot Aborted Logins with empty userNov 18 09:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Za  -A' ossec13001ihExim Auth failed2025-11-18 09:38:11 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:47628: 535 Incorrect authentication data (set_id=aureovieira)92.255.190.692017370`  -;) ossec13001ihExim Auth failed2025-11-18 09:37:41 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (psess) [98.192.114.251]:39884: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)98.192.114.2516252001n_  -g) ossec13001ihExim Auth failed2025-11-18 09:37:38 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:52104: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)158.181.132.861527747o^  -o% ossec13001ihExim Auth failed2025-11-18 09:37:38 dovecot_plain authenticator failed for (metrus) [178.16.89.87]:32870: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)178.16.89.87690791] W' ossec9708ihDovecot Aborted Login with empty userNov 18 09:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\\  -I% ossec13001ihExim Auth failed2025-11-18 09:37:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62915: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758f[  -Y' ossec13001ihExim Auth failed2025-11-18 09:37:56 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:57702: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)125.19.188.981269750 O awO$x  e!% ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:41:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.361814991fw  -[% ossec13001iiExim Auth failed2025-11-18 09:41:42 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:39070: 535 Incorrect authentication data (set_id=isabellylisboa)98.161.232.96252001v  k' ossec9709ii|Multiple Dovecot Aborted Logins with empty userNov 18 09:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*u  e+' ossec9710ii6Dovecot Auth failed on disconnected session.Nov 18 09:40:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001&t  e!) ossec9710ii*Dovecot Auth failed on disconnected session.Nov 18 09:40:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387~s  - % ossec13001iiTExim Auth failed2025-11-18 09:40:51 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:52908: 535 Incorrect authentication data (set_id=secretarioadjunto)195.62.50.36298795r W' ossec9708iiBDovecot Aborted Login with empty userNov 18 09:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<29kJxd1DHq+xV3kv>177.87.121.473469034oq  -i) ossec13001ii<Exim Auth failed2025-11-18 09:40:27 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:45139: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)201.219.68.1893865483\p  -A+ ossec13001ii6Exim Auth failed2025-11-18 09:40:21 dovecot_login authenticator failed for ([185.129.146.241]) [185.129.146.241]:38724: 535 Incorrect authentication data (set_id=contato)185.129.146.2412017370o W' ossec9708iiDovecot Aborted Login with empty userNov 18 09:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\n  -G% ossec13001ihExim Auth failed2025-11-18 09:39:13 dovecot_login authenticator failed for 38-146-95-34.echocast.zone [38.146.95.34]:47093: 535 Incorrect authentication data (set_id=envios)38.146.95.346252001nm  -g) ossec13001ii(Exim Auth failed2025-11-18 09:40:08 dovecot_login authenticator failed for ([175.205.103.66]) [175.205.103.66]:41107: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)175.205.103.661835841,l  e/' ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:39:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867k  W' ossec9708ihDovecot Aborted Login with empty userNov 18 09:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 t w ^ j t/  e3) ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:42:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730  -' ossec13001iiExim Auth failed2025-11-18 09:42:13 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (pomak) [174.161.27.82]:59230: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)174.161.27.8262520015  eA' ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:42:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<3v1Azd1DqrqdQi/y>157.66.47.2421562822o  -m% ossec13001iiExim Auth failed2025-11-18 09:42:43 dovecot_login authenticator failed for ([27.39.128.68]) [27.39.128.68]:50134: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)27.39.128.681814991s  -u% ossec13001ii|Exim Auth failed2025-11-18 09:41:31 dovecot_login authenticator failed for ([151.2.166.30]) [151.2.166.30]:50831: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)151.2.166.302635167f  -[% ossec13001iiExim Auth failed2025-11-18 09:41:57 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:40988: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)111.26.63.831814991t  -u' ossec13001ii~Exim Auth failed2025-11-18 09:41:34 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:41325: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)201.173.86.133996063T  -;# ossec13001iirExim Auth failed2025-11-18 09:41:22 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:52494: 535 Incorrect authentication data (set_id=contato)77.78.13.137328004  eC# ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:41:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483#~  3K) ossec11301iiNew FTP connection.Nov 18 09:41:37 hosting pure-ftpd: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1182750405p}  -o% ossec13001iihExim Auth failed2025-11-18 09:41:12 dovecot_login authenticator failed for ([1.83.124.138]) [1.83.124.138]:34516: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)1.83.124.1381814991|  W' ossec9708iiDovecot Aborted Login with empty userNov 18 09:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'{  e#) ossec9710iivDovecot Auth failed on disconnected session.Nov 18 09:41:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730,z  e++ ossec9710iinDovecot Auth failed on disconnected session.Nov 18 09:41:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822*y  e)) ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:42:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750 &  F j o D.J,  e++ ossec9710ijLDovecot Auth failed on disconnected session.Nov 18 09:44:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841'  e%' ossec9710ij:Dovecot Auth failed on disconnected session.Nov 18 09:44:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084\  ;9% ossec13008ijMail Recipient rejected2025-11-18 09:44:08 H=(195.3.134.135) [179.0.178.53]:56271 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:56271 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034`  -M' ossec13001iiExim Auth failed2025-11-18 09:43:12 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:51333: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)123.58.215.721819730a  -M) ossec13001iiExim Auth failed2025-11-18 09:43:09 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:41056: 535 Incorrect authentication data (set_id=paulinho.vendas)112.168.71.1091835841i  -a' ossec13001iiExim Auth failed2025-11-18 09:43:33 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:51214: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)194.116.236.4298795 W' ossec9708iiDovecot Aborted Login with empty userNov 18 09:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&  e%% ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:43:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841'  e#) ossec9710iiDovecot Auth failed on disconnected session.Nov 18 09:43:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841w  -{' ossec13001iiExim Auth failed2025-11-18 09:43:13 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:35915: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)220.246.40.631819730X  ;/' ossec13008ijMail Recipient rejected2025-11-18 09:43:58 H=(localhost) [179.0.178.104]:62074 F= rejected RCPT : No Such User Here179.0.178.1043469034R  -1' ossec13001iiExim Auth failed2025-11-18 09:43:35 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:52440: 535 Incorrect authentication data (set_id=adm)152.52.194.941269750l  -k# ossec13001iiExim Auth failed2025-11-18 09:42:41 dovecot_login authenticator failed for (31-154-68-141.orange.net.il) [2.55.68.141]:38496: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)2.55.68.141294640 W' ossec9708iiDovecot Aborted Login with empty userNov 18 09:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2/8vzN1DBtyxV3kv>177.87.121.473469034V  -=' ossec13001iiExim Auth failed2025-11-18 09:42:23 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:49191: 535 Incorrect authentication data (set_id=comercial)65.20.153.14699237  r `v\+-&$  e#' ossec9710ijDovecot Auth failed on disconnected session.Nov 18 09:46:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<+kp22t1DOMg7GIXF>59.24.133.1971835841i#  -c% ossec13001ijExim Auth failed2025-11-18 09:45:53 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60992: 535 Incorrect authentication data (set_id=postamster@educacionalevangelico.com.br)62.60.131.40130758e"  -W' ossec13001ij|Exim Auth failed2025-11-18 09:45:48 dovecot_login authenticator failed for ([118.60.136.49]) [183.107.0.216]:59784: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)183.107.0.2161835841$!  e!' ossec9710ijpDovecot Auth failed on disconnected session.Nov 18 09:45:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<1qv91t1Dtqk+PIOL>62.60.131.139130758-  e-+ ossec9710ijnDovecot Auth failed on disconnected session.Nov 18 09:45:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991 W' ossec9708ijlDovecot Aborted Login with empty userNov 18 09:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f  -U+ ossec13001ijbExim Auth failed2025-11-18 09:45:22 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51972: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034+  e1# ossec9710ij8Dovecot Auth failed on disconnected session.Nov 18 09:44:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750_  -K' ossec13001ij6Exim Auth failed2025-11-18 09:44:38 dovecot_login authenticator failed for ([103.83.130.80]) [103.83.130.80]:41936: 535 Incorrect authentication data (set_id=marcelo.pinheiro)103.83.130.801269750*  e'+ ossec9710ij0Dovecot Auth failed on disconnected session.Nov 18 09:44:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822  k' ossec9709ij0Multiple Dovecot Aborted Logins with empty userNov 18 09:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034u  -u) ossec13001ij&Exim Auth failed2025-11-18 09:44:22 dovecot_login authenticator failed for ([218.27.205.159]) [218.27.205.159]:51484: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)218.27.205.1591814991'  e#) ossec9710ijFDovecot Auth failed on disconnected session.Nov 18 09:44:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044  W' ossec9708ijNDovecot Aborted Login with empty userNov 18 09:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 # ; _ ] ~|Y2U!73 UM+ ossec11001ijDeferred login on the cpanel service[2025-11-18 09:47:23 -0300] info [webmaild] 191.177.193.122 - ieqcampocomprido@ieq.com.br "GET /cpsess3858446217/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.193.122346903402  e3+ ossec9710ijDovecot Auth failed on disconnected session.Nov 18 09:47:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822Y1  -?' ossec13001ijExim Auth failed2025-11-18 09:47:11 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:49145: 535 Incorrect authentication data (set_id=marialuiza)193.46.192.202510769#0  k+ ossec9709ijMultiple Dovecot Aborted Logins with empty userNov 18 09:46:58 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, session=216.238.113.1763469034/ W+ ossec9708ijDovecot Aborted Login with empty userNov 18 09:46:57 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=<2DX+291DVNDY7nGw>216.238.113.1763469034~.  - ' ossec13001ijExim Auth failed2025-11-18 09:46:41 dovecot_login authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:59182: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)116.48.151.581819730- W' ossec9708ijDovecot Aborted Login with empty userNov 18 09:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+,  e-' ossec9710ijDovecot Auth failed on disconnected session.Nov 18 09:46:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001^+  -G) ossec13001ijExim Auth failed2025-11-18 09:46:47 dovecot_login authenticator failed for ([103.75.158.202]) [103.75.158.202]:49697: 535 Incorrect authentication data (set_id=junior.gomes)103.75.158.20212697500*  ES+ ossec5715ijSSHD authentication success.Nov 18 09:46:29 hosting sshd[2160]: Accepted password for root from 191.243.199.212 port 45046 ssh2191.243.199.2123469034~)  -) ossec13001ijExim Auth failed2025-11-18 09:46:57 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40386: 535 Incorrect authentication data (set_id=sec.geral)122.176.21.1041269750X(  -?% ossec13001ijExim Auth failed2025-11-18 09:46:35 dovecot_login authenticator failed for ([190.15.98.153]) [190.15.96.26]:58269: 535 Incorrect authentication data (set_id=aureovieira)190.15.96.263469034d'  -U' ossec13001ijExim Auth failed2025-11-18 09:46:30 dovecot_login authenticator failed for ([79.135.236.42]) [79.135.236.42]:58350: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)79.135.236.422017370x&  -{) ossec13001ijExim Auth failed2025-11-18 09:46:29 dovecot_login authenticator failed for (dynamic-adsl.viettel.vn) [116.98.104.138]:53788: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)116.98.104.1381562822]%  -C+ ossec13001ijExim Auth failed2025-11-18 09:46:53 dovecot_login authenticator failed for ([191.102.123.13]) [186.179.100.129]:1044: 535 Incorrect authentication data (set_id=marialuiza)186.179.100.1293686110  PjPszmWB  -;' ossec13001ik+Exim Auth failed2025-11-18 09:48:41 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:37273: 535 Incorrect authentication data (set_id=juridico)187.6.121.2463469034 A  -) ossec13001ik%Exim Auth failed2025-11-18 09:48:35 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:61293: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)223.197.145.331819730/@  e7% ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001p?  -i+ ossec13001ikExim Auth failed2025-11-18 09:48:26 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:45306: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)121.131.220.1441835841b>  -S% ossec13001ikExim Auth failed2025-11-18 09:48:25 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:36385: 535 Incorrect authentication data (set_id=contato)174.79.87.536252001h=  -Y+ ossec13001ik3Exim Auth failed2025-11-18 09:48:51 dovecot_login authenticator failed for ([122.175.189.100]) [122.175.189.100]:35227: 535 Incorrect authentication data (set_id=andressa.financeiro)122.175.189.1001269750Y<  -C% ossec13001ik-Exim Auth failed2025-11-18 09:48:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:54657: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758; W' ossec9708ik!Dovecot Aborted Login with empty userNov 18 09:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b:  -Q) ossec13001ik7Exim Auth failed2025-11-18 09:48:54 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:56808: 535 Incorrect authentication data (set_id=marcelo.pinheiro)185.101.16.2502721039  e) ossec9710ik'Dovecot Auth failed on disconnected session.Nov 18 09:48:37 hosting dovecot: imap-login: Disconnected: Connection closed: read(size=353) failed: Connection reset by peer (user disabled): user=, method=PLAIN, rip=113.10.156.230, lip=200.150.196.245, TLS: read(size=353) failed: Connection reset by peer, session=<3lF94N1DdeRxCpzm>113.10.156.2301819730k8  -_+ ossec13001ikExim Auth failed2025-11-18 09:48:29 dovecot_login authenticator failed for ([110.185.173.167]) [110.185.173.167]:34750: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)110.185.173.1671814991`7  -O' ossec13001ikExim Auth failed2025-11-18 09:48:22 dovecot_plain authenticator failed for (fradoss) [178.16.90.176]:40252: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)178.16.90.176690791.6  e/+ ossec9710ijDovecot Auth failed on disconnected session.Nov 18 09:47:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822r5  -m+ ossec13001ijExim Auth failed2025-11-18 09:47:57 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:48764: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)186.238.247.23834690344 W' ossec9708ijDovecot Aborted Login with empty userNov 18 09:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  Q  k' ossec9709ik]Multiple Dovecot Aborted Logins with empty userNov 18 09:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034YP  -=) ossec13001ikYExim Auth failed2025-11-18 09:49:29 dovecot_login authenticator failed for ([218.238.15.224]) [218.238.15.224]:39208: 535 Incorrect authentication data (set_id=adriana)218.238.15.2241835841eO  -S+ ossec13001ikUExim Auth failed2025-11-18 09:49:23 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63501: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)165.154.121.2311605651dN  -U' ossec13001ikMExim Auth failed2025-11-18 09:49:16 dovecot_login authenticator failed for ([113.57.108.79]) [183.92.116.88]:2465: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)183.92.116.881814991vM  -w) ossec13001ikEExim Auth failed2025-11-18 09:49:08 dovecot_login authenticator failed for ([119.36.194.248]) [119.36.193.230]:52122: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)119.36.193.2301814991L  -+ ossec13001ik}Exim Auth failed2025-11-18 09:50:05 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:53718: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)177.223.133.1043469034K  W' ossec9708ik{Dovecot Aborted Login with empty userNov 18 09:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 J  -#+ ossec13001ikKExim Auth failed2025-11-18 09:49:14 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:51228: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)188.219.104.2103175395{I  -+ ossec13001ik3Exim Auth failed2025-11-18 09:48:50 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:61872: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)223.197.164.1881819730[H  -C' ossec13001ik+Exim Auth failed2025-11-18 09:48:42 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:57751: 535 Incorrect authentication data (set_id=atualizacoes)5.140.212.1442017370G  W+ ossec9708ik)Dovecot Aborted Login with empty userNov 18 09:48:39 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.210, lip=200.150.207.122, TLS, session=185.247.137.2102635167kF  -_+ ossec13001ik#Exim Auth failed2025-11-18 09:48:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61293: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)165.154.121.2311605651oE  -m% ossec13001ikExim Auth failed2025-11-18 09:48:25 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:44798: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)59.27.93.1381835841.D  e3' ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:48:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001{C  -) ossec13001ikExim Auth failed2025-11-18 09:48:16 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:56586: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)202.166.82.2521880251 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+   3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034} 3469034{ 3469034z 3469034y 3469034u 3469034t 3469034p 3469034n 3469034g 3469034d 3469034a 3469034[ 3469034X 3469034V 3469034U 3469034T 3469034M 3469034L 3469034I 3469034E 3469034A 3469034@ 3469034? 3469034< 3469034; 34690347 34690340 3469034/ 3469034, 3469034* 3469034) 3469034' 3469034& 3469034# 3469034" 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034y 3469034w 3469034l 3469034i 3469034e 3469034d 3469034` 3469034^ 3469034\ 3469034Y 3469034T 3469034Q 3469034O 3469034J 3469034G 3469034B 3469034A 3469034> 3469034= 3469034: 34690349 34690347 34690345 34690344 34690342 34690340 3469034. 3469034- 3469034, 3469034+ 3469034) 3469034' 3469034% 3469034# 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034{ 3469034y 3469034x 3469034v 3469034p 3469034o 3469034k 3469034e 3469034^ 3469034Z 3469034W 3469034T 3469034E 3469034@ 3469034? 34690349 3469034- 3469034) 3469034& 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034h G ~TG `  -' ossec13001ikExim Auth failed2025-11-18 09:51:33 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:38540: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)220.246.40.631819730/_  e1+ ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:51:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=134.199.201.2056252001s^  -s) ossec13001ikExim Auth failed2025-11-18 09:50:52 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:38889: 535 Incorrect authentication data (set_id=contato)195.142.25.183298795]  - ' ossec13001ikExim Auth failed2025-11-18 09:50:43 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:36454: 535 Incorrect authentication data (set_id=marcelo.pinheiro)182.95.174.181269750\ W' ossec9708ikDovecot Aborted Login with empty userNov 18 09:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y[  -% ossec13001ikExim Auth failed2025-11-18 09:50:25 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:40518: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)103.90.27.831643084(Z  e#+ ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:50:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<+bDR591DDIt9gnHM>125.130.113.2041835841oY  -g+ ossec13001ikExim Auth failed2025-11-18 09:50:57 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:57818: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)120.157.221.1492077456uX  -s+ ossec13001ikExim Auth failed2025-11-18 09:50:54 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:47580: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)194.179.135.1742661886\W  -C) ossec13001ikExim Auth failed2025-11-18 09:50:53 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:54108: 535 Incorrect authentication data (set_id=financeiro)103.250.160.761269750-V  e-+ ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:50:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<1Ie06d1DpoJrhr+5>107.134.191.18562520011U  e5+ ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:50:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822T  -' ossec13001ikExim Auth failed2025-11-18 09:50:41 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:58709: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)186.201.54.903469034cS  -O+ ossec13001ik{Exim Auth failed2025-11-18 09:50:02 dovecot_login authenticator failed for ([175.203.199.118]) [175.203.199.118]:2001: 535 Incorrect authentication data (set_id=administrativo1)175.203.199.1181835841R  -5+ ossec13001ikoExim Auth failed2025-11-18 09:49:50 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:54931: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)107.135.117.2456252001  o  k' ossec9709ilMultiple Dovecot Aborted Logins with empty userNov 18 09:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034qn  -k+ ossec13001ikExim Auth failed2025-11-18 09:52:14 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:36586: 535 Incorrect authentication data (set_id=rafael)122.187.221.1301269750.m  e5% ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:52:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991ll  -c) ossec13001il3Exim Auth failed2025-11-18 09:53:06 dovecot_login authenticator failed for ([58.222.188.154]) [58.222.188.154]:63680: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)58.222.188.1541814991k  W' ossec9708il/Dovecot Aborted Login with empty userNov 18 09:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dj  -Y# ossec13001ikExim Auth failed2025-11-18 09:51:52 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:34545: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)221.2.40.101814991\i  -G' ossec13001ikExim Auth failed2025-11-18 09:51:45 dovecot_login authenticator failed for ([176.30.212.99]) [176.30.212.99]:44940: 535 Incorrect authentication data (set_id=isabellylisboa)176.30.212.99298795^h  -G) ossec13001ikExim Auth failed2025-11-18 09:51:20 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:59225: 535 Incorrect authentication data (set_id=atualizacoes)196.28.226.1241036973Vg  -;% ossec13001ikExim Auth failed2025-11-18 09:51:18 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:56148: 535 Incorrect authentication data (set_id=financeiro)58.16.201.521814991+f  e)+ ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:51:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001de  -U' ossec13001ikExim Auth failed2025-11-18 09:51:44 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:48489: 535 Incorrect authentication data (set_id=presidencia)152.231.25.643686110)d  e+' ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:51:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758$c  e## ossec9710ikDovecot Auth failed on disconnected session.Nov 18 09:51:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483b W' ossec9708ikDovecot Aborted Login with empty userNov 18 09:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<96Za7N1DRKGxV3kv>177.87.121.473469034pa  -k) ossec13001ikExim Auth failed2025-11-18 09:51:28 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:40958: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)122.187.220.301269750 " .'P"*~  e)) ossec9710il]Dovecot Auth failed on disconnected session.Nov 18 09:53:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750B}  -% ossec13001ilQExim Auth failed2025-11-18 09:53:37 dovecot_login authenticator failed for ([1.180.97.138]) [1.180.97.138]:38050: 535 Incorrect authentication data1.180.97.1381814991a|  -K+ ossec13001ilOExim Auth failed2025-11-18 09:53:34 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51454: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1413469034({  e'' ossec9710il9Dovecot Auth failed on disconnected session.Nov 18 09:53:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<2RIf8t1DnM1n9M4G>103.244.206.61643084z  -+ ossec13001iliExim Auth failed2025-11-18 09:54:01 dovecot_login authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:40388: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)117.250.165.1141269750Ty  -5' ossec13001ilgExim Auth failed2025-11-18 09:53:58 dovecot_login authenticator failed for 111-70-49-186.emome-ip.hinet.net [111.70.49.186]:42814: 535 Incorrect authentication data111.70.49.1861668284Wx  -=% ossec13001ileExim Auth failed2025-11-18 09:53:57 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:35634: 535 Incorrect authentication data (set_id=presidencia)27.24.141.881814991xw  -{) ossec13001ilCExim Auth failed2025-11-18 09:53:23 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:52281: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)46.212.110.2373144096\v  -A+ ossec13001il=Exim Auth failed2025-11-18 09:53:16 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:46362: 535 Incorrect authentication data (set_id=contato)190.238.101.2093932488du  -Y# ossec13001iliExim Auth failed2025-11-18 09:54:00 dovecot_login authenticator failed for ([111.4.78.74]) [111.4.78.74]:44992: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)111.4.78.741814991t W' ossec9708ilMDovecot Aborted Login with empty userNov 18 09:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6DGC891DQOGxV3kv>177.87.121.473469034%s  e#% ossec9710il;Dovecot Auth failed on disconnected session.Nov 18 09:53:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060tr  -s) ossec13001iloExim Auth failed2025-11-18 09:54:06 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:38576: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)121.202.198.981819730qq  -k+ ossec13001il-Exim Auth failed2025-11-18 09:53:00 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:51553: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)211.169.212.2061835841'p  e%' ossec9710il!Dovecot Auth failed on disconnected session.Nov 18 09:52:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001 @  |x_*@f  -[% ossec13001ilExim Auth failed2025-11-18 09:55:52 dovecot_login authenticator failed for ([85.175.81.54]) [85.175.81.54]:39796: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)85.175.81.5420173701 e7' ossec9710ilDovecot Auth failed on disconnected session.Nov 18 09:55:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=43.155.16.1051819730  W' ossec9708ilDovecot Aborted Login with empty userNov 18 09:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034*  e-% ossec9710ilDovecot Auth failed on disconnected session.Nov 18 09:56:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841l  -e' ossec13001ilExim Auth failed2025-11-18 09:55:57 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:36449: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)39.125.67.1091835841b  -M+ ossec13001ilExim Auth failed2025-11-18 09:55:38 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51815: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)181.191.136.1413469034  k' ossec9709ilMultiple Dovecot Aborted Logins with empty userNov 18 09:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690344  e=) ossec9710ilDovecot Auth failed on disconnected session.Nov 18 09:55:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730  - ' ossec13001ilExim Auth failed2025-11-18 09:54:28 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:47602: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)182.95.57.15812697505  e=+ ossec9710ilDovecot Auth failed on disconnected session.Nov 18 09:54:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001V  -9' ossec13001ilExim Auth failed2025-11-18 09:54:22 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:60047: 535 Incorrect authentication data (set_id=contato)114.30.180.581835841o  -i) ossec13001il}Exim Auth failed2025-11-18 09:54:21 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:62568: 535 Incorrect authentication data (set_id=aureovieira)220.246.47.1461819730Y  -=) ossec13001ilExim Auth failed2025-11-18 09:54:47 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:51646: 535 Incorrect authentication data (set_id=contato)120.157.27.2372077456$  e!% ossec9710ilDovecot Auth failed on disconnected session.Nov 18 09:54:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=91.122.56.592017370 W' ossec9708ilDovecot Aborted Login with empty userNov 18 09:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 M e -Q+ ossec13001imOExim Auth failed2025-11-18 09:57:51 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51993: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1413469034r  -s% ossec13001im3Exim Auth failed2025-11-18 09:57:23 dovecot_login authenticator failed for (22.32.117.87.donpac.ru) [87.117.32.22]:52580: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)87.117.32.222017370b  -S% ossec13001im9Exim Auth failed2025-11-18 09:57:29 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:36713: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)59.27.93.1381835841%  e#% ossec9710im5Dovecot Auth failed on disconnected session.Nov 18 09:57:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<8wo7Ad5DvLpvAEul>111.0.75.1651814991.  e3' ossec9710im/Dovecot Auth failed on disconnected session.Nov 18 09:57:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822^  -I' ossec13001im;Exim Auth failed2025-11-18 09:57:31 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:49224: 535 Incorrect authentication data (set_id=paulinho.vendas)38.141.252.556252001U  -7' ossec13001im;Exim Auth failed2025-11-18 09:57:31 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:37048: 535 Incorrect authentication data (set_id=compras)182.95.60.1461269750{  Cm' ossec11313imFTP file uploaded to serverNov 18 09:57:01 hosting pure-ftpd: (opsconso@201.22.53.135) [NOTICE] /home/opsconso//public_html/wp-content/themes/ops/template-cartas.php uploaded (15011 bytes, 535.85KB/sec)201.22.53.1353469034,  e3# ossec9710ilDovecot Auth failed on disconnected session.Nov 18 09:56:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001c  -Q) ossec13001ilExim Auth failed2025-11-18 09:56:12 dovecot_login authenticator failed for ([91.244.113.178]) [91.244.113.178]:53549: 535 Incorrect authentication data (set_id=secretarioadjunto)91.244.113.1782017370e  -W' ossec13001ilExim Auth failed2025-11-18 09:56:08 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:47425: 535 Incorrect authentication data (set_id=contato)189.218.82.493996063X  -?% ossec13001imExim Auth failed2025-11-18 09:56:37 dovecot_login authenticator failed for ([36.135.62.84]) [36.135.62.85]:57614: 535 Incorrect authentication data (set_id=atualizacoes)36.135.62.851814991 W' ossec9708imDovecot Aborted Login with empty userNov 18 09:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034! 3G' ossec11301ilNew FTP connection.Nov 18 09:56:11 hosting pure-ftpd: (?@201.22.53.135) [INFO] New connection from 201.22.53.135201.22.53.1353469034! C7' ossec11309ilFTP Authentication success.Nov 18 09:56:12 hosting pure-ftpd: (?@201.22.53.135) [INFO] opsconso is now logged in201.22.53.1353469034   -) ossec13001ilExim Auth failed2025-11-18 09:55:59 dovecot_login authenticator failed for (static-adsl190-250-78-191.une.net.co) [190.250.78.191]:54518: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)190.250.78.1913686110  sg+%O7wk_Sth\PD8, qe1+ymaUI=1% |pdXL@4(  BCth\PD8,  }[ xY l ` T H < 0 $    u j _ T I > 3 (    x m b W L A 6 +  { p e Z O D 9 . #   ~ s h ] R G < 1 &N7H=  99237/ 99237/ 99237/ 732800/f 690791/+ 798544/ 690791/ 798549/ 690791'( 690791% 690791$J 690791 690791 a 690791 690791 690791 690791 690791\ 690791A 690791z 690791# 690791. 99237.v 99237.[ 690791.. 732800.) 99237.% 99237.! 718075  718075 718075 718075 718075  718075  718075  690791- 690791- 690791- 690791-b 690791+ 690791* 690791*7 690791) 690791) 690791) 690791)p 690791'3 99237- 798544- 99237- 935317- 732800-a 732800-+ 798549- 798544 798544 798544 798544 798544 798544 ? 798544 # 798544_ 798544' 798544 798544 798544Q 798544/ 798544 798544 798544K 798544 798544 798544 798544i 798544 798544 732800* 732800'G 732800%P 732800%# 732800$ 732800# 732800 732800u 732800N 732800 732800 732800 732800 732800 732800j 7328008 732800 732800 732800 732800$ 732800 7328005 732800S 732800Q 7328006 732800 732800 719819" 718075  99237,I 99237,F 798544+z 798544+i 798549+5 99237+# 99237* 99237* 99237)! 99237) 99237(j 99237'x 99237' 99237& 99237&~ 99237&P 99237& 99237% 99237% 99237% 99237$ 99237$ 99237$s 99237$_ 99237$5 99237$ 99237# 99237#Y 99237# 99237# 99237"~ 99237"< 99237 99237 K 99237  99237 99237( 99237 99237 99237t 99237 99237 99237 99237 99237 99237h 99237. 99237 99237 99237; 99237 99237 992371 99237D 99237 99237 99237 99237 99237T 99237 99237 99237f 992375 99237 992376 99237 99237 99237 99237 99237 99237 1 99237 99237 N 99237 99237 99237 99237  99237 x 99237 99237 99237 99237 99237n 99237K 99237 99237+ 99237 99237 99237 99237 99237 99237t 99237 99237 99237 99237 99237 99237C 953987 953987 953987 953987 953987 953987e 953987 933860 921929% 921929 921929 921929 895949 R 798549)N 798549'Y 798549%? 798549#G 798549!_ 798549: 798549O 798549 798549 798549 798549 798549= 798549 798549 798549 798549 798549 798549 798549d 798549 798549 798549l 798549 798549 798549 798544)9 798544( 798544(5 798544&a 798544&D 798544$z 798544#J 798544#> 798544 798544 H 798544 798544g 798544| 798544 798544 798544x 798544 798544 798544 798544? 798544/ 798544' 798544 f*H   ~tj`VLB8.$\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R 4  * H > l&XND:v0bh^TJ|r,"@6d(ZPF< x2n`VLB~tj8.$zpRHf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (zpf>4*  vlbXND:0& ip2+ ip2+ ipJ+ ipF+ ip+ io+ ip"+ ip + io+ io+ io+ io+ io+ io+ io+ io+ io+ io+ io~+ io~+ io+ io+ io+ io+ io* iol* io`* ioZ* ioZ* io|* iox* ior* ior* io`* io&* io$* io* io * io * io * in* io* io* in* in* in* io* io* in* in* in* in* in* in* in* io* in* in* in* in* in* in* in* in* in* in* in* in* in* in* in* inv* inl* inj* inX* in* in* in2* in.* in,* in* inL* inD* in* im* im* im* in * im* im* im* im* im* im* im* im* im* im* im* im{* im* im* im* im* im* im* imc* im* im* im* im* imy* im* imS* im=* im-* im+* im)* imS* imG* imG* imQ* imO* im3* im9* im5* im/* im;* im;* im* im* im* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il* il}* ilo*r ili*z ili*u ilg*y ile*x il]*~ ilQ*} ilO*| ilM*t ilC*w il=*v il;*s il9*{ il3*l il/*k il-*q il!*p il*o ik*n ijF* ij:* ij8* ij6* iq+< iq+; iq+H iq+B iq+G iq+F iq+: iq+9 iq+8 iqt+7 iqX+3 iq9+6 iq/+5 iq*+4 iq+- iq+2 iq+1 ip+0 ip+/ ip+. ip++ ip+* ip+) ip+( ip+& ip+, ip+% ip+' ip+ ip+$ ip+ ip+# ip+" ip+! ip+ ip+ ip|+ ipv+ ipl+ iph+ ipN+ ik*m ik*j ik*i ik*e ik*d ik*c ik*b ik*` ik*a ik*_ ik*h ik*g ik*f ik*Y ik*X ik*W ik*^ ik*V ik*] ik*U ik*T ik*\ ik*[ ik*Z ik}*L ik{*S ik{*K iko*R ik]*Q ikY*P ikU*O ikM*N ikK*J ikE*M ik7*: ik3*I ik3*= ik-*< ik+*H ik+*B ik)*G ik'*9 iq+C ik%*A ik#*F ik!*; ik*@ ik*8 ik*E ik*? ik*> ik*7 ik*D ik*C ij*5 ij*4 ij*3 ij*2 ij*1 ij*6 ij*0 ij*/ ij*) ij*% ij*+ ij*. ij*( ij*- ij*$ ij** ij*' ij*& ij*, ij*# ij|*" ijp*! ijn* ijl* ijb* ijN* ijL*    $G$2,  e;' ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:58:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<7rObBt5DKMYtPZWl>45.61.149.1656252001+  - + ossec13001imExim Auth failed2025-11-18 09:58:52 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:31984: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)213.227.245.1546907912*  e7+ ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:58:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001+)  e+) ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:58:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<3L4HBt5DPsivfiX3>175.126.37.2471835841(  k' ossec9709imyMultiple Dovecot Aborted Logins with empty userNov 18 09:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y'  -=) ossec13001imExim Auth failed2025-11-18 09:59:04 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:56030: 535 Incorrect authentication data (set_id=contato)121.73.169.1612186224H&  -) ossec13001imSExim Auth failed2025-11-18 09:57:54 dovecot_login authenticator failed for ([125.140.145.62]) [125.140.145.62]:54095: 535 Incorrect authentication data125.140.145.621835841% W' ossec9708im=Dovecot Aborted Login with empty userNov 18 09:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s$  -s' ossec13001im-Exim Auth failed2025-11-18 09:57:17 dovecot_login authenticator failed for ([125.17.198.105]) [125.19.251.90]:43514: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)125.19.251.901269750n#  -i' ossec13001im+Exim Auth failed2025-11-18 09:57:14 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:50784: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)111.93.80.1581269750o"  -g+ ossec13001im)Exim Auth failed2025-11-18 09:57:12 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:49822: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)219.152.206.1551814991/!  e5' ossec9710imSDovecot Auth failed on disconnected session.Nov 18 09:57:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001Y  -?' ossec13001imGExim Auth failed2025-11-18 09:57:43 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:49274: 535 Incorrect authentication data (set_id=financeiro)117.6.226.1221562822]  -E) ossec13001imGExim Auth failed2025-11-18 09:57:42 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:52970: 535 Incorrect authentication data (set_id=aureovieira)121.73.168.2342186224%  e%# ossec9710imQDovecot Auth failed on disconnected session.Nov 18 09:57:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483  l.;  e3' ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:59:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991W:  -;' ossec13001imExim Auth failed2025-11-18 09:59:52 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:14500: 535 Incorrect authentication data (set_id=adriana)58.49.113.1381814991o9  -k' ossec13001imExim Auth failed2025-11-18 09:59:44 dovecot_login authenticator failed for ([188.247.43.42]) [188.247.43.42]:46306: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)188.247.43.4220173708 W' ossec9708imDovecot Aborted Login with empty userNov 18 09:59:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034'7 3O+ ossec11301im New FTP connection.Nov 18 09:59:28 hosting pure-ftpd: (?@165.227.134.101) [INFO] New connection from 165.227.134.101165.227.134.1012921044c6  -U' ossec13001imExim Auth failed2025-11-18 09:58:43 dovecot_login authenticator failed for ([87.201.160.53]) [87.201.160.53]:34210: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)87.201.160.5329055745  e?' ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:58:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=103.244.206.61643084n4  -i' ossec13001im{Exim Auth failed2025-11-18 09:58:35 dovecot_login authenticator failed for ([61.178.82.215]) [61.178.82.215]:52457: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)61.178.82.2151814991i3  -a% ossec13001imExim Auth failed2025-11-18 09:59:01 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:39540: 535 Incorrect authentication data (set_id=isabellylisboa)111.70.32.101668284)2  e') ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:58:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387.1  e5% ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:58:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841[0  -C' ossec13001imExim Auth failed2025-11-18 09:58:48 dovecot_login authenticator failed for ([182.79.95.231]) [152.52.244.46]:52868: 535 Incorrect authentication data (set_id=junior.gomes)152.52.244.461269750q/  -u% ossec13001imExim Auth failed2025-11-18 09:58:46 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:46580: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)65.20.133.5699237.  W' ossec9708imDovecot Aborted Login with empty userNov 18 09:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034--  e3% ossec9710imcDovecot Auth failed on disconnected session.Nov 18 09:58:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001 K 2  {nKI  k' ossec9709in.Multiple Dovecot Aborted Logins with empty userNov 18 10:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034$H  e' ossec9710in,Dovecot Auth failed on disconnected session.Nov 18 10:01:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<3IrkD95DPuYnaoFh>39.106.129.971814991aG  -M) ossec13001inExim Auth failed2025-11-18 10:01:17 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:35966: 535 Incorrect authentication data (set_id=flavio.oliveira)84.210.192.2403144096F  W' ossec9708inLDovecot Aborted Login with empty userNov 18 10:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034E  - + ossec13001inDExim Auth failed2025-11-18 10:01:55 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:63669: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)223.197.153.1351819730lD  -c) ossec13001inExim Auth failed2025-11-18 10:00:51 dovecot_login authenticator failed for ([58.222.188.154]) [58.222.188.154]:57027: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)58.222.188.1541814991'C  e%' ossec9710imDovecot Auth failed on disconnected session.Nov 18 10:00:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991B W' ossec9708imDovecot Aborted Login with empty userNov 18 10:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346A  eA) ossec9710imDovecot Auth failed on disconnected session.Nov 18 10:00:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750'@  e%' ossec9710in Dovecot Auth failed on disconnected session.Nov 18 10:00:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=36.50.177.1711562822@?  gO+ ossec11307imMultiple connection attempts from same sourceNov 18 09:59:34 hosting pure-ftpd: (?@165.227.134.101) [INFO] New connection from 165.227.134.101165.227.134.1012921044T>  -9# ossec13001imExim Auth failed2025-11-18 10:00:00 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:32681: 535 Incorrect authentication data (set_id=vendas.luiz)218.76.73.418149914=  e?' ossec9710imDovecot Auth failed on disconnected session.Nov 18 09:59:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001v<  -w) ossec13001imExim Auth failed2025-11-18 09:59:35 dovecot_login authenticator failed for ([128.185.224.14]) [122.186.244.34]:56270: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)122.186.244.341269750 ]   )]Y 3?# ossec11301inNew FTP connection.Nov 18 10:03:16 hosting pure-ftpd: (?@34.38.45.85) [INFO] New connection from 34.38.45.8534.38.45.852802361qX  -q% ossec13001inExim Auth failed2025-11-18 10:03:13 dovecot_login authenticator failed for ([111.26.62.42]) [111.26.62.42]:58820: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)111.26.62.421814991`W  -Q# ossec13001inExim Auth failed2025-11-18 10:03:27 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:51783: 535 Incorrect authentication data (set_id=contato)113.28.86.11819730[V  -E% ossec13001inExim Auth failed2025-11-18 10:03:40 dovecot_login authenticator failed for ([219.139.41.6]) [219.139.41.6]:49566: 535 Incorrect authentication data (set_id=administrativo1)219.139.41.61814991U W' ossec9708inDovecot Aborted Login with empty userNov 18 10:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5ZpFF95DEMuxV3kv>177.87.121.473469034#T  e% ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:03:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<151BFt5D7pwI2Cjk>8.216.40.2281861060lS  -e' ossec13001inExim Auth failed2025-11-18 10:03:14 dovecot_login authenticator failed for ([113.201.2.253]) [113.201.2.253]:18925: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)113.201.2.25318149910R  e9% ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841 Q  -%) ossec13001inExim Auth failed2025-11-18 10:03:51 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:55876: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)195.142.25.183298795kP  -c' ossec13001invExim Auth failed2025-11-18 10:02:44 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:60578: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)182.95.54.1941269750\O  -I% ossec13001inlExim Auth failed2025-11-18 10:02:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61169: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758N W' ossec9708injDovecot Aborted Login with empty userNov 18 10:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ZM  -?) ossec13001inXExim Auth failed2025-11-18 10:02:14 dovecot_login authenticator failed for ([75.183.102.189]) [75.183.102.189]:40278: 535 Incorrect authentication data (set_id=juridico)75.183.102.1896252001tL  -w% ossec13001inExim Auth failed2025-11-18 10:03:03 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:38354: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)115.77.111.21562822jK  -a' ossec13001inExim Auth failed2025-11-18 10:02:59 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:39049: 535 Incorrect authentication data (set_id=sec.geral)177.174.15.693469034&J  e%% ossec9710in2Dovecot Auth failed on disconnected session.Nov 18 10:01:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<7Gk9EN5DwI2iAOAm>162.0.224.386252001 g k J '  3|h  Co' ossec11313ioFTP file uploaded to serverNov 18 10:05:08 hosting pure-ftpd: (opsconso@201.22.53.135) [NOTICE] /home/opsconso//public_html/wp-content/themes/ops/template-cartas.php uploaded (8212 bytes, 30859.04KB/sec)201.22.53.1353469034(g  e%) ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822Rf  -5# ossec13001inExim Auth failed2025-11-18 10:04:55 dovecot_login authenticator failed for ([65.76.33.76]) [65.76.33.76]:48674: 535 Incorrect authentication data (set_id=novamanha)65.76.33.766252001,e  e-) ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=129.226.187.561819730+d  e++ ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758Vc  -9' ossec13001inExim Auth failed2025-11-18 10:04:26 dovecot_login authenticator failed for ([122.186.91.50]) [122.186.91.50]:59274: 535 Incorrect authentication data (set_id=contato)122.186.91.501269750qb  -m) ossec13001inExim Auth failed2025-11-18 10:04:23 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:41876: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)103.147.248.441269750Va  -;% ossec13001inExim Auth failed2025-11-18 10:04:12 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:58842: 535 Incorrect authentication data (set_id=financeiro)27.24.141.881814991`  W' ossec9708ioDovecot Aborted Login with empty userNov 18 10:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034._  e1) ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750^  k' ossec9709inMultiple Dovecot Aborted Logins with empty userNov 18 10:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  e# ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750x\  -{) ossec13001inExim Auth failed2025-11-18 10:04:14 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:33026: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)178.232.51.1353144096/[  A[# ossec11302inFTP Authentication failed.Nov 18 10:03:20 hosting pure-ftpd: (?@34.38.45.85) [WARNING] Authentication failed for user [anonymous]34.38.45.852802361bZ  -Q' ossec13001inExim Auth failed2025-11-18 10:03:17 dovecot_login authenticator failed for ([122.201.27.64]) [122.201.27.64]:53914: 535 Incorrect authentication data (set_id=andressa.financeiro)122.201.27.642029969 | e ii||x  - + ossec13001iorExim Auth failed2025-11-18 10:06:58 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:35432: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)213.238.254.1562661886ww  -w+ ossec13001iorExim Auth failed2025-11-18 10:06:58 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:57988: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)185.183.103.1212635167iv -[) ossec13001io`Exim Auth failed2025-11-18 10:06:38 dovecot_plain authenticator failed for (ASMAQ-lyxY) [149.19.165.201]:43794: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)149.19.165.2013469034|u Cm' ossec11313io&FTP file uploaded to serverNov 18 10:05:40 hosting pure-ftpd: (opsconso@201.22.53.135) [NOTICE] /home/opsconso//public_html/wp-content/themes/ops/template-cartas.php uploaded (5074 bytes, 1350.17KB/sec)201.22.53.1353469034)t  e)' ossec9710io$Dovecot Auth failed on disconnected session.Nov 18 10:05:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<+fmtHt5DJOCkXF7M>164.92.94.2046252001s W' ossec9708ioDovecot Aborted Login with empty userNov 18 10:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034pr  -k) ossec13001io Exim Auth failed2025-11-18 10:05:13 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:47729: 535 Incorrect authentication data (set_id=alex.vendas)90.161.217.2282510769cq  -U' ossec13001io Exim Auth failed2025-11-18 10:05:14 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:61348: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)194.116.236.42987954p  e;+ ossec9710io Dovecot Auth failed on disconnected session.Nov 18 10:05:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=103.179.188.1461562822zo  -' ossec13001inExim Auth failed2025-11-18 10:04:10 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:45826: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)77.37.162.1172017370 n  C7' ossec11309ioFTP Authentication success.Nov 18 10:05:07 hosting pure-ftpd: (?@201.22.53.135) [INFO] opsconso is now logged in201.22.53.1353469034 m  3G' ossec11301ioNew FTP connection.Nov 18 10:05:07 hosting pure-ftpd: (?@201.22.53.135) [INFO] New connection from 201.22.53.135201.22.53.1353469034]l  -I% ossec13001inExim Auth failed2025-11-18 10:04:44 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:55275: 535 Incorrect authentication data31.199.10.823175395lk  -a+ ossec13001inExim Auth failed2025-11-18 10:04:21 dovecot_login authenticator failed for ([123.129.196.119]) [123.129.196.119]:56808: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)123.129.196.11918149915j  e?) ossec9710inDovecot Auth failed on disconnected session.Nov 18 10:04:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730ii  -_' ossec13001ioExim Auth failed2025-11-18 10:05:07 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:54148: 535 Incorrect authentication data (set_id=compras)220.246.33.791819730  .  e1) ossec9710ioDovecot Auth failed on disconnected session.Nov 18 10:07:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387y  -}) ossec13001ioExim Auth failed2025-11-18 10:07:29 dovecot_login authenticator failed for ([91.207.181.124]) [91.207.181.124]:41872: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)91.207.181.1242017370h  -Y+ ossec13001io~Exim Auth failed2025-11-18 10:07:09 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:48962: 535 Incorrect authentication data (set_id=juliana)121.202.206.1191819730g  -[) ossec13001io~Exim Auth failed2025-11-18 10:07:09 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:40267: 535 Incorrect authentication data (set_id=marialuiza)82.102.188.117294640  W' ossec9708ioDovecot Aborted Login with empty userNov 18 10:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034z  -' ossec13001ioExim Auth failed2025-11-18 10:07:54 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:50336: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)82.209.148.602661886g  -W+ ossec13001ioExim Auth failed2025-11-18 10:07:49 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:55828: 535 Incorrect authentication data (set_id=andressa.financeiro)122.185.176.1261269750  k' ossec9709ioMultiple Dovecot Aborted Logins with empty userNov 18 10:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034h  -[) ossec13001ioExim Auth failed2025-11-18 10:07:20 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:57290: 535 Incorrect authentication data (set_id=xavier)187.11.252.1603469034~  -# ossec13001iolExim Auth failed2025-11-18 10:06:52 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:51592: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)96.1.40.1516251999i}  -a% ossec13001io`Exim Auth failed2025-11-18 10:06:38 dovecot_login authenticator failed for ([14.46.58.104]) [14.46.58.104]:59568: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)14.46.58.1041835841||  -' ossec13001ioZExim Auth failed2025-11-18 10:06:34 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:48438: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)42.200.70.1341819730{ W' ossec9708ioZDovecot Aborted Login with empty userNov 18 10:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[z  -C' ossec13001io|Exim Auth failed2025-11-18 10:07:08 dovecot_login authenticator failed for ([61.178.82.215]) [61.178.82.215]:55727: 535 Incorrect authentication data (set_id=junior.gomes)61.178.82.2151814991-y  e1' ossec9710ioxDovecot Auth failed on disconnected session.Nov 18 10:07:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867 3 @  ' M D*)  e%+ ossec9710ip2Dovecot Auth failed on disconnected session.Nov 18 10:10:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991l  -c) ossec13001iplExim Auth failed2025-11-18 10:11:08 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:61264: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)12.222.177.1466252001  W' ossec9708iphDovecot Aborted Login with empty userNov 18 10:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d  -W% ossec13001ipExim Auth failed2025-11-18 10:09:25 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:60485: 535 Incorrect authentication data (set_id=contato)161.81.25.861819730%  e%# ossec9710ioDovecot Auth failed on disconnected session.Nov 18 10:09:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750  -) ossec13001ip"Exim Auth failed2025-11-18 10:09:53 dovecot_login authenticator failed for (79x136x194x132.dynamic.saratov.ertelecom.ru) [79.136.194.132]:56572: 535 Incorrect authentication data (set_id=envios@comercial.art.br)79.136.194.1322017370 W' ossec9708ip Dovecot Aborted Login with empty userNov 18 10:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708ioDovecot Aborted Login with empty userNov 18 10:08:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  -' ossec13001ioExim Auth failed2025-11-18 10:08:27 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:53156: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)219.76.191.291819730V  -9' ossec13001ioExim Auth failed2025-11-18 10:08:13 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:43288: 535 Incorrect authentication data (set_id=contato)159.75.92.1361814991Z  -=+ ossec13001ioExim Auth failed2025-11-18 10:08:13 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:43306: 535 Incorrect authentication data (set_id=bruno)103.158.138.17912697507  eE' ossec9710ioDovecot Auth failed on disconnected session.Nov 18 10:08:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<6XWvJ95DUJQI1et7>8.213.235.1231605651o  -i) ossec13001ioExim Auth failed2025-11-18 10:08:46 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:45442: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)223.166.87.1451814991Y  -=+ ossec13001ioExim Auth failed2025-11-18 10:08:39 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:56492: 535 Incorrect authentication data (set_id=bruno)178.250.191.189458258l  -i# ossec13001ioExim Auth failed2025-11-18 10:07:48 dovecot_login authenticator failed for ([1.31.80.222]) [1.31.80.222]:45882: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)1.31.80.2221814991 '>   ' -%  e-+ ossec9710ipDovecot Auth failed on disconnected session.Nov 18 10:12:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841$ W+ ossec9708ipDovecot Aborted Login with empty userNov 18 10:11:48 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=<6CDcNN5DR/TY7nGw>216.238.113.1763469034g#  -_' ossec13001ipExim Auth failed2025-11-18 10:11:47 dovecot_plain authenticator failed for (chabloness) [65.20.133.208]:46996: 535 Incorrect authentication data (set_id=design.user.sales@inovasite.com)65.20.133.20899237"  Ss) ossec11000ipLogin failed on the cpanel service.[2025-11-18 10:11:39 -0300] info [cpaneld] 159.223.33.152 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password159.223.33.1521880251k!  -g% ossec13001ipExim Auth failed2025-11-18 10:11:35 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:54508: 535 Incorrect authentication data (set_id=contato)5.199.161.79597427n  -i' ossec13001ip|Exim Auth failed2025-11-18 10:11:24 dovecot_login authenticator failed for (static.ftth.knl.117.220.14.49.bsnl.in) [117.220.14.49]:37672: 535 Incorrect authentication data (set_id=comercial)117.220.14.491269750X  -A# ossec13001ipExim Auth failed2025-11-18 10:11:59 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:56126: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999#  k+ ossec9709ipMultiple Dovecot Aborted Logins with empty userNov 18 10:11:48 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, session=216.238.113.17634690340  e5) ossec9710ipDovecot Auth failed on disconnected session.Nov 18 10:11:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730 W' ossec9708ipDovecot Aborted Login with empty userNov 18 10:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s  -s' ossec13001ipvExim Auth failed2025-11-18 10:11:17 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:50682: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)95.181.244.442017370y  -}) ossec13001ipNExim Auth failed2025-11-18 10:10:38 dovecot_login authenticator failed for os3-365-15698.vs.sakura.ne.jp (ADMIN) [133.167.70.202]:59617: 535 Incorrect authentication data (set_id=info@kglsolucoes.com)133.167.70.2021861060  k' ossec9709ipJMultiple Dovecot Aborted Logins with empty userNov 18 10:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e  ;I' ossec13008ipFMail Recipient rejected2025-11-18 10:10:29 H=(localhost) [179.0.178.104]:63174 F= rejected RCPT : Nenhuma pessoa no endereço."179.0.178.1043469034U  -7' ossec13001ip2Exim Auth failed2025-11-18 10:10:09 dovecot_login authenticator failed for ([119.220.16.46]) [119.220.16.46]:56620: 535 Incorrect authentication data (set_id=envios)119.220.16.461835841   R8 )3  W' ossec9708iqXDovecot Aborted Login with empty userNov 18 10:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\2  -E' ossec13001iqExim Auth failed2025-11-18 10:14:01 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:51530: 535 Incorrect authentication data (set_id=comercial@inovasite.com)103.153.183.16252001+1  e/% ossec9710iqDovecot Auth failed on disconnected session.Nov 18 10:14:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.218358410 W' ossec9708ipDovecot Aborted Login with empty userNov 18 10:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034:/  eG+ ossec9710ipDovecot Auth failed on disconnected session.Nov 18 10:13:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<57SfOt5DNpiGx8nN>134.199.201.20562520013.  e;) ossec9710ipDovecot Auth failed on disconnected session.Nov 18 10:13:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<2bL3Od5DbLCl0xnK>165.211.25.2022233387'-  e#) ossec9710iqDovecot Auth failed on disconnected session.Nov 18 10:14:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251e, -U' ossec13001ipExim Auth failed2025-11-18 10:12:24 dovecot_login authenticator failed for (ministeriofernandabrum.com.br) [112.122.54.54]:19860: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991#+  e+ ossec9710ipDovecot Auth failed on disconnected session.Nov 18 10:13:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758Z*  -?) ossec13001ipExim Auth failed2025-11-18 10:12:43 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:47165: 535 Incorrect authentication data (set_id=recepcao)111.85.118.1471814991Y)  -C% ossec13001ipExim Auth failed2025-11-18 10:12:41 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59142: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758( W' ossec9708ipDovecot Aborted Login with empty userNov 18 10:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034{'  -' ossec13001ipExim Auth failed2025-11-18 10:12:07 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:52255: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)201.173.86.133996063&&  e!) ossec9710ipDovecot Auth failed on disconnected session.Nov 18 10:12:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841   P c')6 E  3G' ossec11301iqNew FTP connection.Nov 18 10:16:59 hosting pure-ftpd: (?@89.163.151.73) [INFO] New connection from 89.163.151.7389.163.151.732921044eD  -U) ossec13001iqExim Auth failed2025-11-18 10:16:33 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:40078: 535 Incorrect authentication data (set_id=andressa.financeiro)128.185.254.5412697509C  gG' ossec11307iqMultiple connection attempts from same sourceNov 18 10:16:23 hosting pure-ftpd: (?@46.62.209.187) [INFO] New connection from 46.62.209.18746.62.209.187660013{B  -' ossec13001iqExim Auth failed2025-11-18 10:16:09 dovecot_login authenticator failed for 111-70-23-252.emome-ip.hinet.net [111.70.23.252]:54295: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)111.70.23.2521668284 A  3G' ossec11301iqNew FTP connection.Nov 18 10:16:57 hosting pure-ftpd: (?@91.90.126.148) [INFO] New connection from 91.90.126.14891.90.126.1483703430&@  3O+ ossec11301iqNew FTP connection.Nov 18 10:16:42 hosting pure-ftpd: (?@176.125.229.137) [INFO] New connection from 176.125.229.137176.125.229.1373194884z?  -% ossec13001iqExim Auth failed2025-11-18 10:16:40 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:38546: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)103.90.27.831643084S>  -5% ossec13001iqExim Auth failed2025-11-18 10:16:36 dovecot_login authenticator failed for ([36.135.92.35]) [36.135.92.36]:47610: 535 Incorrect authentication data (set_id=contato)36.135.92.361814991_=  -K' ossec13001iqExim Auth failed2025-11-18 10:16:34 dovecot_login authenticator failed for ([122.139.16.200]) [119.51.252.26]:28060: 535 Incorrect authentication data (set_id=flavio.oliveira)119.51.252.261814991a<  s' ossec11321iqActive Response. FTP brute force attack (Port 21 is protected)Nov 18 10:16:17 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]46.62.209.187660013;  S' ossec211321iqPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 46.62.209.18746.62.209.187660013i:  -_' ossec13001iqExim Auth failed2025-11-18 10:16:03 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:50344: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)65.191.211.336252001=9 As' ossec11302iqFTP Authentication failed.Nov 18 10:15:50 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]46.62.209.187660013 8 3G' ossec11301iqNew FTP connection.Nov 18 10:15:45 hosting pure-ftpd: (?@46.62.209.187) [INFO] New connection from 46.62.209.18746.62.209.1876600137 W' ossec9708iqtDovecot Aborted Login with empty userNov 18 10:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346  k' ossec9709iq9Multiple Dovecot Aborted Logins with empty userNov 18 10:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]5  -G) ossec13001iq/Exim Auth failed2025-11-18 10:14:22 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:52126: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549)4  e') ossec9710iq*Dovecot Auth failed on disconnected session.Nov 18 10:14:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750 ? !0U  e7' ossec9710irDovecot Auth failed on disconnected session.Nov 18 10:17:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991iT  -a% ossec13001iqExim Auth failed2025-11-18 10:17:38 dovecot_plain authenticator failed for (quitiopars) [64.72.74.162]:37520: 535 Incorrect authentication data (set_id=design.user.support@inovasite.com)64.72.74.1626252001S  k' ossec9709iqMultiple Dovecot Aborted Logins with empty userNov 18 10:17:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034nR  -m# ossec13001iqExim Auth failed2025-11-18 10:17:28 dovecot_login authenticator failed for ([61.169.6.99]) [61.169.6.99]:39094: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)61.169.6.991814991Q  - + ossec13001iqExim Auth failed2025-11-18 10:17:50 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:38906: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)190.121.193.1263595528/P  e3+ ossec9710iqDovecot Auth failed on disconnected session.Nov 18 10:17:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758HO  -) ossec13001iqExim Auth failed2025-11-18 10:17:00 dovecot_login authenticator failed for ([210.182.73.132]) [210.182.73.132]:58401: 535 Incorrect authentication data210.182.73.1321835841\N  -A+ ossec13001iqExim Auth failed2025-11-18 10:16:56 dovecot_login authenticator failed for ([123.129.196.119]) [123.129.196.119]:51138: 535 Incorrect authentication data (set_id=adriana)123.129.196.1191814991#M  e' ossec9710iqDovecot Auth failed on disconnected session.Nov 18 10:16:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758@L  Is' ossec11331iq Stealth FTP brute force attackNov 18 10:16:33 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]46.62.209.1876600130K  e5) ossec9710iqDovecot Auth failed on disconnected session.Nov 18 10:16:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841J  3C% ossec11301iqNew FTP connection.Nov 18 10:16:42 hosting pure-ftpd: (?@212.97.69.12) [INFO] New connection from 212.97.69.12212.97.69.121522867I W' ossec9708iqDovecot Aborted Login with empty userNov 18 10:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034pH  -q# ossec13001iqExim Auth failed2025-11-18 10:16:16 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:51386: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)46.44.40.822017370 G 3G' ossec11301iqNew FTP connection.Nov 18 10:16:07 hosting pure-ftpd: (?@46.62.209.187) [INFO] New connection from 46.62.209.18746.62.209.187660013=F As' ossec11302iqFTP Authentication failed.Nov 18 10:16:07 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]46.62.209.187660013    1  4sd  -s' ossec13001ir+Exim Auth failed2025-11-18 10:18:33 dovecot_login authenticator failed for 67-216-150-67-216-150-69.cpe.sparklight.net [67.216.150.69]:43751: 535 Incorrect authentication data (set_id=financeiro)67.216.150.696252001c W' ossec9708ir)Dovecot Aborted Login with empty userNov 18 10:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[b  -C' ossec13001irExim Auth failed2025-11-18 10:18:19 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:53518: 535 Incorrect authentication data (set_id=atualizacoes)140.249.20.141814991ua  -s+ ossec13001irExim Auth failed2025-11-18 10:18:10 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:57382: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)180.188.143.1661819730+`  e/% ossec9710ir?Dovecot Auth failed on disconnected session.Nov 18 10:18:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<+xgITt5Dzs1zR+4E>115.71.238.41835841k_  -c' ossec13001ir5Exim Auth failed2025-11-18 10:18:44 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:43928: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)118.121.234.51814991'^  e%' ossec9710iqDovecot Auth failed on disconnected session.Nov 18 10:17:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822.]  e1) ossec9710ir Dovecot Auth failed on disconnected session.Nov 18 10:17:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<5BfUSt5DvtWB4kCN>129.226.64.1411819730g\  -Y) ossec13001iqExim Auth failed2025-11-18 10:17:08 dovecot_login authenticator failed for line161-37.adsl.kirov.ru [89.254.228.161]:51119: 535 Incorrect authentication data (set_id=flavio.oliveira)89.254.228.1612017370[  --# ossec13001ir Exim Auth failed2025-11-18 10:18:00 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43865: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)187.8.64.943469034jZ  -a' ossec13001irExim Auth failed2025-11-18 10:17:57 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:60650: 535 Incorrect authentication data (set_id=financeiro)90.230.168.262661886lY  -c) ossec13001irExim Auth failed2025-11-18 10:17:52 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:48154: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)182.227.214.331835841mX  -g' ossec13001iqExim Auth failed2025-11-18 10:17:29 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:46434: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)152.52.194.941269750cW  -O+ ossec13001ir Exim Auth failed2025-11-18 10:18:03 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:51204: 535 Incorrect authentication data (set_id=administrativo1)122.185.176.1261269750V  W' ossec9708ir Dovecot Aborted Login with empty userNov 18 10:18:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 SE i > G Q }M3NduR9QSzt  -) ossec13001irExim Auth failed2025-11-18 10:21:50 dovecot_login authenticator failed for (213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:56022: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)213.142.48.1432017370ds  -Q+ ossec13001irExim Auth failed2025-11-18 10:21:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:58375: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)165.154.121.2311605651r  W' ossec9708irDovecot Aborted Login with empty userNov 18 10:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q  k' ossec9709irMultiple Dovecot Aborted Logins with empty userNov 18 10:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kp  -_+ ossec13001irExim Auth failed2025-11-18 10:20:30 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55475: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)165.154.121.2311605651fo  -U+ ossec13001irExim Auth failed2025-11-18 10:20:08 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52289: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1413469034an  ;C% ossec13008iroMail Recipient rejected2025-11-18 10:19:41 H=(195.3.134.135) [179.0.178.53]:62685 F= rejected RCPT : No Such User Here179.0.178.533469034m W' ossec9708ireDovecot Aborted Login with empty userNov 18 10:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,l  e/' ossec9710ir]Dovecot Auth failed on disconnected session.Nov 18 10:19:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<7DXLT95DcodSczCz>82.115.48.1791522867Pk  -1# ossec13001irExim Auth failed2025-11-18 10:20:02 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:58158: 535 Incorrect authentication data (set_id=contato)218.76.73.41814991rj  -s% ossec13001irqExim Auth failed2025-11-18 10:19:44 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57934: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)85.19.195.123144096si -q) ossec13001ireExim Auth failed2025-11-18 10:19:31 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:62366: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)185.241.208.83798544'h  e%' ossec9710ir_Dovecot Auth failed on disconnected session.Nov 18 10:19:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001Xg  -;) ossec13001irWExim Auth failed2025-11-18 10:19:19 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:32066: 535 Incorrect authentication data (set_id=rafael)67.213.230.1226252001Vf  -9' ossec13001irExim Auth failed2025-11-18 10:18:18 dovecot_login authenticator failed for ([121.129.34.91]) [121.129.34.91]:56324: 535 Incorrect authentication data (set_id=contato)121.129.34.911835841]e  -G' ossec13001irExim Auth failed2025-11-18 10:18:17 dovecot_login authenticator failed for ([219.128.55.94]) [219.128.55.94]:33749: 535 Incorrect authentication data (set_id=isabellylisboa)219.128.55.941814991 4 y _ 7 M \^De0;Tb4*  e)) ossec9710iskDovecot Auth failed on disconnected session.Nov 18 10:23:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750n  -o# ossec13001iscExim Auth failed2025-11-18 10:23:47 dovecot_login authenticator failed for (95.3.36.154.static.ttnet.com.tr) [95.3.36.154]:37918: 535 Incorrect authentication data (set_id=vendas@arkson.com.br)95.3.36.154298795c  -O+ ossec13001is]Exim Auth failed2025-11-18 10:23:40 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:40658: 535 Incorrect authentication data (set_id=isabellylisboa)177.236.145.1883996063q  -k+ ossec13001isMExim Auth failed2025-11-18 10:23:25 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:51738: 535 Incorrect authentication data (set_id=financeiro)128.185.228.13412697501~  e=# ossec9710is!Dovecot Auth failed on disconnected session.Nov 18 10:22:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483[}  -A) ossec13001isExim Auth failed2025-11-18 10:22:39 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:43636: 535 Incorrect authentication data (set_id=sec.geral)121.73.163.2502186224| W' ossec9708isDovecot Aborted Login with empty userNov 18 10:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+fRAW95DTqGxV3kv>177.87.121.473469034z{  -' ossec13001isExim Auth failed2025-11-18 10:22:24 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:47256: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)208.96.233.676251999mz  -o! ossec13001isExim Auth failed2025-11-18 10:22:21 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:37008: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)89.67.37.2798544fy  -[% ossec13001is Exim Auth failed2025-11-18 10:22:15 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42832: 535 Incorrect authentication data (set_id=atualizacoes)81.16.164.762661886$x  e) ossec9710is9Dovecot Auth failed on disconnected session.Nov 18 10:23:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387w W' ossec9708irDovecot Aborted Login with empty userNov 18 10:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Uv  ;+% ossec13008irMail Recipient rejected2025-11-18 10:21:13 H=(195.3.134.135) [179.0.178.53]:64843 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:64843 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034*u  e/# ossec9710irDovecot Auth failed on disconnected session.Nov 18 10:21:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001   4,C)  e%+ ossec9710isDovecot Auth failed on disconnected session.Nov 18 10:25:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822)  e-# ossec9710isDovecot Auth failed on disconnected session.Nov 18 10:25:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=148.113.4.51269750e  -U+ ossec13001isExim Auth failed2025-11-18 10:25:07 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:56085: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795j  -a' ossec13001isExim Auth failed2025-11-18 10:24:57 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:51108: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)88.84.209.1462017370 W' ossec9708isDovecot Aborted Login with empty userNov 18 10:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_  -G+ ossec13001is{Exim Auth failed2025-11-18 10:24:11 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51586: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1413469034X  -;) ossec13001isyExim Auth failed2025-11-18 10:24:08 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:52183: 535 Incorrect authentication data (set_id=vendas)111.59.206.2241814991&  e%% ossec9710isDovecot Auth failed on disconnected session.Nov 18 10:24:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841q  -o' ossec13001isExim Auth failed2025-11-18 10:24:47 dovecot_login authenticator failed for (pool-176-226-163-5.is74.ru) [176.226.163.5]:54658: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)176.226.163.52017370Z  -A' ossec13001isExim Auth failed2025-11-18 10:24:44 dovecot_login authenticator failed for ([218.22.187.67]) [218.22.187.66]:57023: 535 Incorrect authentication data (set_id=aureovieira)218.22.187.661814991_  -O# ossec13001isyExim Auth failed2025-11-18 10:24:09 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:51394: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)46.44.40.822017370  k' ossec9709isUMultiple Dovecot Aborted Logins with empty userNov 18 10:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   -!% ossec13001isMExim Auth failed2025-11-18 10:23:25 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:37035: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)59.99.153.211269750`  -M' ossec13001isMExim Auth failed2025-11-18 10:23:24 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49159: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)123.58.215.721819730  W' ossec9708issDovecot Aborted Login with empty userNov 18 10:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 *6  , *X!  -9+ ossec13001isExim Auth failed2025-11-18 10:26:19 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:51840: 535 Incorrect authentication data (set_id=contato)211.169.212.2061835841  W' ossec9708it'Dovecot Aborted Login with empty userNov 18 10:27:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<44RZa95DHLuxV3kv>177.87.121.473469034\  -I% ossec13001itExim Auth failed2025-11-18 10:26:50 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:54346: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758|  -+ ossec13001itExim Auth failed2025-11-18 10:26:44 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1113: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)186.179.100.1293686110t  -u' ossec13001itExim Auth failed2025-11-18 10:26:31 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:50787: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)46.212.39.2013144096|  -) ossec13001isExim Auth failed2025-11-18 10:25:53 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:47438: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)136.53.199.1606252001`  -K) ossec13001isExim Auth failed2025-11-18 10:25:44 dovecot_login authenticator failed for (static.khi77.pie.net.pk) [221.120.201.11]:52869: 535 Incorrect authentication data (set_id=leandro)221.120.201.111168579j  -_) ossec13001isExim Auth failed2025-11-18 10:25:13 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:35289: 535 Incorrect authentication data (set_id=aureovieira)212.225.255.822510769/  e3) ossec9710isDovecot Auth failed on disconnected session.Nov 18 10:25:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<8scfZt5DpJt2wSaf>118.193.38.1591819730   -) ossec13001isExim Auth failed2025-11-18 10:25:29 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:49218: 535 Incorrect authentication data (set_id=leandro@eloempresas.com)182.70.122.2451269750g  -[' ossec13001isExim Auth failed2025-11-18 10:25:13 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:33705: 535 Incorrect authentication data (set_id=eduardo)119.46.148.5316056513  e;) ossec9710isDovecot Auth failed on disconnected session.Nov 18 10:25:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730l  -c) ossec13001isExim Auth failed2025-11-18 10:25:40 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:38214: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)182.95.222.1781269750 W' ossec9708isDovecot Aborted Login with empty userNov 18 10:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Z  -A' ossec13001isExim Auth failed2025-11-18 10:25:30 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:59177: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)103.153.183.16252001h  -]' ossec13001isExim Auth failed2025-11-18 10:26:07 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:34978: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)182.66.214.701269750 L k > 7TtZ/,L\0  -C) ossec13001itgExim Auth failed2025-11-18 10:28:07 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:42518: 535 Incorrect authentication data (set_id=novamanha)182.95.225.1141269750/  - ) ossec13001itSExim Auth failed2025-11-18 10:27:47 dovecot_login authenticator failed for broadband-188-32-104-175.ip.moscow.rt.ru [188.32.104.175]:60566: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)188.32.104.1752017370'.  e%' ossec9710itKDovecot Auth failed on disconnected session.Nov 18 10:27:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841- W' ossec9708itEDovecot Aborted Login with empty userNov 18 10:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9bEWbd5DsMixV3kv>177.87.121.473469034\,  -C) ossec13001it=Exim Auth failed2025-11-18 10:27:24 dovecot_login authenticator failed for ([157.230.66.74]) [137.184.193.67]:57710: 535 Incorrect authentication data (set_id=alex.vendas)137.184.193.676252001_+  -K' ossec13001it\Exim Auth failed2025-11-18 10:27:54 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:33401: 535 Incorrect authentication data (set_id=desenvolvimento2)116.114.97.101814991Y*  -?' ossec13001itIExim Auth failed2025-11-18 10:27:36 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:44416: 535 Incorrect authentication data (set_id=financeiro)186.5.178.2293865483u)  -y% ossec13001it=Exim Auth failed2025-11-18 10:27:24 dovecot_login authenticator failed for (22.69.85.194.in-addr.arpa) [194.85.69.22]:57746: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)194.85.69.222017370-(  e/) ossec9710it;Dovecot Auth failed on disconnected session.Nov 18 10:27:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044)'  e)' ossec9710it7Dovecot Auth failed on disconnected session.Nov 18 10:27:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001+&  e-' ossec9710it3Dovecot Auth failed on disconnected session.Nov 18 10:27:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001*%  e-% ossec9710itgDovecot Auth failed on disconnected session.Nov 18 10:28:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841d$  -Q+ ossec13001it#Exim Auth failed2025-11-18 10:26:59 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:55264: 535 Incorrect authentication data (set_id=administrativo1)177.236.145.1883996063#  k' ossec9709it Multiple Dovecot Aborted Logins with empty userNov 18 10:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)"  e') ossec9710itDovecot Auth failed on disconnected session.Nov 18 10:26:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841 6 c I [[NkD6  W' ossec9708itDovecot Aborted Login with empty userNov 18 10:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034=  - ' ossec13001itExim Auth failed2025-11-18 10:30:01 dovecot_login authenticator failed for pppoe-78-111-249-76.dynamic.tvingo.ru [78.111.249.76]:40242: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)78.111.249.762017370-<  e-+ ossec9710itDovecot Auth failed on disconnected session.Nov 18 10:29:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.15418149917;  eE' ossec9710itDovecot Auth failed on disconnected session.Nov 18 10:28:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822h:  -[) ossec13001itExim Auth failed2025-11-18 10:28:44 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:59526: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)103.248.30.2051269750_9 -G) ossec13001itExim Auth failed2025-11-18 10:28:37 dovecot_login authenticator failed for (User) [177.74.174.120]:54404: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)177.74.174.1203469034 8  -' ossec13001itExim Auth failed2025-11-18 10:29:07 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (courni) [73.144.27.228]:42512: 535 Incorrect authentication data (set_id=design.user.admin@inovasite.com)73.144.27.2286252001|7  -) ossec13001itExim Auth failed2025-11-18 10:29:05 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:50204: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)107.175.76.1466252001j6  -e# ossec13001itExim Auth failed2025-11-18 10:28:59 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:20676: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)61.37.150.618358415 W' ossec9708itDovecot Aborted Login with empty userNov 18 10:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034-4  e-+ ossec9710itiDovecot Auth failed on disconnected session.Nov 18 10:28:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<5Rwyb95DJvtxoZB3>113.161.144.119156282223  e=% ossec9710it`Dovecot Auth failed on disconnected session.Nov 18 10:27:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001,2  e++ ossec9710itEDovecot Auth failed on disconnected session.Nov 18 10:27:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.20418358411  -' ossec13001it/Exim Auth failed2025-11-18 10:27:11 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:60634: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)149.210.37.16390903 z*4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z 4 R H > * p f \   bXvl:0&ND|rh^"TJ@6,xF<2ndZP (j`~tLB8.V$\RH>4zpf | r h ^ T J @ 6 , "    x n d Z Pz*  vlbXND:0& ix,D ix,C iw,B iw,A iw,@ ix ,= ix,< ix,? ix ,> iw,; iw,: iw,9 iw,8 iw,7 iw,6 iw,5 iw,4 iw,3 iw,2 iw,1 iw,0 iw,/ iw,. iw,- iw,, iw,+ iw,* iw,) iwz,( iw,' iwH,& iwB,% iwX,$ iwT,# iwP," iw,,! iw*, iw(, iw$, iw , iw , iw, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, iv, ivt, ivp, ivb, iv`, iv^, ivR, iv, ivn, ivL, iv"+ iv + iv8+ iv2+ iv&+ iv+ iv+ ivF+ ivD+ iv@+ iv>+ iv$+ iv+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iu+ iuz+ iur+ iuj+ iuh+ iub+ iuZ+ iu+ iuj+ iu*+ iu&+ iuJ+ iuF+ iu@+ iu6+ iu.+ iu:+ iu"+ iuR+ iuB+ iu:+ it+ iu+ iu+ it+ it+ it+ iu+ iu+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ it+ iti+ itg+ itg+ it`+ it\+ itS+ itK+ itI+ itE+ itE+ it=+ it=+ it;+ it7+ it3+ it/+ it'+ it#+ it+ it+ it + it+ it+ is+ is+ is+ is+ is+ is+ is+ iq+M iq+J iq+@ iq+? iq+> iq+L iq+I iq+D iy,k iy,h ix,g ix,f ix,j ix,e ix,i ix,a ix,` ix,_ ix,d ix,^ ix,] ix,c ix,b ix,X ix,W ix,V ix,U ixu,\ ixj,[ ixh,T ixh,S ixf,Z ixd,Y ix^,E ixZ,M ixV,R ixR,J ixP,I ixL,Q ixF,L ixD,P ix@,O ix@,H ix<,K ix<,G ix.,N ix.,F is+ is+ is+ is+ is+ is+ is+ is+ is+ is+ is+ is+ is+ is{+ isy+ isy+ iss+ isk+ isc+ is]+ isU+ isM+ isM+ isM+ is9+x is!+~ is+} is+| is+{ is+z is +y ir+u ir+t ir+s ir+w ir+v ir+r ir+q ir+p ir+o ir+k irq+j( iy-,l iro+n ire+m ire+i ir_+h ir]+l irW+g ir?+` ir5+_ ir++d ir)+c ir+b ir+f ir+e ir+a ir +W ir +V ir +] ir +[ ir+Z ir+U ir+Y iq+Q iq+T iq+P iq+S iq+X iq+^ iq+R iq+\ iq+O iq+E iq+K iq+A iq+N 2   1  (N  e#+ ossec9710itDovecot Auth failed on disconnected session.Nov 18 10:30:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001mM  -e) ossec13001iuExim Auth failed2025-11-18 10:30:56 dovecot_login authenticator failed for ([95.221.232.167]) [95.221.232.167]:52768: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)95.221.232.1672017370~L  -) ossec13001iuExim Auth failed2025-11-18 10:30:44 dovecot_login authenticator failed for (static-200-85-150173.vnet.bo) [200.85.150.173]:48852: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)200.85.150.1733923057ZK  -?) ossec13001itExim Auth failed2025-11-18 10:30:23 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:43338: 535 Incorrect authentication data (set_id=recepcao)173.245.250.166252001#J  e% ossec9710itDovecot Auth failed on disconnected session.Nov 18 10:30:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=8.137.123.3618149913I e9) ossec9710itDovecot Auth failed on disconnected session.Nov 18 10:30:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044`H  -I+ ossec13001iuExim Auth failed2025-11-18 10:31:04 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:45169: 535 Incorrect authentication data (set_id=vendas.luiz)186.179.253.2423382998lG  -e' ossec13001iuExim Auth failed2025-11-18 10:30:57 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:50928: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)125.20.253.861269750F W' ossec9708itDovecot Aborted Login with empty userNov 18 10:30:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034E  k' ossec9709itMultiple Dovecot Aborted Logins with empty userNov 18 10:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034ZD  -A' ossec13001itExim Auth failed2025-11-18 10:29:17 dovecot_login authenticator failed for ([218.56.121.58]) [221.2.140.230]:59538: 535 Incorrect authentication data (set_id=vendas.luiz)221.2.140.2301814991|C  - % ossec13001itExim Auth failed2025-11-18 10:29:30 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:41001: 535 Incorrect authentication data (set_id=flavio.oliveira)195.62.50.36298795B W+ ossec9708itDovecot Aborted Login with empty userNov 18 10:29:21 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=216.238.113.1763469034]A  -E) ossec13001itExim Auth failed2025-11-18 10:29:19 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:49737: 535 Incorrect authentication data (set_id=aureovieira)222.101.241.441835841i@  -_' ossec13001itExim Auth failed2025-11-18 10:29:15 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:34227: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)45.194.15.2281168579 +   "@+V^  -9' ossec13001iubExim Auth failed2025-11-18 10:32:16 dovecot_login authenticator failed for ([121.164.164.9]) [121.164.164.9]:49819: 535 Incorrect authentication data (set_id=contato)121.164.164.91835841l]  -c) ossec13001iuZExim Auth failed2025-11-18 10:32:08 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:50879: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)121.134.31.1931835841\  W' ossec9708iuDovecot Aborted Login with empty userNov 18 10:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.[  e1) ossec9710iujDovecot Auth failed on disconnected session.Nov 18 10:32:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<2dBoft5DkKikXLll>164.92.185.1012921044^Z  -Q! ossec13001iu*Exim Auth failed2025-11-18 10:31:21 dovecot_plain authenticator failed for (caliting) [5.32.107.6]:54290: 535 Incorrect authentication data (set_id=design.user.ceo@inovasite.com)5.32.107.6290557gY  -]% ossec13001iu&Exim Auth failed2025-11-18 10:31:16 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:34755: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)61.72.58.2421835841YX  -?' ossec13001iuJExim Auth failed2025-11-18 10:31:52 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:43322: 535 Incorrect authentication data (set_id=sec.geral)125.19.188.981269750|W  -) ossec13001iuFExim Auth failed2025-11-18 10:31:48 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:32526: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)75.152.225.1546251999XV  -;) ossec13001iu@Exim Auth failed2025-11-18 10:31:42 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:34114: 535 Incorrect authentication data (set_id=xavier)106.245.246.261835841U W' ossec9708iu6Dovecot Aborted Login with empty userNov 18 10:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -' ossec13001iu.Exim Auth failed2025-11-18 10:31:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (posint) [87.103.126.54]:32245: 535 Incorrect authentication data (set_id=design.user.ceo@inovasite.com)87.103.126.542264397}S  -) ossec13001iu:Exim Auth failed2025-11-18 10:31:36 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:46184: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)103.29.185.1621643084)R  e%+ ossec9710iu"Dovecot Auth failed on disconnected session.Nov 18 10:31:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<6c0Uet5DGsRrhr+5>107.134.191.1856252001gQ  -]% ossec13001iuRExim Auth failed2025-11-18 10:32:00 dovecot_login authenticator failed for ([61.74.212.17]) [61.74.212.17]:1769: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)61.74.212.171835841lP  -c) ossec13001iuBExim Auth failed2025-11-18 10:31:45 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.238]:14659: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)210.206.24.2381835841O  -') ossec13001iu:Exim Auth failed2025-11-18 10:31:36 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:40123: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)50.187.155.1306252001  fL`7TdblVm  -;' ossec13001iuExim Auth failed2025-11-18 10:34:51 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:32885: 535 Incorrect authentication data (set_id=recepcao)46.30.161.197690791Vl  -7) ossec13001iuExim Auth failed2025-11-18 10:34:44 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:35714: 535 Incorrect authentication data (set_id=info)221.165.172.381835841rk  -q' ossec13001iuExim Auth failed2025-11-18 10:34:40 dovecot_login authenticator failed for 110-25-88-184.adsl.fetnet.net [110.25.88.184]:59250: 535 Incorrect authentication data (set_id=envios@comercial.art.br)110.25.88.1841668284~j  - ' ossec13001iuExim Auth failed2025-11-18 10:34:37 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:35203: 535 Incorrect authentication data (set_id=info@cartoriopinheirinho.com.br)103.51.26.1981269750li  -c) ossec13001iuExim Auth failed2025-11-18 10:34:32 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:26446: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)111.61.176.2441814991_h -E+ ossec13001iuExim Auth failed2025-11-18 10:34:17 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52068: 535 Incorrect authentication data (set_id=contato@asscar.com.br)181.191.136.1413469034%g  e!' ossec9710iuDovecot Auth failed on disconnected session.Nov 18 10:33:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001hf  -[) ossec13001iuExim Auth failed2025-11-18 10:33:11 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:58391: 535 Incorrect authentication data (set_id=info)35.130.111.1466252001e W' ossec9708iuDovecot Aborted Login with empty userNov 18 10:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690342d  e7+ ossec9710iuDovecot Auth failed on disconnected session.Nov 18 10:33:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001oc  -m% ossec13001iuExim Auth failed2025-11-18 10:32:48 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:41000: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)85.19.195.123144096(b  e#+ ossec9710iuzDovecot Auth failed on disconnected session.Nov 18 10:32:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841a  k' ossec9709iurMultiple Dovecot Aborted Logins with empty userNov 18 10:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034s`  -q) ossec13001iujExim Auth failed2025-11-18 10:32:24 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:36716: 535 Incorrect authentication data (set_id=compras)177.22.122.1543469034'_  e)# ossec9710iuhDovecot Auth failed on disconnected session.Nov 18 10:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483 |-  0+5iF\|\}  -C) ossec13001iv8Exim Auth failed2025-11-18 10:35:51 dovecot_login authenticator failed for ([185.15.189.232]) [185.15.189.232]:44208: 535 Incorrect authentication data (set_id=assessoria)185.15.189.2322017370f|  -[% ossec13001iv2Exim Auth failed2025-11-18 10:35:45 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:48030: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)102.53.15.562542007{  k' ossec9709iv&Multiple Dovecot Aborted Logins with empty userNov 18 10:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Hz  -) ossec13001ivExim Auth failed2025-11-18 10:35:12 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:38465: 535 Incorrect authentication data60.172.230.1841814991ry  -u# ossec13001ivExim Auth failed2025-11-18 10:35:11 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:9526: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)58.27.253.61168579hx  -Y+ ossec13001ivFExim Auth failed2025-11-18 10:36:05 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:65145: 535 Incorrect authentication data (set_id=assessoria)207.200.180.1746252001w  W' ossec9708ivDDovecot Aborted Login with empty userNov 18 10:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Yv  -C% ossec13001iv@Exim Auth failed2025-11-18 10:36:00 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63835: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758Vu  -7) ossec13001iv>Exim Auth failed2025-11-18 10:35:56 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:65296: 535 Incorrect authentication data (set_id=info)111.61.177.1871814991)t  e') ossec9710iv$Dovecot Auth failed on disconnected session.Nov 18 10:35:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730fs  -W) ossec13001ivExim Auth failed2025-11-18 10:35:04 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60260: 535 Incorrect authentication data (set_id=info)103.29.185.1621643084ir  -a% ossec13001iuExim Auth failed2025-11-18 10:34:44 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:38894: 535 Incorrect authentication data (set_id=info@deproi.com.br)121.18.49.141814991rq  -m+ ossec13001iuExim Auth failed2025-11-18 10:34:40 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:47718: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)197.219.228.2421036973p W' ossec9708iuDovecot Aborted Login with empty userNov 18 10:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.o  e5% ossec9710iuDovecot Auth failed on disconnected session.Nov 18 10:34:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991On  -/# ossec13001iuExim Auth failed2025-11-18 10:34:54 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:44612: 535 Incorrect authentication data (set_id=envios)46.8.245.342017370 &3 V &  !G-/  e5' ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:37:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<5lx0kd5D8I0tPZWl>45.61.149.1656252001 W' ossec9708ivDovecot Aborted Login with empty userNov 18 10:37:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -9' ossec13001ivExim Auth failed2025-11-18 10:37:07 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:42252: 535 Incorrect authentication data (set_id=contato)186.239.41.743469034g  -W+ ossec13001ivExim Auth failed2025-11-18 10:37:05 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:54698: 535 Incorrect authentication data (set_id=info@deproi.com.br)103.194.243.1871269750d  -S) ossec13001ivtExim Auth failed2025-11-18 10:36:51 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:45024: 535 Incorrect authentication data (set_id=info@deproi.com.br)221.167.21.1481835841Y  -;+ ossec13001ivpExim Auth failed2025-11-18 10:36:47 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:46753: 535 Incorrect authentication data (set_id=info)121.142.146.1671835841 W' ossec9708ivbDovecot Aborted Login with empty userNov 18 10:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r  -s% ossec13001iv`Exim Auth failed2025-11-18 10:36:30 dovecot_login authenticator failed for ([121.128.76.108]) [211.196.31.2]:41259: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)211.196.31.21835841m  -c+ ossec13001iv^Exim Auth failed2025-11-18 10:36:29 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:50502: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)218.149.235.1521835841"  e% ossec9710ivRDovecot Auth failed on disconnected session.Nov 18 10:36:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<1UkzjN5DXq0vT1jH>47.79.88.1991861060*  e-% ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:37:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841,  e/' ossec9710ivnDovecot Auth failed on disconnected session.Nov 18 10:36:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001Y  -=) ossec13001ivLExim Auth failed2025-11-18 10:36:11 dovecot_login authenticator failed for (pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:38822: 535 Incorrect authentication data181.192.79.1793865483o  -i) ossec13001iv"Exim Auth failed2025-11-18 10:35:29 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:47780: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)218.28.168.1901814991V~  -7) ossec13001iv Exim Auth failed2025-11-18 10:35:26 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:51408: 535 Incorrect authentication data (set_id=info)118.45.101.1591835841 B \B W' ossec9708iwDovecot Aborted Login with empty userNov 18 10:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1MYEmN5Dxo+xV3kv>177.87.121.473469034(  e+# ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:38:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483|  -' ossec13001ivExim Auth failed2025-11-18 10:38:30 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:59776: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)41.59.202.241149590.  e/+ ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:39:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.18562520014  e?' ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:38:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001a  -M) ossec13001ivExim Auth failed2025-11-18 10:38:45 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:32850: 535 Incorrect authentication data (set_id=paulinho.vendas)125.19.154.1581269750  k' ossec9709ivMultiple Dovecot Aborted Logins with empty userNov 18 10:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034r  -q' ossec13001ivExim Auth failed2025-11-18 10:38:24 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:59454: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)95.181.244.442017370  W' ossec9708ivDovecot Aborted Login with empty userNov 18 10:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034V  -7) ossec13001ivExim Auth failed2025-11-18 10:38:40 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:45602: 535 Incorrect authentication data (set_id=info)192.34.128.2026252001p  -o% ossec13001ivExim Auth failed2025-11-18 10:37:27 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:51974: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)84.211.19.1231440960  e9% ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:37:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001Y  -;+ ossec13001ivExim Auth failed2025-11-18 10:37:17 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:56722: 535 Incorrect authentication data (set_id=info)169.211.232.1821835841i  -]) ossec13001ivExim Auth failed2025-11-18 10:37:51 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:61259: 535 Incorrect authentication data (set_id=contato)223.197.166.781819730'  e#) ossec9710ivDovecot Auth failed on disconnected session.Nov 18 10:37:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750 !  *  -!+ ossec13001iwExim Auth failed2025-11-18 10:41:42 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:50644: 535 Incorrect authentication data (set_id=info@educacionalevangelico.com.br)122.187.228.2311269750b)  -O) ossec13001iwExim Auth failed2025-11-18 10:41:36 dovecot_login authenticator failed for (17.64.uzpak.uz) [213.230.124.17]:56192: 535 Incorrect authentication data (set_id=info@1075fm.com.br)213.230.124.1715124401(  e;' ossec9710iwzDovecot Auth failed on disconnected session.Nov 18 10:41:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758'  W' ossec9708iwDovecot Aborted Login with empty userNov 18 10:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i&  -_' ossec13001iwHExim Auth failed2025-11-18 10:40:24 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:52458: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)103.174.34.491269750y%  -{+ ossec13001iwBExim Auth failed2025-11-18 10:40:17 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:33303: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)200.216.172.1823469034Y$  -=) ossec13001iwXExim Auth failed2025-11-18 10:40:39 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:36132: 535 Incorrect authentication data (set_id=adriana)128.185.214.781269750[#  -E% ossec13001iwTExim Auth failed2025-11-18 10:40:36 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:38994: 535 Incorrect authentication data (set_id=info)85.19.195.123144096" W' ossec9708iwPDovecot Aborted Login with empty userNov 18 10:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034M!  -+# ossec13001iw,Exim Auth failed2025-11-18 10:39:56 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:48892: 535 Incorrect authentication data (set_id=info)103.55.89.51269750.  e5% ossec9710iw*Dovecot Auth failed on disconnected session.Nov 18 10:39:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<4ecimd5DCe13xBIC>119.196.18.21835841) e+% ossec9710iw(Dovecot Auth failed on disconnected session.Nov 18 10:39:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103%  e#% ossec9710iw$Dovecot Auth failed on disconnected session.Nov 18 10:39:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=111.0.75.1651814991x  -' ossec13001iw Exim Auth failed2025-11-18 10:39:44 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40774: 535 Incorrect authentication data (set_id=info@letracaixa.art.br)41.59.202.241149590_  -G+ ossec13001iw Exim Auth failed2025-11-18 10:39:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51900: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)181.191.136.1413469034 ctgZM@3& }pc |obUH;.!xk^QD7*~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730x 1819730h 1819730U 18197308 18197306 1819730 1819730 1819730 1819730 1819730 1819730 1819730b 1819730_ 1819730' 1819730_ 1819730E 1819730 1819730 1819730 1819730 1819730 1819730 1819730t 1819730n 1819730R 1819730C 1819730A 18197307 1819730% 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730e 1819730d 1819730V 1819730I 1819730- 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730y 1819730q 1819730l 1819730b 1819730` 1819730: 1819730+ 1819730 1819730 1819730 1819730 1819730w 1819730^ 1819730Y 18197302 1819730! 1819730% 1819730% 1819730%} 1819730%s 1819730%I 1819730% 1819730% 1819730$ 1819730$ 1819730$ 1819730$A 1819730$> 1819730$) 1819730$' 1819730# 1819730# 1819730# 1819730# 1819730# 1819730# 1819730# 1819730#W 1819730#N 1819730# 1819730" 1819730" 1819730" 1819730" 1819730" 1819730" 1819730" 1819730"t 1819730"j 1819730"O 1819730"H 1819730"- 1819730"" 1819730! 1819730! 1819730! 1819730! 1819730!c 1819730!W 1819730!S 1819730!D 1819730!> 1819730!7 1819730! 1819730 1819730 1819730 1819730 r 1819730 d 1819730 X 1819730  1819730 1819730 1819730 1819730 1819730r 1819730T 1819730D 18197308 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730u 1819730n 1819730e 1819730` 1819730T 1819730& 1819730 1819730 1819730 1819730 1819730 1819730t 1819730g 1819730J 1819730 1819730 1819730 1819730 1819730 1819730 1819730v 1819730E 1819730D 1819730= 1819730: 1819730! 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730B 18197306 18197301 1819730+ 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730q 1819730p 1819730b #: o9  -i) ossec13001iwExim Auth failed2025-11-18 10:42:51 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:41965: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)182.151.45.1361814991k8  -a) ossec13001iwExim Auth failed2025-11-18 10:42:23 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:50990: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)111.61.176.2451814991m7  -e) ossec13001iwExim Auth failed2025-11-18 10:42:52 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:49177: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)161.153.13.1536252001i6  -[+ ossec13001iwExim Auth failed2025-11-18 10:42:37 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:52135: 535 Incorrect authentication data (set_id=info)223.197.145.1261819730W5  -?# ossec13001iwExim Auth failed2025-11-18 10:42:34 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:38846: 535 Incorrect authentication data (set_id=info)60.8.73.17418149914 W' ossec9708iwDovecot Aborted Login with empty userNov 18 10:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[3  -G# ossec13001iwExim Auth failed2025-11-18 10:42:23 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:38354: 535 Incorrect authentication data (set_id=info@deproi.com.br)103.55.89.5126975092  eG) ossec9710iwDovecot Auth failed on disconnected session.Nov 18 10:42:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750/1  e5' ossec9710iwDovecot Auth failed on disconnected session.Nov 18 10:43:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991j0  -c) ossec13001iwExim Auth failed2025-11-18 10:41:54 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:53562: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)196.216.81.12649518o/  -i) ossec13001iwExim Auth failed2025-11-18 10:41:52 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:59425: 535 Incorrect authentication data (set_id=info)187.237.47.2143996063.  k' ossec9709iwMultiple Dovecot Aborted Logins with empty userNov 18 10:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034--  e/) ossec9710iwDovecot Auth failed on disconnected session.Nov 18 10:41:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841e,  -W' ossec13001iwExim Auth failed2025-11-18 10:42:04 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44078: 535 Incorrect authentication data (set_id=info)76.132.238.436252001Y+  -;+ ossec13001iwExim Auth failed2025-11-18 10:41:51 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:53986: 535 Incorrect authentication data (set_id=info)121.160.166.1611835841 o#  ( N i T_fL3:CRo_I  -O' ossec13001ixPExim Auth failed2025-11-18 10:44:48 dovecot_plain authenticator failed for (bacter) [65.20.143.159]:45603: 535 Incorrect authentication data (set_id=neemias.piler@arkson.com.br)65.20.143.15999237mH  -g' ossec13001ix@Exim Auth failed2025-11-18 10:44:31 dovecot_login authenticator failed for ([61.150.11.135]) [61.150.11.135]:34789: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)61.150.11.1351814991sG  -o+ ossec13001ix<Exim Auth failed2025-11-18 10:44:27 dovecot_login authenticator failed for ([119.205.188.194]) [119.205.188.194]:51876: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)119.205.188.1941835841uF  -y) ossec13001ix.Exim Auth failed2025-11-18 10:44:14 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:45542: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)185.255.47.19099237E  W' ossec9708ix^Dovecot Aborted Login with empty userNov 18 10:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034D W' ossec9708ixDovecot Aborted Login with empty userNov 18 10:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7IpTpt5D3JaxV3kv>177.87.121.473469034uC  -u) ossec13001ixExim Auth failed2025-11-18 10:43:28 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:40830: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)152.52.236.1581269750qB UE' ossec11001iwDeferred login on the cpanel service[2025-11-18 10:43:18 -0300] info [webmaild] 179.130.88.46 - rh@contabilidadefollador.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing179.130.88.463469034.A  e3' ossec9710iwDovecot Auth failed on disconnected session.Nov 18 10:43:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822_@  -I) ossec13001iwExim Auth failed2025-11-18 10:43:10 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:56392: 535 Incorrect authentication data (set_id=atualizacoes1)220.72.159.2301835841a?  -O' ossec13001ixExim Auth failed2025-11-18 10:43:49 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:41770: 535 Incorrect authentication data (set_id=info@deproi.com.br)41.216.169.122328926V>  -9' ossec13001ix Exim Auth failed2025-11-18 10:43:40 dovecot_login authenticator failed for ([220.192.75.11]) [220.192.75.11]:38740: 535 Incorrect authentication data (set_id=adriana)220.192.75.111814991Y=  -;+ ossec13001ix Exim Auth failed2025-11-18 10:44:00 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:37339: 535 Incorrect authentication data (set_id=info)123.129.245.2491814991s<  -u% ossec13001ixExim Auth failed2025-11-18 10:43:54 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:59434: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)14.203.9.1302077456#;  e% ossec9710iwDovecot Auth failed on disconnected session.Nov 18 10:43:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060Y:  -=) ossec13001iwExim Auth failed2025-11-18 10:43:07 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:45994: 535 Incorrect authentication data (set_id=contato)122.185.145.541269750 Y |obUH;.!sfYui]PC6)~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1880251/} 1880251/2 1880251. 2017370C 2017370< 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370b 2017370] 2017370I 2017370; 2017370 2017370 2017370 2017370 2017370z 2017370j 2017370B 192950)w 192950x 1929502 192950 192950 192950 $ 192950 192950h 192950E 1880251. 1880251. 1880251- 1880251- 1880251-z 1880251-Q 1880251, 1880251, 1880251, 1880251+- 1880251+" 1880251*C 1880251) 1880251) 1880251) 1880251(d 1880251& 1880251% 1880251%l 1880251$ 1880251$ 1880251#7 1880251" 2017370 K 2017370 @ 2017370 3 2017370 $ 2017370  2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 } 2017370 y 2017370 2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 t 2017370 s 2017370 I 2017370 C 2017370 < 2017370 : 2017370 9 2017370 * 2017370 " 2017370 ! 2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370o 2017370m 2017370Z 2017370T 2017370B 2017370> 20173708 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370y 2017370r 2017370h 2017370J 2017370' 2017370 2017370 2017370 2017370 2017370 2017370 2017370l 2017370k 2017370U 20173702 2017370, 2017370( 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370} 2017370` 2017370J 2017370& 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370S 2017370O 2017370J 2017370I 20173704 2017370/ 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370s 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370z 2017370q 2017370b 2017370L 2017370I 2017370F * 6 = Y 6  yX  -' ossec13001ixExim Auth failed2025-11-18 10:45:46 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:50560: 535 Incorrect authentication data (set_id=financeiro)92.255.190.692017370+W  e-' ossec9710ixDovecot Auth failed on disconnected session.Nov 18 10:45:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991ZV  -C% ossec13001ixExim Auth failed2025-11-18 10:45:41 dovecot_login authenticator failed for ([112.6.11.184]) [112.6.11.184]:57238: 535 Incorrect authentication data (set_id=isabellylisboa)112.6.11.1841814991U W' ossec9708ixDovecot Aborted Login with empty userNov 18 10:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034sT  -u% ossec13001ixhExim Auth failed2025-11-18 10:45:12 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:50712: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)84.54.115.461512440lS  -g% ossec13001ixhExim Auth failed2025-11-18 10:45:11 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:35705: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)94.50.162.662017370aR  -O' ossec13001ixVExim Auth failed2025-11-18 10:44:53 dovecot_plain authenticator failed for (toching) [12.150.243.22]:6482: 535 Incorrect authentication data (set_id=neemias.piler@arkson.com.br)12.150.243.226252001)Q  e)' ossec9710ixLDovecot Auth failed on disconnected session.Nov 18 10:44:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<8uN2qt5DSJOkXF7M>164.92.94.2046252001$P  e' ossec9710ixDDovecot Auth failed on disconnected session.Nov 18 10:44:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<53jzqd5DiBIkMrGr>36.50.177.1711562822O  k' ossec9709ix@Multiple Dovecot Aborted Logins with empty userNov 18 10:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034`N  -I+ ossec13001ix.Exim Auth failed2025-11-18 10:44:14 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:46154: 535 Incorrect authentication data (set_id=faturamento)103.230.176.1521269750uM  -w' ossec13001ixZExim Auth failed2025-11-18 10:44:58 dovecot_login authenticator failed for 110-25-88-184.adsl.fetnet.net [110.25.88.184]:60021: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)110.25.88.1841668284pL  -i+ ossec13001ixFExim Auth failed2025-11-18 10:44:38 dovecot_login authenticator failed for (pool-176-226-218-128.is74.ru) [176.226.218.128]:49084: 535 Incorrect authentication data (set_id=desenvolvimento2)176.226.218.1282017370aK  -M) ossec13001ix<Exim Auth failed2025-11-18 10:44:27 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:56888: 535 Incorrect authentication data (set_id=administrativo1)103.147.248.441269750mJ  -i% ossec13001ixRExim Auth failed2025-11-18 10:44:49 dovecot_login authenticator failed for (8.171.broad.ha.dynamic.163data.com.cn) [171.8.42.112]:35174: 535 Incorrect authentication data (set_id=financeiro)171.8.42.1121814991   qR_Yg  -=) ossec13001ixExim Auth failed2025-11-18 10:47:39 dovecot_login authenticator failed for ([175.237.47.241]) [175.237.47.241]:58576: 535 Incorrect authentication data (set_id=contato)175.237.47.2411835841f  k' ossec9709ixMultiple Dovecot Aborted Logins with empty userNov 18 10:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Qe  -3# ossec13001ixExim Auth failed2025-11-18 10:47:20 dovecot_login authenticator failed for ([101.13.1.75]) [101.13.1.75]:43594: 535 Incorrect authentication data (set_id=supports)101.13.1.751668284Xd  -;) ossec13001ixExim Auth failed2025-11-18 10:46:34 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:36734: 535 Incorrect authentication data (set_id=rafael)111.93.177.2281269750oc  -g+ ossec13001ixExim Auth failed2025-11-18 10:46:19 dovecot_login authenticator failed for ([112.186.241.102]) [112.186.241.102]:42129: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)112.186.241.1021835841)b  e-# ossec9710ixDovecot Auth failed on disconnected session.Nov 18 10:46:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001na  -i) ossec13001ixExim Auth failed2025-11-18 10:46:57 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:42071: 535 Incorrect authentication data (set_id=supports@opsconsorcios.com.br)196.189.59.226337996-`  e1' ossec9710ixDovecot Auth failed on disconnected session.Nov 18 10:46:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867-_  e-+ ossec9710ixDovecot Auth failed on disconnected session.Nov 18 10:46:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841^ W' ossec9708ixDovecot Aborted Login with empty userNov 18 10:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(]  e%) ossec9710ixDovecot Auth failed on disconnected session.Nov 18 10:46:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822P\  -1# ossec13001ixuExim Auth failed2025-11-18 10:45:24 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:42790: 535 Incorrect authentication data (set_id=contato)46.8.240.442017370%[  e!' ossec9710ixjDovecot Auth failed on disconnected session.Nov 18 10:45:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=39.106.129.971814991dZ  -S) ossec13001ixfExim Auth failed2025-11-18 10:45:10 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:36388: 535 Incorrect authentication data (set_id=atualizacoes)158.181.132.861527747~Y  -) ossec13001ixdExim Auth failed2025-11-18 10:45:08 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:35189: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)67.172.244.2356252001  |dYv  -;+ ossec13001iyExim Auth failed2025-11-18 10:50:28 dovecot_login authenticator failed for ([176.195.126.170]) [176.195.126.170]:54340: 535 Incorrect authentication data (set_id=info)176.195.126.17020173704u  e?' ossec9710iy[Dovecot Auth failed on disconnected session.Nov 18 10:49:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651\t  -G% ossec13001iyExim Auth failed2025-11-18 10:49:51 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:49782: 535 Incorrect authentication data (set_id=marcelo.pinheiro)111.26.67.361814991.s  e1) ossec9710iy}Dovecot Auth failed on disconnected session.Nov 18 10:49:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=165.210.33.1932233387mr  -e) ossec13001iywExim Auth failed2025-11-18 10:49:41 dovecot_login authenticator failed for (201.173.97.119-clientes-izzi.mx) [201.173.97.119]:57964: 535 Incorrect authentication data (set_id=atualizacoes)201.173.97.1193996063q W' ossec9708iymDovecot Aborted Login with empty userNov 18 10:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034up  -u) ossec13001iymExim Auth failed2025-11-18 10:49:32 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:51796: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)121.73.161.1432186224lo  -c) ossec13001iykExim Auth failed2025-11-18 10:49:30 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:46450: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)121.73.163.1432186224n W' ossec9708iy1Dovecot Aborted Login with empty userNov 18 10:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+m  e+) ossec9710iy/Dovecot Auth failed on disconnected session.Nov 18 10:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=143.244.133.471269750`l  -I+ ossec13001iy-Exim Auth failed2025-11-18 10:48:28 dovecot_login authenticator failed for ([211.224.227.120]) [211.224.227.120]:43246: 535 Incorrect authentication data (set_id=novalondria)211.224.227.1201835841bk  -U% ossec13001iyExim Auth failed2025-11-18 10:48:12 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:38456: 535 Incorrect authentication data (set_id=novalondria@cieadep.com)37.34.237.45285570j  -) ossec13001ixExim Auth failed2025-11-18 10:47:19 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:54463: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)186.97.203.1653686110'i  e#) ossec9710ixDovecot Auth failed on disconnected session.Nov 18 10:47:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044h  W' ossec9708iyDovecot Aborted Login with empty userNov 18 10:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  ! 2 > N 55Z5PVvr  -q) ossec13001iyExim Auth failed2025-11-18 10:51:55 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:60887: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)185.112.148.66130758\  -I% ossec13001iyExim Auth failed2025-11-18 10:51:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57525: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758v  -w) ossec13001iyExim Auth failed2025-11-18 10:51:39 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:56319: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)201.15.149.2543469034a  -K+ ossec13001iyExim Auth failed2025-11-18 10:51:26 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:53623: 535 Incorrect authentication data (set_id=sandromiguel)123.129.196.1181814991f  -[% ossec13001iyExim Auth failed2025-11-18 10:51:13 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:40197: 535 Incorrect authentication data (set_id=presidencia)111.70.3.12216682847  eC) ossec9710iyDovecot Auth failed on disconnected session.Nov 18 10:51:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=122.144.131.251814991W  -?# ossec13001iyExim Auth failed2025-11-18 10:51:55 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:50276: 535 Incorrect authentication data (set_id=isabellylisboa)113.59.34.51814991Y  -?' ossec13001iyExim Auth failed2025-11-18 10:51:20 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:57408: 535 Incorrect authentication data (set_id=financeiro)125.19.163.581269750~  k' ossec9709iyMultiple Dovecot Aborted Logins with empty userNov 18 10:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}  W' ossec9708iyDovecot Aborted Login with empty userNov 18 10:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l|  -e' ossec13001iyExim Auth failed2025-11-18 10:50:53 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:35100: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)27.24.141.1121814991p{  -k) ossec13001iyExim Auth failed2025-11-18 10:50:45 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:48652: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)195.222.57.1833277605kz  -c' ossec13001iyExim Auth failed2025-11-18 10:50:18 dovecot_login authenticator failed for ([46.149.34.226]) [46.149.34.226]:60154: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)46.149.34.2262017370jy  -_) ossec13001iyExim Auth failed2025-11-18 10:51:06 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:40006: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)182.95.115.1941269750mx  -g' ossec13001iyExim Auth failed2025-11-18 10:50:48 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:44354: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)218.78.112.811814991|w  -) ossec13001iyExim Auth failed2025-11-18 10:50:38 dovecot_login authenticator failed for 219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:33678: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)219.89.198.1912186224  ,=G,P  -/% ossec13001iz;Exim Auth failed2025-11-18 10:52:58 dovecot_login authenticator failed for ([219.129.96.2]) [219.129.96.2]:37181: 535 Incorrect authentication data (set_id=info)219.129.96.21814991]  -E) ossec13001iz7Exim Auth failed2025-11-18 10:52:54 dovecot_login authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be [81.243.106.218]:52154: 535 Incorrect authentication data81.243.106.2182802361+  e++ ossec9710iz%Dovecot Auth failed on disconnected session.Nov 18 10:52:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<5Vmcxt5D/ODBl4nP>193.151.137.207130758 W' ossec9708iz!Dovecot Aborted Login with empty userNov 18 10:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690346  eA) ossec9710izDovecot Auth failed on disconnected session.Nov 18 10:52:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387  -=% ossec13001izExim Auth failed2025-11-18 10:52:17 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (mozatingra) [80.14.31.158]:38292: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)80.14.31.1583017382r  -o) ossec13001iz=Exim Auth failed2025-11-18 10:52:59 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:50692: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)223.167.203.561814991k  -c' ossec13001iz+Exim Auth failed2025-11-18 10:52:41 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:42594: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)119.192.59.801835841]  -G) ossec13001iz)Exim Auth failed2025-11-18 10:52:40 dovecot_login authenticator failed for ([185.250.240.220]) [88.249.175.243]:46424: 535 Incorrect authentication data (set_id=faturamento)88.249.175.243298795a  -K+ ossec13001izExim Auth failed2025-11-18 10:52:28 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52328: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1413469034v  -u+ ossec13001iyExim Auth failed2025-11-18 10:51:25 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:60112: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)176.119.132.2302510769l  -a+ ossec13001izExim Auth failed2025-11-18 10:52:05 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57955: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)165.154.121.2311605651 U% ossec11001izDeferred login on the cpanel service[2025-11-18 10:52:00 -0300] info [webmaild] 45.235.16.64 - lucas@cavilhasdiesel.com.br "GET /cpsess1494109354/3rdparty/roundcube/?_task=mail HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect45.235.16.643469034f  -U+ ossec13001iyExim Auth failed2025-11-18 10:51:31 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:57312: 535 Incorrect authentication data (set_id=secretarioadjunto)180.104.103.1461814991 W' ossec9708iyDovecot Aborted Login with empty userNov 18 10:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034  (  "'_$ -G) ossec13001izExim Auth failed2025-11-18 10:54:07 dovecot_login authenticator failed for (User) [177.74.174.120]:52935: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)177.74.174.1203469034V#  -;% ossec13001izExim Auth failed2025-11-18 10:55:03 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:35264: 535 Incorrect authentication data (set_id=assessoria)102.88.10.102328926&"  e!) ossec9710izDovecot Auth failed on disconnected session.Nov 18 10:54:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<69ukzt5DbKXSchJs>210.114.18.1081835841! W' ossec9708izDovecot Aborted Login with empty userNov 18 10:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e%) ossec9710izDovecot Auth failed on disconnected session.Nov 18 10:54:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251i  -]) ossec13001izExim Auth failed2025-11-18 10:54:13 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:58877: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)189.108.215.393469034  -% ossec13001izExim Auth failed2025-11-18 10:55:05 dovecot_login authenticator failed for 221-120-4-38.emome-ip.hinet.net [221.120.4.38]:42504: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)221.120.4.381668284W  -=' ossec13001izExim Auth failed2025-11-18 10:54:37 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:49345: 535 Incorrect authentication data (set_id=novamanha)46.210.96.232294640+  e/% ossec9710izDovecot Auth failed on disconnected session.Nov 18 10:54:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841_ -G) ossec13001izqExim Auth failed2025-11-18 10:53:51 dovecot_login authenticator failed for (User) [177.74.174.120]:52935: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)177.74.174.1203469034  k' ossec9709iz]Multiple Dovecot Aborted Logins with empty userNov 18 10:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -E) ossec13001izSExim Auth failed2025-11-18 10:53:22 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:37902: 535 Incorrect authentication data (set_id=vendas.luiz)121.73.163.2502186224e  -S+ ossec13001iz{Exim Auth failed2025-11-18 10:54:03 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62438: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)165.154.121.2311605651  W' ossec9708iz{Dovecot Aborted Login with empty userNov 18 10:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+Xzjy95DnIyxV3kv>177.87.121.473469034q  -m) ossec13001izExim Auth failed2025-11-18 10:52:14 dovecot_login authenticator failed for ([219.138.200.44]) [219.138.200.44]:36214: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)219.138.200.441814991 :-  {na4' ~qdWJ= reXK>1$ {naTG:- A$ ~qdWJ=0# z[Tm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   tNG | p d X L @ 4 (h    1 x m b W K ? 3 ' 3996063/ 453733/ 3865483T 3865483 3865483 3865483 3865483 3865483 38654837 3865483# 3865483 3865483h 3865483T 3996063/r 3932488/G 3865483 3865483 3865483 3865483 3865483 3865483 3865483 3865483 3865483z 38654835 3865483 3865483n 38654839 3865483 3865483/ 3865483. 458258. 3865483 3865483 < 3865483 3865483S 3865483 3865483 3865483 3865483[ 3865483 3865483$ 3865483 3865483 3865483 3865483z 3865483 3865483 3865483 3865483t 3865483Q 3865483, 3865483.z 3996063.k 3932488. 453733. 3996063- 3923057 390903+ 390903) 390903' 390903&N 390903 390903 390903 O 390903  390903 390903q 3895114 3865483-l 3865483-D 3865483, 3865483, 3865483, 3865483+ 3865483+ 3865483+~ 3865483* 3865483*c 3865483) 3865483) 3865483)1 3865483( 3865483( 3865483' 3865483' 3865483' 3865483' 3865483&0 3865483% 3865483% 3865483% 3865483%v 3865483%p 3865483$ 3865483$ 3865483$0 3865483# 3865483#a 3865483#- 3865483" 3865483" 3865483"D 3865483" 3865483! 3865483!y 3865483 3865483 3923057- 458258- 597427 587116#= 587116"1 587116 51537c 51537 49518,0 49518" 49518 } 49518 M 49518! 458258+ 458258# 458258" 458258" 458258 s 458258 458258 458258 458258 458258 458258 453733) 453733! 453733 453733 453733 453733 453733r 453733 453733 453733P 453733x 453733 3996063,r 3996063,/ 3996063+ 3996063+ 3996063+' 3996063* 3996063* 3996063(W 3996063' 3996063% 3996063%{ 3996063% 3996063$ 3996063! 3996063! 3996063! 3996063! 3996063!: 3996063!2 3996063 3996063 3996063 w 3996063] 3996063G 39960639 3996063, 3996063 3996063 3996063w 3996063 3996063 3996063 3996063 3996063c 3996063? 3996063- 3996063 3996063 3996063m 3996063 3996063 3996063 3996063 3996063{ 3996063( 3996063 3996063M 3996063 3996063 3996063x 3996063 3996063 3996063  3996063 3996063 J 3996063  3996063 3996063 3996063 = 3996063 3996063 3996063 3996063 4 39960639 3996063/ 3996063 3996063 3996063 3996063b 3996063 3996063L 39960639 3996063@ 3996063 3932488*v 3932488'0 3932488% 3932488# 3932488! 3932488 3932488s 3932488k 3932488z 3932488 39324886 3932488M 3932488 3932488 3932488 3932488 3932488  3932488 3932488E 3932488 3932488 3932488w 3932488_ 3932488 3923057+ 3923057$ 3923057| 3923057 3923057 3923057   '3  e%' ossec9710i{aDovecot Auth failed on disconnected session.Nov 18 10:57:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001V2  -9' ossec13001i{]Exim Auth failed2025-11-18 10:57:48 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:50902: 535 Incorrect authentication data (set_id=contato)213.230.65.531512440h1  -[) ossec13001i{SExim Auth failed2025-11-18 10:57:38 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:51886: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)152.52.210.11812697500 W' ossec9708i{MDovecot Aborted Login with empty userNov 18 10:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034i/  -[+ ossec13001i{?Exim Auth failed2025-11-18 10:57:19 dovecot_login authenticator failed for ([196.200.112.238]) [196.200.112.238]:1572: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)196.200.112.2382328926d.  -Y# ossec13001i{cExim Auth failed2025-11-18 10:57:54 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:47001: 535 Incorrect authentication data (set_id=aureovieira)49.245.6.311880251-  k' ossec9709i{Multiple Dovecot Aborted Logins with empty userNov 18 10:56:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034v,  -y' ossec13001i{ Exim Auth failed2025-11-18 10:56:26 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:38910: 535 Incorrect authentication data (set_id=alex.vendas)118.212.79.211814991,+  e-) ossec9710izDovecot Auth failed on disconnected session.Nov 18 10:56:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750n*  -i' ossec13001izExim Auth failed2025-11-18 10:56:13 dovecot_login authenticator failed for ([1.237.155.150]) [1.237.155.150]:58906: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)1.237.155.1501835841)  W' ossec9708i{/Dovecot Aborted Login with empty userNov 18 10:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6j+c1t5D9NexV3kv>177.87.121.473469034k(  -a) ossec13001izExim Auth failed2025-11-18 10:55:45 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:38906: 535 Incorrect authentication data (set_id=financeiro)118.200.42.1121880251^'  -I' ossec13001izExim Auth failed2025-11-18 10:55:33 dovecot_login authenticator failed for ([112.102.61.21]) [112.102.61.21]:49179: 535 Incorrect authentication data (set_id=administrativo1)112.102.61.211814991& W' ossec9708izDovecot Aborted Login with empty userNov 18 10:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%  -% ossec13001izExim Auth failed2025-11-18 10:55:26 dovecot_login authenticator failed for (syn-072-179-206-006.res.spectrum.com) [72.179.206.6]:58481: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)72.179.206.66252001 v !  ?OvUC  -7' ossec13001i{Exim Auth failed2025-11-18 10:59:09 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:57370: 535 Incorrect authentication data (set_id=cpfnc2)157.20.228.201269750lB  -e' ossec13001i{Exim Auth failed2025-11-18 10:59:32 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:50740: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)103.220.16.511269750, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<8nN43t5D1IXSchJs>210.114.18.1081835841~>  - % ossec13001i{Exim Auth failed2025-11-18 10:59:13 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:39498: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)182.76.71.821269750U=  -9' ossec13001i{Exim Auth failed2025-11-18 10:59:24 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3685: 535 Incorrect authentication data (set_id=cpfnc2)213.55.85.202337996h<  -[) ossec13001i{Exim Auth failed2025-11-18 10:59:48 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:54000: 535 Incorrect authentication data (set_id=xavier)186.235.248.733469034;  k' ossec9709i{Multiple Dovecot Aborted Logins with empty userNov 18 10:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Y:  -=) ossec13001i{Exim Auth failed2025-11-18 10:58:45 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56417: 535 Incorrect authentication data (set_id=contato)103.168.241.3212697509 W' ossec9708i{Dovecot Aborted Login with empty userNov 18 10:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034w8  -{' ossec13001i{Exim Auth failed2025-11-18 10:58:29 dovecot_plain authenticator failed for (hmqu9flnlwg9h17bcp4d876uqfwu21) [186.82.102.36]:1831: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)186.82.102.3636861107  - + ossec13001i{Exim Auth failed2025-11-18 10:58:25 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:38154: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)177.223.133.104346903406  e7' ossec9710i{Dovecot Auth failed on disconnected session.Nov 18 10:59:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867g5  -Y) ossec13001i{Exim Auth failed2025-11-18 10:58:58 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:41852: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)111.171.125.941835841p4  -m' ossec13001i{Exim Auth failed2025-11-18 10:58:53 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:55654: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)27.24.141.1121814991  O i we>~2T  e9) ossec9710i|'Dovecot Auth failed on disconnected session.Nov 18 11:01:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=129.226.64.1411819730sS  -o+ ossec13001i|LExim Auth failed2025-11-18 11:01:47 dovecot_login authenticator failed for ([223.241.214.127]) [223.241.214.127]:57979: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)223.241.214.1271814991mR  -e) ossec13001i|+Exim Auth failed2025-11-18 11:01:15 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:45710: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)122.187.166.541269750!Q 3G' ossec11301i|)New FTP connection.Nov 18 11:01:12 hosting pure-ftpd: (?@50.207.23.120) [INFO] New connection from 50.207.23.12050.207.23.1206252001

, rip=177.87.121.47, lip=200.150.196.245, session=<1GAk495DeN2xV3kv>177.87.121.473469034tK  -s) ossec13001i{Exim Auth failed2025-11-18 11:00:19 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:55862: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)92.126.223.1752017370#J  e+ ossec9710i|Dovecot Auth failed on disconnected session.Nov 18 11:00:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758jI  -a' ossec13001i|Exim Auth failed2025-11-18 11:00:35 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:51752: 535 Incorrect authentication data (set_id=ferramentaria)177.159.99.953469034YH  -C% ossec13001i|Exim Auth failed2025-11-18 11:01:02 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61283: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758bG  -U# ossec13001i{Exim Auth failed2025-11-18 10:59:10 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:12950: 535 Incorrect authentication data (set_id=marialuiza)58.27.253.61168579!F 3G' ossec11301i{New FTP connection.Nov 18 10:59:25 hosting pure-ftpd: (?@50.207.23.120) [INFO] New connection from 50.207.23.12050.207.23.1206252001E  W' ossec9708i{Dovecot Aborted Login with empty userNov 18 11:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oD  -g+ ossec13001i{Exim Auth failed2025-11-18 10:59:38 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.123]:50884: 535 Incorrect authentication data (set_id=cpfnc2)116.193.128.1231269750  $  P (;Wc  -9) ossec13001i|Exim Auth failed2025-11-18 11:02:50 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:45824: 535 Incorrect authentication data (set_id=xavier)160.251.121.701861060rb  -q' ossec13001i|{Exim Auth failed2025-11-18 11:02:35 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:50106: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)50.231.243.286252001)a  e%+ ossec9710i|yDovecot Auth failed on disconnected session.Nov 18 11:02:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991`  W' ossec9708i|Dovecot Aborted Login with empty userNov 18 11:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W_  -9) ossec13001i|Exim Auth failed2025-11-18 11:02:57 dovecot_login authenticator failed for ([1.15.123.146]) [175.11.231.177]:57606: 535 Incorrect authentication data (set_id=contato)175.11.231.1771814991+^  e-' ossec9710i|Dovecot Auth failed on disconnected session.Nov 18 11:02:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.11015628224]  e?' ossec9710i|Dovecot Auth failed on disconnected session.Nov 18 11:02:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991i\  -a% ossec13001i|fExim Auth failed2025-11-18 11:02:13 dovecot_login authenticator failed for ([210.12.14.58]) [210.12.14.58]:59684: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)210.12.14.581814991$[  e!' ossec9710i|1Dovecot Auth failed on disconnected session.Nov 18 11:01:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=62.60.131.137130758;Z  Ao' ossec11302i|-FTP Authentication failed.Nov 18 11:01:16 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]50.207.23.1206252001wY  -}% ossec13001i|`Exim Auth failed2025-11-18 11:02:06 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:56162: 535 Incorrect authentication data (set_id=desenvolvimento2)31.199.10.823175395X W' ossec9708i|>Dovecot Aborted Login with empty userNov 18 11:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034?W  Io' ossec11331i|> Stealth FTP brute force attackNov 18 11:01:32 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]50.207.23.12062520011V  e7) ossec9710i|1Dovecot Auth failed on disconnected session.Nov 18 11:01:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730`U -G+ ossec13001i|'Exim Auth failed2025-11-18 11:01:10 dovecot_login authenticator failed for (opsconsorcios.com.br) [111.122.211.212]:51652: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991 %; M m J R mdyvl[s  -E' ossec13001i|Exim Auth failed2025-11-18 11:03:32 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:35185: 535 Incorrect authentication data (set_id=hcpontagrossa)94.207.19.166290557r W' ossec9708i|Dovecot Aborted Login with empty userNov 18 11:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lq  -i# ossec13001i|Exim Auth failed2025-11-18 11:03:30 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:50123: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)113.59.34.51814991p  - ) ossec13001i|Exim Auth failed2025-11-18 11:03:24 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:53690: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)182.239.78.12418197304o  eC# ossec9710i|Dovecot Auth failed on disconnected session.Nov 18 11:03:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483cn  -O+ ossec13001i|Exim Auth failed2025-11-18 11:03:46 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:52642: 535 Incorrect authentication data (set_id=paulinho.vendas)128.185.212.1781269750cm  -U% ossec13001i|Exim Auth failed2025-11-18 11:03:40 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:57665: 535 Incorrect authentication data (set_id=envios@comercial.art.br)45.118.49.181269750al  -M) ossec13001i|Exim Auth failed2025-11-18 11:03:37 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:35858: 535 Incorrect authentication data (set_id=info)192.46.237.1332921044k  -+ ossec13001i|Exim Auth failed2025-11-18 11:03:55 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:48006: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)187.115.144.1033469034aj  -O' ossec13001i|Exim Auth failed2025-11-18 11:03:31 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62275: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)123.58.215.721819730ti  -q+ ossec13001i|Exim Auth failed2025-11-18 11:03:20 dovecot_login authenticator failed for ([220.180.166.214]) [220.180.166.214]:48943: 535 Incorrect authentication data (set_id=hcpontagrossa@hipercesta.com.br)220.180.166.2141814991h  k' ossec9709i|yMultiple Dovecot Aborted Logins with empty userNov 18 11:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\g  -G% ossec13001i|nExim Auth failed2025-11-18 11:02:20 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:57520: 535 Incorrect authentication data (set_id=desenvolvimento2)111.26.63.871814991jf  -a' ossec13001i|}Exim Auth failed2025-11-18 11:02:36 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:48834: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)182.95.52.1221269750fe  -U+ ossec13001i|hExim Auth failed2025-11-18 11:02:15 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18670: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1423469034Wd  -9) ossec13001i|Exim Auth failed2025-11-18 11:02:53 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:33715: 535 Incorrect authentication data (set_id=bruno)222.186.68.1531814991 z)4 F < 2 (   ~tj`VLB8.$pf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p * f  R H > 4  \bvl0&XND:hTJ@6|r,"^dZxnPF<2 (~tj`8VLB$.H>4zpf\R | r h ^ T J @ 6 , "    x n d Z PvlbXND:0&z iu-o iu-n iu-m i-k i-j i-i i-p i-h iZ-g i?-f i9-e i--d iZ-c iN-b iF-a i=-` i-_ i-^ i-] i-\ i-[ i-Z i-Y i-X i-W i-V i|-U i-T i-S i~-R ip-Q ih-P iJ-O i>-N i>-M i-L i-K i4-J i-I i-H i -G i-F i&-E i-D i~-C i~-B i~-A i~-@ i~-? i~-> i~-= i~-< i~-; i~-: i~-9 i~B-8 i~B-7 i~p-6 i~\-5 i~Z-4 i~P-3 i~J-2 i~z-1 i~d-0 i~ -/ i~-. i~$-- i~-, i~-+ i~"-* i~-) i~,-( i~-' i~-& i}-% i}-$ i}-# i}-" i}-! i}- i}- i}- i}- i}- i}- i}- i}- i}- i}- i}- i}- i}- i}- i}- i}R- i}R- i}r- i}- i}Z- i}V- i}- i}T- i}R- i}- i}- i}j- i}j- i}- i}L- i}L- i}>- i}<- i}(, i}$, i}$, i}(, i}<, i}2, i}., i} , i}, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|, i|}, i|{, i|y, i|y, i|n, i|h, i|f, i|`, i|L, i|>, i|>, i|1, i|1, i|-, i|+, i|), i|', i|', i|, i|, i|, i|, i|, i|, i{, i{, i{, i{, i{, i{, i{, i{, i{, iy,t iy},s iyw,r iym,q iym,p iyk,o iy[,u iy1,n i- i- i- iw- iq- io- im- im- ig- ie- ie- iW- iG- i=- i9- i/- i)- i%- i- i-} i- i- i- i- i- i-~ i-| i-x i-w i-q i-v i-u i-t i-{ i-z i-s i-r i-y i-l i{, i{, i{, i{, i{, i{, i{, i{, i{, i{, i{, i{, i{, i{, i{c, i{a, i{], i{S, i{M, i{?, i{/, i{, i{ , iz, iz, iz, iz, iz, iz, iz, iz, iz, iz, iz, iz, iz, iz, iz, iz{, iz{, izq, iz],2 izS, iz=, iz;, iz7, iz+, iz), iz%, iz!, iz, iz, iz, iz, iz, iz, iy, iy, iy, iy, iy, iy, iy, iy, iy, iy, iy, iy,y iy,} iy,| iy,x iy,{ iy,w iy,~ iy,v iy,z 6   4C  W' ossec9708i}LDovecot Aborted Login with empty userNov 18 11:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e-' ossec9710i}>Dovecot Auth failed on disconnected session.Nov 18 11:05:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001m  -k# ossec13001i}<Exim Auth failed2025-11-18 11:05:46 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:57737: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)46.44.24.402017370R  -3' ossec13001i}(Exim Auth failed2025-11-18 11:05:26 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:49199: 535 Incorrect authentication data (set_id=info)196.0.107.158226074t~  -s) ossec13001i}$Exim Auth failed2025-11-18 11:05:23 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:42434: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)103.251.31.1661269750W}  -9) ossec13001i}$Exim Auth failed2025-11-18 11:05:22 dovecot_login authenticator failed for ([118.69.133.140]) [118.69.133.140]:57970: 535 Incorrect authentication data (set_id=lucas)118.69.133.1401562822/|  e3+ ossec9710i}(Dovecot Auth failed on disconnected session.Nov 18 11:05:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758h{  -]' ossec13001i}<Exim Auth failed2025-11-18 11:05:47 dovecot_login authenticator failed for (58-115-53-172.twt1.com.tw) [58.115.53.172]:50442: 535 Incorrect authentication data (set_id=paulinho.vendas)58.115.53.1721668284Sz  -3' ossec13001i}2Exim Auth failed2025-11-18 11:05:36 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:51048: 535 Incorrect authentication data (set_id=info)45.164.98.2053469034y  k' ossec9709i}.Multiple Dovecot Aborted Logins with empty userNov 18 11:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&x  e%% ossec9710i} Dovecot Auth failed on disconnected session.Nov 18 11:04:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<5k3X8t5D9JR3xBIC>119.196.18.21835841xw  -{) ossec13001i}Exim Auth failed2025-11-18 11:04:52 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:52944: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)71.208.122.1856252001v W' ossec9708i|Dovecot Aborted Login with empty userNov 18 11:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vu  -9' ossec13001i|Exim Auth failed2025-11-18 11:04:31 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:58586: 535 Incorrect authentication data (set_id=contato)114.98.235.341814991lt  -c) ossec13001i|Exim Auth failed2025-11-18 11:03:52 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:59306: 535 Incorrect authentication data (set_id=envios)72.239.139.1626252001 V  0  iV  -+' ossec13001i}RExim Auth failed2025-11-18 11:06:09 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (liked) [87.103.126.54]:32783: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)87.103.126.542264397-  e/) ossec9710i}RDovecot Auth failed on disconnected session.Nov 18 11:06:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750$  e!' ossec9710i}rDovecot Auth failed on disconnected session.Nov 18 11:06:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758m  U=) ossec11001i}Deferred login on the cpanel service[2025-11-18 11:07:03 -0300] info [webmaild] 189.49.233.224 - operacoes@huboperacoes.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing189.49.233.2243469034W  -=% ossec13001i}ZExim Auth failed2025-11-18 11:06:16 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:34290: 535 Incorrect authentication data (set_id=coordenacao)36.50.167.811269750  -A) ossec13001i}VExim Auth failed2025-11-18 11:06:13 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (wismacha) [76.157.219.158]:34450: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)76.157.219.1586252001)  e)' ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:06:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001W  -9) ossec13001i}TExim Auth failed2025-11-18 11:06:11 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:53874: 535 Incorrect authentication data (set_id=eduardo)152.52.236.1221269750*  e'+ ossec9710i}RDovecot Auth failed on disconnected session.Nov 18 11:06:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<7WkF995DgvVxoZB3>113.161.144.1191562822x  -}' ossec13001i}Exim Auth failed2025-11-18 11:07:08 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:38118: 535 Incorrect authentication data (set_id=salamuni)182.95.57.11012697503  e?% ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001 W' ossec9708i}jDovecot Aborted Login with empty userNov 18 11:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034j  -_) ossec13001i}jExim Auth failed2025-11-18 11:06:33 dovecot_login authenticator failed for ([180.168.60.146]) [180.168.60.146]:55757: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)180.168.60.1461814991h  -_% ossec13001i}Exim Auth failed2025-11-18 11:05:12 dovecot_login authenticator failed for ([213.234.0.90]) [213.234.0.90]:50498: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)213.234.0.902017370r  -o) ossec13001i}LExim Auth failed2025-11-18 11:06:03 dovecot_login authenticator failed for ([183.92.156.184]) [183.92.136.185]:42115: 535 Incorrect authentication data (set_id=coordenacao@maringasoldas.com.br)183.92.136.1851814991 :4? ^ D F n s~aa4@:U!  -7' ossec13001i}Exim Auth failed2025-11-18 11:08:29 dovecot_login authenticator failed for ([172.81.45.147]) [172.81.45.147]:40360: 535 Incorrect authentication data (set_id=envios)172.81.45.1476252001)  e') ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:08:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841p  -m' ossec13001i}Exim Auth failed2025-11-18 11:08:25 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:46701: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)117.6.226.1221562822)  e%+ ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:08:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001|  -' ossec13001i}Exim Auth failed2025-11-18 11:08:11 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:38904: 535 Incorrect authentication data (set_id=envios@comercial.art.br)77.37.162.1172017370/  e1+ ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:08:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841f  -U+ ossec13001i}Exim Auth failed2025-11-18 11:08:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18549: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)181.191.136.1423469034   -!) ossec13001i}Exim Auth failed2025-11-18 11:08:37 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:37258: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)93.121.175.2203579143b  -O) ossec13001i}Exim Auth failed2025-11-18 11:08:25 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:35899: 535 Incorrect authentication data (set_id=andre.nascimento)61.150.123.1061814991w  -y) ossec13001i}Exim Auth failed2025-11-18 11:07:58 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:40280: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)178.176.229.362017370T  -7% ossec13001i}Exim Auth failed2025-11-18 11:07:49 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:44404: 535 Incorrect authentication data (set_id=salamuni)183.6.43.2361814991z  -}+ ossec13001i}Exim Auth failed2025-11-18 11:07:47 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:42362: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)123.209.106.1902077456 W' ossec9708i}Dovecot Aborted Login with empty userNov 18 11:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6sYs/N5DGsWxV3kv>177.87.121.473469034]  -G) ossec13001i}Exim Auth failed2025-11-18 11:07:32 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:57056: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549q  -q% ossec13001i}Exim Auth failed2025-11-18 11:07:29 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:53438: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)180.165.1.711814991H  -) ossec13001i}Exim Auth failed2025-11-18 11:07:27 dovecot_login authenticator failed for ([111.26.106.118]) [111.26.106.119]:46832: 535 Incorrect authentication data111.26.106.1191814991 @  @H1  -) ossec13001i~zExim Auth failed2025-11-18 11:11:06 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:38421: 535 Incorrect authentication data61.150.123.1061814991T0  -5) ossec13001i~dExim Auth failed2025-11-18 11:10:43 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:52690: 535 Incorrect authentication data (set_id=adm)85.133.161.162130758s/  -o+ ossec13001i~ Exim Auth failed2025-11-18 11:09:16 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53168: 535 Incorrect authentication data (set_id=assessoria)188.219.104.2103175395u.  -y% ossec13001i~Exim Auth failed2025-11-18 11:09:09 dovecot_plain authenticator failed for (bam1p4pwo0leyzlyczxu9hjje3vech) [1.212.225.99]:48358: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)1.212.225.991835841\-  -A+ ossec13001i~$Exim Auth failed2025-11-18 11:09:40 dovecot_login authenticator failed for ([211.238.237.254]) [211.238.237.254]:51505: 535 Incorrect authentication data (set_id=contato)211.238.237.2541835841, W' ossec9708i~Dovecot Aborted Login with empty userNov 18 11:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034q+  -s% ossec13001i~Exim Auth failed2025-11-18 11:09:17 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:55933: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)95.87.213.16732800o*  -k' ossec13001i~"Exim Auth failed2025-11-18 11:09:38 dovecot_login authenticator failed for ([182.239.80.74]) [182.239.80.74]:48237: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)182.239.80.741819730r)  -o) ossec13001i~Exim Auth failed2025-11-18 11:09:12 dovecot_login authenticator failed for ([218.15.224.102]) [218.15.224.102]:42996: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)218.15.224.1021814991|(  -) ossec13001i~,Exim Auth failed2025-11-18 11:09:47 dovecot_login authenticator failed for dynamic-216-81.keskikaista.fi [185.131.216.81]:47984: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)185.131.216.81660013T'  -5' ossec13001i~Exim Auth failed2025-11-18 11:09:06 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:54471: 535 Incorrect authentication data111.70.23.2231668284&  W' ossec9708i~Dovecot Aborted Login with empty userNov 18 11:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034%  k' ossec9709i}Multiple Dovecot Aborted Logins with empty userNov 18 11:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8A21/95DNOOxV3kv>177.87.121.473469034`$  -O' ossec13001i}Exim Auth failed2025-11-18 11:08:47 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:57937: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)194.116.236.4298795.#  e/+ ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:08:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822&"  e#' ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 11:08:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841 4   r@  -s% ossec13001i~Exim Auth failed2025-11-18 11:11:45 dovecot_login authenticator failed for 111-70-11-15.emome-ip.hinet.net [111.70.11.15]:32938: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)111.70.11.151668284)?  e%+ ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 11:11:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001Y>  -=) ossec13001i~Exim Auth failed2025-11-18 11:11:56 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:43466: 535 Incorrect authentication data (set_id=eduardo)103.168.241.321269750 =  -+ ossec13001i~Exim Auth failed2025-11-18 11:11:47 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:39326: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)180.222.166.2122077456<  k' ossec9709i~Multiple Dovecot Aborted Logins with empty userNov 18 11:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4iJ5Ct9DwOKxV3kv>177.87.121.473469034d;  -U' ossec13001i~Exim Auth failed2025-11-18 11:11:32 dovecot_plain authenticator failed for (pabusly) [12.150.243.22]:56378: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)12.150.243.226252001Z: -?' ossec13001i~Exim Auth failed2025-11-18 11:11:32 dovecot_login authenticator failed for (calcautomation.com) [112.122.54.54]:11079: 535 Incorrect authentication data (set_id=nologin)112.122.54.5418149919  -' ossec13001i~Exim Auth failed2025-11-18 11:11:29 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (vicale) [81.225.30.107]:39648: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)81.225.30.1072661886[8  -C' ossec13001i~BExim Auth failed2025-11-18 11:10:08 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:42194: 535 Incorrect authentication data (set_id=fabio.vendas)152.52.244.461269750/7  e7% ossec9710i~BDovecot Auth failed on disconnected session.Nov 18 11:10:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841d6  -U' ossec13001i~pExim Auth failed2025-11-18 11:10:55 dovecot_plain authenticator failed for (pirelowfus) [24.187.213.29]:34850: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)24.187.213.29625200125  e9) ossec9710i~\Dovecot Auth failed on disconnected session.Nov 18 11:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197304 W' ossec9708i~ZDovecot Aborted Login with empty userNov 18 11:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034b3  -U# ossec13001i~PExim Auth failed2025-11-18 11:10:24 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:37041: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)189.56.0.193469034b2  -O) ossec13001i~JExim Auth failed2025-11-18 11:10:18 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:46718: 535 Incorrect authentication data (set_id=fabio.vendas)109.207.33.2536290252  m O  k' ossec9709iJMultiple Dovecot Aborted Logins with empty userNov 18 11:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034lN  -c) ossec13001i>Exim Auth failed2025-11-18 11:14:21 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:36722: 535 Incorrect authentication data (set_id=cpfnc2)24.222.149.2396251999fM  U1' ossec11001i>Deferred login on the cpanel service[2025-11-18 11:14:21 -0300] info [webmaild] 177.16.29.122 - compras@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing177.16.29.1223469034L W' ossec9708iDovecot Aborted Login with empty userNov 18 11:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034K  -) ossec13001iExim Auth failed2025-11-18 11:13:25 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:37856: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)208.109.38.1436252001J  -+ ossec13001i4Exim Auth failed2025-11-18 11:14:11 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:50538: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)223.197.153.1431819730]I  -I% ossec13001iExim Auth failed2025-11-18 11:13:48 dovecot_login authenticator failed for (1075fm.com.br) [206.82.9.238]:49603: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)206.82.9.2386252001YH  -;+ ossec13001iExim Auth failed2025-11-18 11:13:37 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:59735: 535 Incorrect authentication data (set_id=info)218.146.133.1171835841_G  -I) ossec13001i Exim Auth failed2025-11-18 11:13:30 dovecot_login authenticator failed for ([122.185.145.54]) [122.185.145.54]:40500: 535 Incorrect authentication data (set_id=atualizacoes1)122.185.145.541269750^F  -K% ossec13001iExim Auth failed2025-11-18 11:13:23 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:60386: 535 Incorrect authentication data (set_id=info@inovasite.com)102.53.15.172542007+E  e)+ ossec9710i&Dovecot Auth failed on disconnected session.Nov 18 11:13:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841&D  e'# ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:13:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483mC  -e) ossec13001i~Exim Auth failed2025-11-18 11:11:37 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:55896: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)121.73.168.2342186224B  W' ossec9708i~Dovecot Aborted Login with empty userNov 18 11:12:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,A  e3# ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 11:11:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<8Q6PC99D9tgXXz9j>23.95.63.996252001 W Z ~MW4]  e?' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:18:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001*\  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:17:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841`[ -G+ ossec13001iExim Auth failed2025-11-18 11:17:13 dovecot_login authenticator failed for (localhost) [213.209.157.209]:52285: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)213.209.157.2092921044&Z  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:17:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<0FExHt9DWtcIiXsk>8.137.123.3618149911Y  e;% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:16:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001X W' ossec9708iDovecot Aborted Login with empty userNov 18 11:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/W  e5' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:16:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<42fSG99D6p8tPZWl>45.61.149.1656252001-V  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:17:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730XU  -A% ossec13001i|Exim Auth failed2025-11-18 11:15:23 dovecot_login authenticator failed for ([91.74.145.27]) [91.74.145.27]:39652: 535 Incorrect authentication data (set_id=ferramentaria)91.74.145.272905575T  eA' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:15:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=157.66.47.2421562822S W' ossec9708iDovecot Aborted Login with empty userNov 18 11:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,R  e/' ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 11:15:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001Q  -+ ossec13001ipExim Auth failed2025-11-18 11:15:12 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:62996: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)128.106.196.1501880251P  W' ossec9708ihDovecot Aborted Login with empty userNov 18 11:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   ! 'l  e)# ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:20:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=66.97.42.713865483yk  -' ossec13001iExim Auth failed2025-11-18 11:20:09 dovecot_login authenticator failed for 111-70-38-124.emome-ip.hinet.net [111.70.38.124]:40310: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)111.70.38.1241668284Vj  -9' ossec13001iExim Auth failed2025-11-18 11:20:04 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:48937: 535 Incorrect authentication data (set_id=compras)1.235.192.1311835841.i  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:19:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841fh  -[% ossec13001iExim Auth failed2025-11-18 11:19:48 dovecot_login authenticator failed for ([36.135.62.82]) [36.135.62.83]:42770: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)36.135.62.831814991.g  e/+ ossec9710iZDovecot Auth failed on disconnected session.Nov 18 11:19:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001zf  -) ossec13001i?Exim Auth failed2025-11-18 11:18:38 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:61467: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)116.48.150.1151819730e W' ossec9708i9Dovecot Aborted Login with empty userNov 18 11:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8pGCI99DiNqxV3kv>177.87.121.473469034fd  -U+ ossec13001i-Exim Auth failed2025-11-18 11:18:20 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18747: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)181.191.136.1423469034tc  -w% ossec13001iZExim Auth failed2025-11-18 11:19:05 dovecot_login authenticator failed for 111-70-13-23.emome-ip.hinet.net [111.70.13.23]:35259: 535 Incorrect authentication data (set_id=igreja@pibtrindade.com.br)111.70.13.231668284kb  -e' ossec13001iNExim Auth failed2025-11-18 11:18:53 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:41318: 535 Incorrect authentication data (set_id=aureovieira)95.158.39.201690791ca  -Q+ ossec13001iFExim Auth failed2025-11-18 11:18:46 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:51727: 535 Incorrect authentication data (set_id=contato)151.237.115.206732800g`  -[' ossec13001i=Exim Auth failed2025-11-18 11:18:35 dovecot_login authenticator failed for ([219.144.16.16]) [219.144.16.16]:59711: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)219.144.16.161814991_  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:17:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   !:]E|  -' ossec13001iExim Auth failed2025-11-18 11:21:16 dovecot_login authenticator failed for ([36.135.62.102]) [36.135.62.103]:47560: 535 Incorrect authentication data36.135.62.1031814991Y{ -=' ossec13001iExim Auth failed2025-11-18 11:20:44 dovecot_login authenticator failed for (letracaixa.art.br) [112.122.54.54]:32068: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991cz  -S' ossec13001iExim Auth failed2025-11-18 11:20:41 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:33602: 535 Incorrect authentication data (set_id=compras)202.156.16.911880251dy  -Q+ ossec13001iExim Auth failed2025-11-18 11:20:24 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:12439: 535 Incorrect authentication data (set_id=eduardo)182.163.122.1331210997Vx  -9' ossec13001iExim Auth failed2025-11-18 11:21:11 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:55830: 535 Incorrect authentication data (set_id=eduardo)111.26.79.1121814991w  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vv  -9' ossec13001iExim Auth failed2025-11-18 11:20:55 dovecot_login authenticator failed for ([218.22.187.68]) [218.22.187.66]:40445: 535 Incorrect authentication data (set_id=eduardo)218.22.187.661814991,u  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:20:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.2421835841 t  -!) ossec13001iExim Auth failed2025-11-18 11:20:50 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (ratemis) [98.192.114.251]:34543: 535 Incorrect authentication data (set_id=marcelo@htmferramentas.com.br)98.192.114.2516252001ds  -W% ossec13001iExim Auth failed2025-11-18 11:20:39 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:50904: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)84.54.115.461512440r  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Qq  -3# ossec13001iExim Auth failed2025-11-18 11:20:58 dovecot_login authenticator failed for ([58.17.128.7]) [58.17.128.7]:56358: 535 Incorrect authentication data (set_id=salamuni)58.17.128.71814991dp  -S) ossec13001iExim Auth failed2025-11-18 11:19:54 dovecot_plain authenticator failed for (inolved) [192.34.128.202]:52264: 535 Incorrect authentication data (set_id=amarildo@brilhometal.com.br)192.34.128.2026252001[o  -?+ ossec13001iuExim Auth failed2025-11-18 11:19:31 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:48785: 535 Incorrect authentication data (set_id=igreja)118.122.196.2301814991n W' ossec9708iuDovecot Aborted Login with empty userNov 18 11:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034&m  e%% ossec9710iuDovecot Auth failed on disconnected session.Nov 18 11:19:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060     F,;`  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034f  -_% ossec13001i=Exim Auth failed2025-11-18 11:22:52 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:35511: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)65.20.131.6399237m  -g' ossec13001i/Exim Auth failed2025-11-18 11:22:37 dovecot_login authenticator failed for broadband-188-32-79-237.ip.moscow.rt.ru [188.32.79.237]:35194: 535 Incorrect authentication data (set_id=partners)188.32.79.2372017370V  -9' ossec13001i%Exim Auth failed2025-11-18 11:22:27 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:45692: 535 Incorrect authentication data (set_id=contato)121.73.167.152186224|  -' ossec13001iExim Auth failed2025-11-18 11:22:21 dovecot_login authenticator failed for 75.97.208.233.res-cmts.blm.ptd.net [75.97.208.233]:50438: 535 Incorrect authentication data (set_id=partners@maringaparts.com.br)75.97.208.2336252001E  -' ossec13001iGExim Auth failed2025-11-18 11:23:03 dovecot_login authenticator failed for ([112.102.61.21]) [112.102.61.21]:51524: 535 Incorrect authentication data112.102.61.211814991W  -;' ossec13001iWExim Auth failed2025-11-18 11:23:17 dovecot_login authenticator failed for ([60.216.89.122]) [60.216.89.122]:46204: 535 Incorrect authentication data (set_id=feedback)60.216.89.1221814991m  -g) ossec13001i9Exim Auth failed2025-11-18 11:22:48 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:57747: 535 Incorrect authentication data (set_id=feedback@deproi.com.br)165.169.82.194935317 W' ossec9708i)Dovecot Aborted Login with empty userNov 18 11:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U  -7' ossec13001iExim Auth failed2025-11-18 11:21:50 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:36530: 535 Incorrect authentication data (set_id=rafael)182.78.111.341269750p  -i+ ossec13001iExim Auth failed2025-11-18 11:21:50 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:3717: 535 Incorrect authentication data (set_id=andre.nascimento)121.202.140.1111819730i  -_' ossec13001iExim Auth failed2025-11-18 11:21:37 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:48988: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)108.143.69.792750405 W' ossec9708iDovecot Aborted Login with empty userNov 18 11:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -I% ossec13001iExim Auth failed2025-11-18 11:21:23 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58101: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758~  - ' ossec13001iExim Auth failed2025-11-18 11:21:24 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:55310: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)113.11.34.2211210997}  - ' ossec13001iExim Auth failed2025-11-18 11:22:12 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:48038: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)24.97.253.2466252001  hqCTin  3;! ossec11301iNew FTP connection.Nov 18 11:24:35 hosting pure-ftpd: (?@3.17.73.23) [INFO] New connection from 3.17.73.233.17.73.236252001w  -y) ossec13001iExim Auth failed2025-11-18 11:25:16 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:33902: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)194.158.224.902658434g  -Y) ossec13001iExim Auth failed2025-11-18 11:25:07 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:44384: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)212.57.136.1412017370k  -e' ossec13001iExim Auth failed2025-11-18 11:24:34 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:58066: 535 Incorrect authentication data (set_id=alex.vendas)5.185.176.195798544* U7' ossec11001iDeferred login on the cpanel service[2025-11-18 11:24:35 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect138.94.168.283469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 11:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034y  -{+ ossec13001imExim Auth failed2025-11-18 11:23:41 dovecot_login authenticator failed for ([218.203.179.228]) [218.203.179.228]:52404: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)218.203.179.2281814991\  -I# ossec13001igExim Auth failed2025-11-18 11:23:34 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:18060: 535 Incorrect authentication data (set_id=info)58.27.253.61168579  k' ossec9709ieMultiple Dovecot Aborted Logins with empty userNov 18 11:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<38hlNd9DdpCxV3kv>177.87.121.473469034-  e/) ossec9710ieDovecot Auth failed on disconnected session.Nov 18 11:23:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841U  -7' ossec13001iExim Auth failed2025-11-18 11:24:03 dovecot_login authenticator failed for ([27.158.58.178]) [27.158.24.119]:4055: 535 Incorrect authentication data (set_id=adriana)27.158.24.1191814991  -' ossec13001iwExim Auth failed2025-11-18 11:23:50 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:56841: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)88.11.230.1602510769(  e'' ossec9710iqDovecot Auth failed on disconnected session.Nov 18 11:23:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001%  e#% ossec9710ioDovecot Auth failed on disconnected session.Nov 18 11:23:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060  -' ossec13001imExim Auth failed2025-11-18 11:23:41 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:49086: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)50.171.64.1706252001    7@[Agxd+  -W% ossec13001iExim Auth failed2025-11-18 11:25:37 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:42484: 535 Incorrect authentication data (set_id=rogerioamorim@ieq.com.br)103.29.62.511269750k*  -c' ossec13001iExim Auth failed2025-11-18 11:25:24 dovecot_login authenticator failed for ([62.192.226.83]) [62.192.226.83]:45156: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)62.192.226.832017370V)  -9' ossec13001iExim Auth failed2025-11-18 11:25:40 dovecot_login authenticator failed for ([111.26.101.76]) [111.26.101.77]:38458: 535 Incorrect authentication data (set_id=eliezer)111.26.101.771814991( W' ossec9708iDovecot Aborted Login with empty userNov 18 11:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<70CNPN9DItaxV3kv>177.87.121.473469034a'  -M) ossec13001iExim Auth failed2025-11-18 11:25:27 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:36334: 535 Incorrect authentication data (set_id=info)196.47.172.2532287781s&  -q) ossec13001iExim Auth failed2025-11-18 11:26:08 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:48344: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)180.94.191.2191821275Y%  -?' ossec13001iExim Auth failed2025-11-18 11:25:53 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:49022: 535 Incorrect authentication data (set_id=info)24.187.213.296252001r$  -o) ossec13001iExim Auth failed2025-11-18 11:25:43 dovecot_login authenticator failed for ([70.174.168.108]) [70.174.168.108]:36397: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)70.174.168.1086252001T#  -3) ossec13001iExim Auth failed2025-11-18 11:25:41 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:39999: 535 Incorrect authentication data (set_id=info)171.100.156.3816056513"  e;) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:25:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=203.124.45.140, lip=200.150.196.245, TLS, session=<1FI1PN9Ds87LfC2M>203.124.45.1401168579y!  -}) ossec13001iExim Auth failed2025-11-18 11:25:48 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:52181: 535 Incorrect authentication data (set_id=rogerioamorim)177.22.122.1543469034[  -E% ossec13001iExim Auth failed2025-11-18 11:25:31 dovecot_login authenticator failed for ([58.37.100.53]) [58.37.100.53]:42786: 535 Incorrect authentication data (set_id=administrativo1)58.37.100.531814991  -% ossec13001iExim Auth failed2025-11-18 11:26:02 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:56753: 535 Incorrect authentication data (set_id=dayanelima@louvoreterno.com.br)85.152.57.602510769m  -g' ossec13001iExim Auth failed2025-11-18 11:25:56 dovecot_login authenticator failed for ([154.203.70.75]) [154.203.70.75]:56435: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)154.203.70.753374766b  -U# ossec13001iExim Auth failed2025-11-18 11:25:14 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:40683: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)113.59.34.51814991+  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:25:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<1tS3Ot9DTLFzR+4E>115.71.238.41835841 k!>    *Aa,@<<_kp;  -m' ossec13001iAExim Auth failed2025-11-18 11:27:12 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:53848: 535 Incorrect authentication data (set_id=info@1075fm.com.br)37.46.160.1752661886Y:  -?' ossec13001i?Exim Auth failed2025-11-18 11:27:10 dovecot_login authenticator failed for ([36.135.103.30]) [36.135.103.30]:33260: 535 Incorrect authentication data (set_id=financeiro)36.135.103.301814991|9  -) ossec13001i-Exim Auth failed2025-11-18 11:26:52 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:58316: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)110.175.41.21720774568  - ' ossec13001i+Exim Auth failed2025-11-18 11:26:50 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:49921: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)70.79.120.2486251999h7  -_' ossec13001i'Exim Auth failed2025-11-18 11:26:46 dovecot_login authenticator failed for (host176-90-16-178.reedlan.com) [178.16.90.176]:39870: 535 Incorrect authentication data (set_id=atualizacoes)178.16.90.17669079116  e9' ossec9710i!Dovecot Auth failed on disconnected session.Nov 18 11:26:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867\5  -C) ossec13001iExim Auth failed2025-11-18 11:26:33 dovecot_login authenticator failed for ([58.121.175.167]) [58.121.175.167]:50362: 535 Incorrect authentication data (set_id=dayanelima)58.121.175.1671835841e4  -W' ossec13001iExim Auth failed2025-11-18 11:26:33 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:44862: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)125.19.195.661269750P3  -1# ossec13001iExim Auth failed2025-11-18 11:26:30 dovecot_login authenticator failed for ([81.13.62.77]) [81.13.62.77]:51014: 535 Incorrect authentication data (set_id=contato)81.13.62.772017370 2  Sw) ossec11000iCLogin failed on the cpanel service.[2025-11-18 11:27:14 -0300] info [cpaneld] 152.42.163.119 - bonfitne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bonfitne (has_cpuser_file failed)152.42.163.1191880251w1  -{' ossec13001i?Exim Auth failed2025-11-18 11:27:10 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:35716: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)182.95.115.701269750x0  -% ossec13001iCExim Auth failed2025-11-18 11:27:15 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:46598: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)92.189.80.732510769/  W' ossec9708i7Dovecot Aborted Login with empty userNov 18 11:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034_-  -G+ ossec13001iExim Auth failed2025-11-18 11:26:30 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:22662: 535 Incorrect authentication data (set_id=financeiro)171.244.140.1341562822[,  -C' ossec13001iExim Auth failed2025-11-18 11:25:55 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:47929: 535 Incorrect authentication data (set_id=fabio.vendas)5.142.196.1852017370 * + S g ; i57cIivkK  -_+ ossec13001iExim Auth failed2025-11-18 11:28:28 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51537: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)165.154.121.2311605651$J 3K) ossec11301iNew FTP connection.Nov 18 11:28:21 hosting pure-ftpd: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1182750405`I  -K) ossec13001iQExim Auth failed2025-11-18 11:27:29 dovecot_login authenticator failed for ([222.240.215.10]) [222.240.215.10]:50471: 535 Incorrect authentication data (set_id=isabellylisboa)222.240.215.101814991oH  -k' ossec13001iMExim Auth failed2025-11-18 11:27:25 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:36468: 535 Incorrect authentication data (set_id=eduardo)108.30.14.2216252001\G  -A+ ossec13001iSExim Auth failed2025-11-18 11:27:31 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:61766: 535 Incorrect authentication data (set_id=compras)119.204.125.1241835841F W' ossec9708iUDovecot Aborted Login with empty userNov 18 11:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034PE  -/% ossec13001iMExim Auth failed2025-11-18 11:27:25 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:11078: 535 Incorrect authentication data (set_id=info)117.135.6.101814991zD  -% ossec13001iExim Auth failed2025-11-18 11:28:14 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:41516: 535 Incorrect authentication data (set_id=promo@maringaparts.com.br)35.243.68.6618610600C  SE) ossec11000ioLogin failed on the cpanel service.[2025-11-18 11:27:58 -0300] info [webmaild] 141.98.103.162 - flavio.oliveira@8it.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)141.98.103.1626290252NB  --# ossec13001ikExim Auth failed2025-11-18 11:27:54 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:50563: 535 Incorrect authentication data (set_id=media)103.50.5.941269750(A  e%) ossec9710iaDovecot Auth failed on disconnected session.Nov 18 11:27:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822h@  -]' ossec13001iEExim Auth failed2025-11-18 11:27:16 dovecot_login authenticator failed for ([70.174.168.87]) [70.174.168.87]:55586: 535 Incorrect authentication data (set_id=media@maringaparts.com.br)70.174.168.876252001T?  -9' ossec13001iAExim Auth failed2025-11-18 11:27:13 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:35798: 535 Incorrect authentication data (set_id=eduardo)65.20.233.11099237{>  -' ossec13001i3Exim Auth failed2025-11-18 11:26:57 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:38544: 535 Incorrect authentication data (set_id=aureovieira)125.23.140.541269750f=  -U+ ossec13001i-Exim Auth failed2025-11-18 11:26:51 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:19164: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)181.191.136.1423469034h<  -_' ossec13001iExim Auth failed2025-11-18 11:26:22 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:40584: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)91.239.23.149458258 ] & (Nv][  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2difTN9DAICxV3kv>177.87.121.473469034TZ  -5' ossec13001iExim Auth failed2025-11-18 11:29:27 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:16461: 535 Incorrect authentication data (set_id=info)58.49.113.1381814991VY  -9) ossec13001iExim Auth failed2025-11-18 11:29:25 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:51582: 535 Incorrect authentication data (set_id=press)94.131.211.168690791lX  -c) ossec13001iExim Auth failed2025-11-18 11:29:58 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:43680: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)195.222.57.1903277605]W  -G' ossec13001iExim Auth failed2025-11-18 11:29:58 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:43361: 535 Incorrect authentication data (set_id=team)103.148.92.471168579V 3C% ossec11301iNew FTP connection.Nov 18 11:29:53 hosting pure-ftpd: (?@20.119.74.72) [INFO] New connection from 20.119.74.7220.119.74.7262520012U  e;' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:29:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=36.50.176.1101562822T  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034~S  -) ossec13001iExim Auth failed2025-11-18 11:29:16 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:50954: 535 Incorrect authentication data (set_id=team@maringaparts.com.br)182.76.228.2341269750{R  -' ossec13001iExim Auth failed2025-11-18 11:29:13 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:55226: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)41.59.202.241149590-Q  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:29:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044TP  -5' ossec13001iExim Auth failed2025-11-18 11:28:43 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:42116: 535 Incorrect authentication data (set_id=promo)45.115.173.111269750uO  -s+ ossec13001iExim Auth failed2025-11-18 11:28:43 dovecot_login authenticator failed for (static-ip-adsl-190.186.228.106.cotas.com.bo) [190.186.228.106]:40992: 535 Incorrect authentication data (set_id=rafael)190.186.228.1063923057N W' ossec9708iDovecot Aborted Login with empty userNov 18 11:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034M  - ) ossec13001iExim Auth failed2025-11-18 11:29:16 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:45999: 535 Incorrect authentication data (set_id=press@maringaparts.com.br)117.211.14.1161269750hL  -_% ossec13001iExim Auth failed2025-11-18 11:28:31 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:45335: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)211.196.31.21835841  qpj  -i+ ossec13001iGExim Auth failed2025-11-18 11:31:35 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:22973: 535 Incorrect authentication data (set_id=bqtz@iemif.com)218.212.140.1711880251\i  -A+ ossec13001i=Exim Auth failed2025-11-18 11:31:24 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:14357: 535 Incorrect authentication data (set_id=contato)202.179.189.1951643084dh  -Q+ ossec13001imExim Auth failed2025-11-18 11:32:12 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:60708: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)165.154.121.2311605651lg  -c) ossec13001iSExim Auth failed2025-11-18 11:31:46 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:49705: 535 Incorrect authentication data (set_id=bqtz)178.140.95.2212017370^f  -G) ossec13001i=Exim Auth failed2025-11-18 11:31:25 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:43950: 535 Incorrect authentication data (set_id=fabio.vendas)112.196.52.1071269750,e  e-) ossec9710i9Dovecot Auth failed on disconnected session.Nov 18 11:31:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197302d  e9) ossec9710ioDovecot Auth failed on disconnected session.Nov 18 11:32:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044c W' ossec9708i Dovecot Aborted Login with empty userNov 18 11:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2KNlTt9DpJKxV3kv>177.87.121.473469034Vb  -9' ossec13001iExim Auth failed2025-11-18 11:30:20 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:52772: 535 Incorrect authentication data (set_id=contato)83.136.176.122510769'a  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<+Q51Td9DSodSnOdL>82.156.231.751814991o`  -k' ossec13001i/Exim Auth failed2025-11-18 11:31:10 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:43987: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)216.126.65.716251999j_  -a' ossec13001i%Exim Auth failed2025-11-18 11:31:01 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:53010: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)159.75.92.1361814991u^  -u) ossec13001iExim Auth failed2025-11-18 11:30:44 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:51676: 535 Incorrect authentication data (set_id=ferramentaria)122.186.244.341269750q]  -o' ossec13001i Exim Auth failed2025-11-18 11:30:33 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:52687: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)14.37.206.13618358417\  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:30:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=8.213.235.1231605651 / 0  ( &I86:5/z  -) ossec13001iExim Auth failed2025-11-18 11:32:51 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:42506: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)201.173.250.423996063y  - ) ossec13001iExim Auth failed2025-11-18 11:32:37 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:61560: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)220.246.47.1461819730xx  -}' ossec13001iExim Auth failed2025-11-18 11:32:35 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:52668: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)95.31.209.1022017370ew  -Y% ossec13001iExim Auth failed2025-11-18 11:33:07 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:60510: 535 Incorrect authentication data (set_id=contato)76.151.32.996252001v  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Vu  -9' ossec13001iyExim Auth failed2025-11-18 11:32:24 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:34404: 535 Incorrect authentication data (set_id=billing)218.22.187.6618149913t  e;) ossec9710iwDovecot Auth failed on disconnected session.Nov 18 11:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044Ys  -=) ossec13001iExim Auth failed2025-11-18 11:33:13 dovecot_login authenticator failed for ([222.240.215.10]) [222.240.215.10]:52157: 535 Incorrect authentication data (set_id=contato)222.240.215.101814991[r  -?+ ossec13001iExim Auth failed2025-11-18 11:32:52 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:35688: 535 Incorrect authentication data (set_id=orders)203.172.213.1661605651q  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034jp  -a' ossec13001iiExim Auth failed2025-11-18 11:32:09 dovecot_login authenticator failed for ([111.26.69.159]) [111.26.69.160]:46856: 535 Incorrect authentication data (set_id=billing@maringaparts.com.br)111.26.69.1601814991o W' ossec9708iEDovecot Aborted Login with empty userNov 18 11:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Yn  -C% ossec13001iCExim Auth failed2025-11-18 11:31:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56202: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758Ym  -?' ossec13001ieExim Auth failed2025-11-18 11:32:04 dovecot_login authenticator failed for ([182.79.95.231]) [152.52.244.46]:53948: 535 Incorrect authentication data (set_id=newsletter)152.52.244.461269750ol  -i) ossec13001iWExim Auth failed2025-11-18 11:31:51 dovecot_login authenticator failed for ([123.161.84.204]) [123.161.84.204]:9074: 535 Incorrect authentication data (set_id=newsletter@maringaparts.com.br)123.161.84.2041814991k W+ ossec9708iMDovecot Aborted Login with empty userNov 18 11:31:41 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=216.238.113.1763469034 - F l x pD*-n  -k% ossec13001iExim Auth failed2025-11-18 11:34:47 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:54792: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)36.135.62.831814991j  -a' ossec13001i$Exim Auth failed2025-11-18 11:35:15 dovecot_login authenticator failed for ([202.156.16.91]) [202.156.16.91]:51229: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)202.156.16.911880251*  e-% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:34:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841y  -# ossec13001iExim Auth failed2025-11-18 11:34:03 dovecot_login authenticator failed for (pppoe-87-76-4.158.evolife.su) [87.76.4.158]:60520: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)87.76.4.1582017370 W' ossec9708iDovecot Aborted Login with empty userNov 18 11:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034(  e%) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:34:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<5Z9UW99DRIkv7PP+>47.236.243.2541880251.  e1) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:34:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=164.92.185.1012921044d  -Q+ ossec13001iExim Auth failed2025-11-18 11:33:53 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:19004: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)181.191.136.1423469034s  -q) ossec13001iExim Auth failed2025-11-18 11:33:49 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:35256: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)125.20.228.1461269750s  -o+ ossec13001iExim Auth failed2025-11-18 11:33:41 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:36339: 535 Incorrect authentication data (set_id=hello)201.183.225.1563658394p  -m' ossec13001iExim Auth failed2025-11-18 11:33:26 dovecot_login authenticator failed for ([168.149.213.8]) [168.149.213.8]:46161: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)168.149.213.86252001V~  -9' ossec13001iExim Auth failed2025-11-18 11:32:56 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:41361: 535 Incorrect authentication data (set_id=contato)1.235.192.1311835841c}  -S' ossec13001iExim Auth failed2025-11-18 11:32:40 dovecot_login authenticator failed for ([1.237.155.150]) [1.237.155.150]:60562: 535 Incorrect authentication data (set_id=orders@deproi.com.br)1.237.155.1501835841d|  -W% ossec13001iwExim Auth failed2025-11-18 11:32:22 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:52750: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)111.26.67.361814991g{  -]' ossec13001iExim Auth failed2025-11-18 11:33:15 dovecot_login authenticator failed for ([91.219.196.17]) [91.219.196.17]:58460: 535 Incorrect authentication data (set_id=hello@maringaparts.com.br)91.219.196.17690791 ( ! $(k  -c' ossec13001i*Exim Auth failed2025-11-18 11:35:21 dovecot_login authenticator failed for (syn-065-032-144-232.res.spectrum.com) [65.32.144.232]:57428: 535 Incorrect authentication data (set_id=contato)65.32.144.2326252001f  U1' ossec11001i_Deferred login on the cpanel service[2025-11-18 11:36:14 -0300] info [webmaild] 177.16.29.122 - compras@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing177.16.29.1223469034h  -[) ossec13001iBExim Auth failed2025-11-18 11:35:45 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:39273: 535 Incorrect authentication data (set_id=info@adlondrina.com.br)190.223.53.2343932488V  -7) ossec13001iPExim Auth failed2025-11-18 11:35:59 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:57828: 535 Incorrect authentication data (set_id=info)120.29.140.1401835841b  -O) ossec13001i4Exim Auth failed2025-11-18 11:35:31 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:42865: 535 Incorrect authentication data (set_id=ieqcampocomprido)50.187.155.1306252001+  e1# ossec9710iaDovecot Auth failed on disconnected session.Nov 18 11:36:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001  W' ossec9708iTDovecot Aborted Login with empty userNov 18 11:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+  e/% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:34:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841_ -G) ossec13001iExim Auth failed2025-11-18 11:34:34 dovecot_login authenticator failed for (User) [177.74.174.120]:54571: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)177.74.174.1203469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 11:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034X  -;) ossec13001iExim Auth failed2025-11-18 11:34:20 dovecot_login authenticator failed for ([220.82.247.216]) [220.82.247.216]:59520: 535 Incorrect authentication data (set_id=cpfnc2)220.82.247.2161835841b  -U% ossec13001i$Exim Auth failed2025-11-18 11:35:14 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:57057: 535 Incorrect authentication data (set_id=ferramentaria)37.157.98.80453733t  -u' ossec13001iExim Auth failed2025-11-18 11:34:40 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:40185: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)213.41.173.773017382  -;' ossec13001iExim Auth failed2025-11-18 11:35:01 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:36948: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)61.95.198.1381269750  -+ ossec13001iExim Auth failed2025-11-18 11:35:01 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:49386: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)203.198.173.1371819730w  -w+ ossec13001iExim Auth failed2025-11-18 11:34:55 dovecot_login authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:58464: 535 Incorrect authentication data (set_id=atualizacoes)122.187.225.2201269750 *  f\RH>~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &  ~ t j ` V L B 8 . $    > z 4 R p f H \   * bX:Nv0&Dl|^rTJh,"@6xZ2PF(<nd ~t8j`.$VLBpz4\ > 4*   l b X N D v : 0 &    | J  @ , " r   6 h ^ T x d Z P n F < 2 (   ix. i- i- i- i- i- i- ix. i- i- i- i- i- i>. i^. iZ. iT. i@. i. i. i. i$. i. i . i". i. i. i. i. i. i. i. i. i. i. i.~ i.} i.| i.{ i.z i.y i.x i.w i.v i.u i.t i.s if.r iZ.q iF.p ip.o in.n iP.m iN.l iJ.k i~.j ib.i i,.h i$.g i6.f i*.e i&.d i.c i@.b i8.a i.` i._ i.^ i.] i.\ i.[ i.Z i.Y i.X i.W i.V i.U i.T i.S i.R i.Q i.P i.O i.N i.M i.L i.K it.J if.I i.H ip.G ib.F i.E i.D i.C iz.B ip.A in.@ ih.? i.> ib.= i8.< i2.; i..: i&.9 i.8 i.7 i.6 i.5 i.4 i.3 i.2 i.1 i.0 i./ i.. i.- i., i.+ i.* i.) i.( i.' i.& i.% i.$ i|.# i." i.! i. iz. iq. im. i. i. i6. i*. i_. iB. ia. iT. iP. i4. i$. i$. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i- i- i- i- i- i- i- i- i- i- i- i- iy- iw- iw- io- im- ii- ie- iW- iS- iM- iG- iE- iC- i=- i=- i9- i/- i%- i- i - i - i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- io- ik- ia- iU- iS- iQ- iM- iM- iE- iC- iC- iA- iA- i?- i?- i7- i3- i-- i-- i+- i'- i!- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i- i-  { q O#47Mpg(  -Y) ossec13001iExim Auth failed2025-11-18 11:37:37 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:49331: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)118.41.142.1641835841' W' ossec9708iDovecot Aborted Login with empty userNov 18 11:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034e&  -Y% ossec13001iExim Auth failed2025-11-18 11:37:23 dovecot_login authenticator failed for 221-120-4-32.emome-ip.hinet.net [221.120.4.32]:32914: 535 Incorrect authentication data (set_id=financeiro)221.120.4.321668284a%  -U% ossec13001iExim Auth failed2025-11-18 11:36:47 dovecot_plain authenticator failed for (tarcae) [65.20.149.93]:36591: 535 Incorrect authentication data (set_id=design.user.sales@inovasite.com)65.20.149.9399237Y$  -;+ ossec13001iExim Auth failed2025-11-18 11:36:47 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:57522: 535 Incorrect authentication data (set_id=info)125.139.124.1201835841f#  -Y' ossec13001i|Exim Auth failed2025-11-18 11:36:42 dovecot_plain authenticator failed for (prolots) [76.190.155.43]:49020: 535 Incorrect authentication data (set_id=design.user.sales@inovasite.com)76.190.155.436252001y"  -}) ossec13001iExim Auth failed2025-11-18 11:37:15 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:64100: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)116.48.149.1231819730k!  -g' ossec13001iExim Auth failed2025-11-18 11:37:05 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:36100: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)65.20.205.22899237(  e'' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:36:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001  e' ossec9710izDovecot Auth failed on disconnected session.Nov 18 11:36:40 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=177.72.185.80, lip=200.150.196.245, TLS, session=<7cJRY99DS5WxSLlQ>177.72.185.803469034 W' ossec9708iqDovecot Aborted Login with empty userNov 18 11:36:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034l  -c) ossec13001imExim Auth failed2025-11-18 11:36:28 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:50878: 535 Incorrect authentication data (set_id=info@radiosarabrasil.fm.br)121.179.93.14718358417  eE' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:37:15 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=37.221.178.80, lip=200.150.196.245, TLS, session=37.221.178.803194884#  e) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:36:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841  k' ossec9709i6Multiple Dovecot Aborted Logins with empty userNov 18 11:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   w  X7  -;) ossec13001iExim Auth failed2025-11-18 11:39:08 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:51582: 535 Incorrect authentication data (set_id=bianca)83.239.171.2262017370Q6  -3% ossec13001iExim Auth failed2025-11-18 11:39:01 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:42033: 535 Incorrect authentication data (set_id=bianca)95.35.29.192294640l5  -c) ossec13001iExim Auth failed2025-11-18 11:38:55 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:54706: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)186.97.203.1653686110i4  -]+ ossec13001iExim Auth failed2025-11-18 11:38:55 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:41902: 535 Incorrect authentication data (set_id=help)213.130.207.177597427i3  -_' ossec13001iExim Auth failed2025-11-18 11:38:44 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:53285: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)27.124.65.13812697502  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8QnWbN9DLLqxV3kv>177.87.121.473469034i1  -_' ossec13001iExim Auth failed2025-11-18 11:38:46 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:56846: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)182.95.52.19412697500  -) ossec13001iExim Auth failed2025-11-18 11:38:45 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:49088: 535 Incorrect authentication data (set_id=help@maringaparts.com.br)95.229.202.1973175395x/  -}' ossec13001iExim Auth failed2025-11-18 11:38:33 dovecot_login authenticator failed for 111-70-28-243.emome-ip.hinet.net [111.70.28.243]:48511: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)111.70.28.2431668284a.  -S% ossec13001iExim Auth failed2025-11-18 11:39:19 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:49658: 535 Incorrect authentication data (set_id=bianca)86.111.91.69690791,-  e/' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:38:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<7czra99DoLxSczCz>82.115.48.1791522867),  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:38:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750+  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d*  -U' ossec13001iExim Auth failed2025-11-18 11:37:50 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:56552: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)93.119.19.1722510769)  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:37:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=77.76.128.35, lip=200.150.196.245, TLS, session=77.76.128.35732800    &~|KgG  -[' ossec13001ipExim Auth failed2025-11-18 11:40:47 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:7172: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)103.161.93.531269750F W' ossec9708ibDovecot Aborted Login with empty userNov 18 11:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034E 3C% ossec11301iNew FTP connection.Nov 18 11:41:15 hosting pure-ftpd: (?@20.29.22.204) [INFO] New connection from 20.29.22.20420.29.22.2046252001-D  e/) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:41:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841&C  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:41:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730TB  -5' ossec13001izExim Auth failed2025-11-18 11:40:56 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:57392: 535 Incorrect authentication data (set_id=paulo)188.231.3.2463017382$A 3K) ossec11301ipNew FTP connection.Nov 18 11:40:46 hosting pure-ftpd: (?@40.124.175.201) [INFO] New connection from 40.124.175.20140.124.175.2016252001k@  -a) ossec13001inExim Auth failed2025-11-18 11:40:45 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:53086: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)188.126.240.802661886v?  -w) ossec13001ihExim Auth failed2025-11-18 11:40:39 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:44860: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)117.248.201.941269750c>  -Q) ossec13001iExim Auth failed2025-11-18 11:41:02 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:47618: 535 Incorrect authentication data (set_id=paulo)111.220.199.982077456s=  -y# ossec13001ibExim Auth failed2025-11-18 11:40:33 dovecot_login authenticator failed for (95.3.36.154.static.ttnet.com.tr) [95.3.36.154]:41607: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)95.3.36.154298795+<  e++ ossec9710i8Dovecot Auth failed on disconnected session.Nov 18 11:39:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758b;  -Q' ossec13001i2Exim Auth failed2025-11-18 11:39:45 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:55440: 535 Incorrect authentication data (set_id=bianca)47.18.200.2426252001`:  -K) ossec13001i.Exim Auth failed2025-11-18 11:39:40 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:41352: 535 Incorrect authentication data (set_id=isabellylisboa)152.52.231.20212697509 W' ossec9708i&Dovecot Aborted Login with empty userNov 18 11:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034|8  -+ ossec13001iExim Auth failed2025-11-18 11:39:22 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:44642: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)121.135.188.1251835841 # 8 O 6 E Z H%QhpX  -q# ossec13001iExim Auth failed2025-11-18 11:43:13 dovecot_login authenticator failed for 111-70-32-3.emome-ip.hinet.net [111.70.32.3]:54605: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)111.70.32.31668284pW  -k) ossec13001iExim Auth failed2025-11-18 11:43:09 dovecot_login authenticator failed for 146.100.50.210.sta.wbroadband.net.au [210.50.100.146]:33077: 535 Incorrect authentication data (set_id=fabio.vendas)210.50.100.1462077456QV  -/' ossec13001iExim Auth failed2025-11-18 11:43:01 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:57993: 535 Incorrect authentication data (set_id=it)14.37.206.1361835841eU  -U+ ossec13001iExim Auth failed2025-11-18 11:42:02 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:59657: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)194.116.236.137298795PT  -/% ossec13001iExim Auth failed2025-11-18 11:41:37 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:39230: 535 Incorrect authentication data (set_id=help)61.72.59.1061835841S  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034TR  -5' ossec13001iExim Auth failed2025-11-18 11:41:22 dovecot_login authenticator failed for ([60.216.89.122]) [60.216.89.122]:60320: 535 Incorrect authentication data (set_id=paulo)60.216.89.1221814991Q 3C% ossec11301iNew FTP connection.Nov 18 11:41:46 hosting pure-ftpd: (?@20.65.193.19) [INFO] New connection from 20.65.193.1920.65.193.196252001TP  -5' ossec13001iExim Auth failed2025-11-18 11:41:23 dovecot_login authenticator failed for ([154.203.70.75]) [154.203.70.75]:45492: 535 Incorrect authentication data (set_id=paulo)154.203.70.753374766, rip=177.87.121.47, lip=200.150.196.245, session=<0z+Jd99DqqexV3kv>177.87.121.473469034eK -Q+ ossec13001iExim Auth failed2025-11-18 11:41:06 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18825: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)181.191.136.1423469034_J -G) ossec13001itExim Auth failed2025-11-18 11:40:50 dovecot_login authenticator failed for (User) [177.74.174.120]:57341: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)177.74.174.1203469034I  -+ ossec13001ifExim Auth failed2025-11-18 11:40:37 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:37617: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)122.187.229.1191269750YH  -=) ossec13001iExim Auth failed2025-11-18 11:41:10 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:33014: 535 Incorrect authentication data (set_id=adriana)182.227.214.331835841  4Vz`Qg`h  -M' ossec13001i,Exim Auth failed2025-11-18 11:43:56 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49528: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)123.58.215.721819730_g  -G+ ossec13001i$Exim Auth failed2025-11-18 11:43:47 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:36388: 535 Incorrect authentication data (set_id=formula316)171.244.140.1341562822]f  -I% ossec13001i6Exim Auth failed2025-11-18 11:44:05 dovecot_login authenticator failed for ([190.15.98.153]) [190.15.96.26]:35498: 535 Incorrect authentication data (set_id=andre.nascimento)190.15.96.263469034fe  -W) ossec13001i*Exim Auth failed2025-11-18 11:43:54 dovecot_login authenticator failed for ([118.123.116.93]) [118.123.116.93]:37738: 535 Incorrect authentication data (set_id=offers@deproi.com.br)118.123.116.931814991 d  -!) ossec13001i&Exim Auth failed2025-11-18 11:43:50 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:48602: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)181.50.250.1893686110c W' ossec9708iDovecot Aborted Login with empty userNov 18 11:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Xb  -;) ossec13001i@Exim Auth failed2025-11-18 11:44:16 dovecot_login authenticator failed for ([202.111.183.30]) [202.111.183.30]:36542: 535 Incorrect authentication data (set_id=offers)202.111.183.301814991Za  -?) ossec13001i8Exim Auth failed2025-11-18 11:44:07 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:33897: 535 Incorrect authentication data (set_id=salamuni)210.219.232.341835841Z`  -?) ossec13001iExim Auth failed2025-11-18 11:43:16 dovecot_login authenticator failed for ([118.122.87.186]) [118.122.87.186]:55570: 535 Incorrect authentication data (set_id=salamuni)118.122.87.1861814991b_  -S% ossec13001iExim Auth failed2025-11-18 11:43:15 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:51138: 535 Incorrect authentication data (set_id=eduardo)174.79.87.536252001a^  -S# ossec13001iExim Auth failed2025-11-18 11:42:55 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:34385: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)36.39.140.21835841r]  -o) ossec13001iExim Auth failed2025-11-18 11:42:55 dovecot_login authenticator failed for ([31.128.158.111]) [31.128.158.111]:49694: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)31.128.158.1112017370%\  -W' ossec13001iExim Auth failed2025-11-18 11:42:59 dovecot_login authenticator failed for 158.45.169.34.bc.googleusercontent.com (7.26.82.34.bc.googleusercontent.com) [34.169.45.158]:14938: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)34.169.45.1586252001`[  -S% ossec13001iExim Auth failed2025-11-18 11:42:49 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:38203: 535 Incorrect authentication data (set_id=it@maringaparts.com.br)65.20.191.1299237Z  -' ossec13001iExim Auth failed2025-11-18 11:42:38 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:51805: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)35.130.111.986252001Y W' ossec9708iDovecot Aborted Login with empty userNov 18 11:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 V }j`,5V[w  -E% ossec13001iExim Auth failed2025-11-18 11:46:10 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:59680: 535 Incorrect authentication data (set_id=administrativo1)103.29.62.511269750dv  -[% ossec13001iExim Auth failed2025-11-18 11:46:05 dovecot_plain authenticator failed for (sphabled) [65.20.184.80]:43755: 535 Incorrect authentication data (set_id=support@palestrantexavier.com.br)65.20.184.8099237 u  -#' ossec13001iExim Auth failed2025-11-18 11:45:59 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:51222: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)177.44.71.24434690340t  e9% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:46:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001%s  e%% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:45:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103]r  -K% ossec13001ifExim Auth failed2025-11-18 11:44:52 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:47412: 535 Incorrect authentication data (set_id=aginfo)2.55.100.104294640,q  e/' ossec9710iZDovecot Auth failed on disconnected session.Nov 18 11:44:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001_p  -K' ossec13001iFExim Auth failed2025-11-18 11:44:21 dovecot_login authenticator failed for ([178.66.185.88]) [178.66.185.88]:49206: 535 Incorrect authentication data (set_id=andre.nascimento)178.66.185.882017370&o  e%% ossec9710ipDovecot Auth failed on disconnected session.Nov 18 11:45:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841n  W' ossec9708inDovecot Aborted Login with empty userNov 18 11:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034m  k' ossec9709iPMultiple Dovecot Aborted Logins with empty userNov 18 11:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gl  -Y) ossec13001iNExim Auth failed2025-11-18 11:44:30 dovecot_login authenticator failed for ([111.53.246.227]) [111.53.246.227]:56437: 535 Incorrect authentication data (set_id=aginfo@transol.com.br)111.53.246.2271814991Zk  -?) ossec13001iJExim Auth failed2025-11-18 11:44:25 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:44786: 535 Incorrect authentication data (set_id=salamuni)140.84.188.1403996063)j e+% ossec9710i~Dovecot Auth failed on disconnected session.Nov 18 11:45:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=193.30.97.33272103#i  e' ossec9710ibDovecot Auth failed on disconnected session.Nov 18 11:44:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<8YVXgd9DiL0+PIOJ>62.60.131.137130758 +* *T&2O+   -K) ossec13001iExim Auth failed2025-11-18 11:47:25 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:34836: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)179.48.229.1173469034_  -M% ossec13001iExim Auth failed2025-11-18 11:46:28 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:59518: 535 Incorrect authentication data (set_id=promo@deproi.com.br)38.226.118.03469034p  -k) ossec13001iExim Auth failed2025-11-18 11:47:11 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:44280: 535 Incorrect authentication data (set_id=financeiro)72.239.139.1626252001*  e'+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:47:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822R  -3% ossec13001iExim Auth failed2025-11-18 11:46:51 dovecot_login authenticator failed for ([45.148.10.30]) [45.148.10.30]:53516: 535 Incorrect authentication data (set_id=bounce)45.148.10.302750405W  -9) ossec13001iExim Auth failed2025-11-18 11:46:43 dovecot_login authenticator failed for ([116.232.12.113]) [116.232.12.113]:15458: 535 Incorrect authentication data (set_id=promo)116.232.12.1131814991l  -g% ossec13001iExim Auth failed2025-11-18 11:46:42 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:52488: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)27.24.141.881814991P  -/% ossec13001iExim Auth failed2025-11-18 11:46:26 dovecot_login authenticator failed for ([45.148.10.26]) [45.148.10.26]:62564: 535 Incorrect authentication data (set_id=1234)45.148.10.262750405m  -c+ ossec13001iExim Auth failed2025-11-18 11:47:12 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:39706: 535 Incorrect authentication data (set_id=fabio.vendas)121.202.146.1441819730q~  -m) ossec13001iExim Auth failed2025-11-18 11:46:47 dovecot_login authenticator failed for ([58.226.255.240]) [58.226.255.240]:2281: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)58.226.255.2401835841)}  e)' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:46:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001_|  -G+ ossec13001iExim Auth failed2025-11-18 11:46:33 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18966: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1423469034{ W' ossec9708iDovecot Aborted Login with empty userNov 18 11:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690343z  eA# ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:45:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<+KQehN9DTI9CYSpH>66.97.42.713865483y W' ossec9708iDovecot Aborted Login with empty userNov 18 11:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Rx  -3% ossec13001iExim Auth failed2025-11-18 11:46:17 dovecot_login authenticator failed for ([45.148.10.31]) [45.148.10.31]:62685: 535 Incorrect authentication data (set_id=design)45.148.10.312750405 6  juG6b  -O) ossec13001iExim Auth failed2025-11-18 11:49:42 dovecot_login authenticator failed for ([216.146.49.206]) [216.146.49.206]:58428: 535 Incorrect authentication data (set_id=it@deproi.com.br)216.146.49.2066252001'  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:49:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758*  e)) ossec9710i>Dovecot Auth failed on disconnected session.Nov 18 11:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750q  -q% ossec13001i^Exim Auth failed2025-11-18 11:49:02 dovecot_login authenticator failed for host86-128-93-57.range86-128.btcentralplus.com [86.128.93.57]:56332: 535 Incorrect authentication data (set_id=contato)86.128.93.572635167'  e#) ossec9710iZDovecot Auth failed on disconnected session.Nov 18 11:48:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<6bwgkN9DMuykXLll>164.92.185.1012921044g  -Y) ossec13001iTExim Auth failed2025-11-18 11:48:51 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:56522: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)220.67.122.2301835841 W' ossec9708i@Dovecot Aborted Login with empty userNov 18 11:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.4734690340  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:47:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.751814991  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:47:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034^  -G) ossec13001iExim Auth failed2025-11-18 11:47:28 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:51782: 535 Incorrect authentication data (set_id=fabio.vendas)223.167.203.561814991  W' ossec9708i$Dovecot Aborted Login with empty userNov 18 11:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7SYAjd9D9I2xV3kv>177.87.121.473469034)  e%+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:47:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<9hSii99DMqZo7MS0>104.236.196.1806252001}  -+ ossec13001i Exim Auth failed2025-11-18 11:47:40 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:33396: 535 Incorrect authentication data (set_id=contato)122.170.105.2191269750s  -q) ossec13001i"Exim Auth failed2025-11-18 11:48:01 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:46084: 535 Incorrect authentication data (set_id=alex.vendas)122.187.229.991269750k  -e% ossec13001iExim Auth failed2025-11-18 11:47:49 dovecot_login authenticator failed for ([60.21.209.27]) [60.21.209.27]:62473: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)60.21.209.271814991 ( ( Q  EBmJaqT&  -3) ossec13001iExim Auth failed2025-11-18 11:50:46 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:38664: 535 Incorrect authentication data (set_id=hr)129.80.228.2316252001M%  -+# ossec13001iExim Auth failed2025-11-18 11:50:41 dovecot_login authenticator failed for ([59.23.3.146]) [59.23.3.146]:43982: 535 Incorrect authentication data (set_id=news)59.23.3.1461835841l$  -c) ossec13001iExim Auth failed2025-11-18 11:50:42 dovecot_login authenticator failed for ([59.110.5.198]) [36.132.129.251]:6315: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)36.132.129.2511814991e#  -W' ossec13001iExim Auth failed2025-11-18 11:50:37 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:59618: 535 Incorrect authentication data (set_id=hr@maringaparts.com.br)95.181.244.442017370"  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034Q!  -1% ossec13001ixExim Auth failed2025-11-18 11:49:27 dovecot_login authenticator failed for ([45.148.10.39]) [45.148.10.39]:59117: 535 Incorrect authentication data (set_id=email)45.148.10.392750405O  --% ossec13001iExim Auth failed2025-11-18 11:50:18 dovecot_login authenticator failed for ([45.148.10.36]) [45.148.10.36]:56943: 535 Incorrect authentication data (set_id=nas)45.148.10.362750405,  e++ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:50:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841R  -3% ossec13001iExim Auth failed2025-11-18 11:49:46 dovecot_login authenticator failed for ([45.148.10.29]) [45.148.10.29]:61648: 535 Incorrect authentication data (set_id=agenda)45.148.10.292750405R  -3% ossec13001i|Exim Auth failed2025-11-18 11:49:31 dovecot_login authenticator failed for ([45.148.10.87]) [45.148.10.87]:50392: 535 Incorrect authentication data (set_id=stores)45.148.10.872750405*  e+' ossec9710i|Dovecot Auth failed on disconnected session.Nov 18 11:49:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=59.24.133.1971835841.  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:49:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=113.161.144.1191562822S  -5% ossec13001ixExim Auth failed2025-11-18 11:49:27 dovecot_login authenticator failed for ([45.148.10.25]) [45.148.10.25]:58968: 535 Incorrect authentication data (set_id=michael)45.148.10.252750405b -K+ ossec13001iExim Auth failed2025-11-18 11:49:49 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18193: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)181.191.136.1423469034 W' ossec9708i~Dovecot Aborted Login with empty userNov 18 11:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -3) ossec13001iExim Auth failed2025-11-18 11:49:54 dovecot_login authenticator failed for ([36.153.164.122]) [36.153.164.122]:32889: 535 Incorrect authentication data (set_id=it)36.153.164.1221814991  3  |5  -' ossec13001iGExim Auth failed2025-11-18 11:52:53 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:56426: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)79.138.90.19526618864 W' ossec9708i3Dovecot Aborted Login with empty userNov 18 11:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034)3  e%+ ossec9710i+Dovecot Auth failed on disconnected session.Nov 18 11:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001e2  -Y% ossec13001iPExim Auth failed2025-11-18 11:53:03 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:59446: 535 Incorrect authentication data (set_id=xavier)181.54.70.403686110%1  e!' ossec9710iNDovecot Auth failed on disconnected session.Nov 18 11:53:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=47.251.44.2106252001_0  -G+ ossec13001iExim Auth failed2025-11-18 11:51:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18184: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)181.191.136.1423469034/ W' ossec9708iDovecot Aborted Login with empty userNov 18 11:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034U.  -7' ossec13001iExim Auth failed2025-11-18 11:51:09 dovecot_login authenticator failed for ([201.88.97.102]) [201.88.97.102]:43694: 535 Incorrect authentication data (set_id=xavier)201.88.97.10234690343-  e9+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:51:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=104.236.196.1806252001o,  -k' ossec13001iExim Auth failed2025-11-18 11:50:50 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:62656: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)209.16.71.2546252001&+  e!) ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:50:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<5K0jlt9D1vevfiX3>175.126.37.2471835841i*  -_) ossec13001iExim Auth failed2025-11-18 11:50:26 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:33468: 535 Incorrect authentication data (set_id=news@maringaparts.com.br)178.158.142.39690791g) -U+ ossec13001iExim Auth failed2025-11-18 11:50:50 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18470: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)181.191.136.1423469034X(  -?% ossec13001iExim Auth failed2025-11-18 11:51:14 dovecot_login authenticator failed for ([45.148.10.34]) [45.148.10.34]:54905: 535 Incorrect authentication data (set_id=doquynhtrang)45.148.10.342750405'  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 5 = j m < VmtSE  -3' ossec13001ifExim Auth failed2025-11-18 11:53:26 dovecot_login authenticator failed for ([45.148.10.122]) [45.148.10.122]:54080: 535 Incorrect authentication data (set_id=ivan)45.148.10.1222750405TD  -5' ossec13001i{Exim Auth failed2025-11-18 11:53:45 dovecot_login authenticator failed for ([45.148.10.124]) [45.148.10.124]:55950: 535 Incorrect authentication data (set_id=maria)45.148.10.12427504053C  e;+ ossec9710imDovecot Auth failed on disconnected session.Nov 18 11:53:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=193.151.137.207130758\B  -I% ossec13001i`Exim Auth failed2025-11-18 11:53:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62477: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758{A  -) ossec13001iExim Auth failed2025-11-18 11:54:08 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:49312: 535 Incorrect authentication data (set_id=envios@comercial.art.br)177.174.95.2453469034O@  --% ossec13001iExim Auth failed2025-11-18 11:54:04 dovecot_login authenticator failed for ([45.148.10.98]) [45.148.10.98]:58969: 535 Incorrect authentication data (set_id=asd)45.148.10.982750405?  k' ossec9709ioMultiple Dovecot Aborted Logins with empty userNov 18 11:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8gaxoN9DFs2xV3kv>177.87.121.473469034R>  -3% ossec13001ifExim Auth failed2025-11-18 11:53:25 dovecot_login authenticator failed for ([45.148.10.37]) [45.148.10.37]:51954: 535 Incorrect authentication data (set_id=server)45.148.10.372750405e=  -W' ossec13001ibExim Auth failed2025-11-18 11:53:22 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:38039: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)45.194.26.1491168579b<  -U# ossec13001iExim Auth failed2025-11-18 11:54:11 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:36077: 535 Incorrect authentication data (set_id=tech)58.8.48.1781605651-;  e1' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:54:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001y:  -{+ ossec13001iExim Auth failed2025-11-18 11:53:51 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:54169: 535 Incorrect authentication data (set_id=tech@deproi.com.br)166.201.209.1526252001O9  --% ossec13001iuExim Auth failed2025-11-18 11:53:40 dovecot_login authenticator failed for ([45.148.10.64]) [45.148.10.64]:63766: 535 Incorrect authentication data (set_id=noc)45.148.10.642750405t8  -s+ ossec13001iExim Auth failed2025-11-18 11:53:55 dovecot_plain authenticator failed for (temee) [178.250.191.189]:38544: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)178.250.191.189458258Y7  -=) ossec13001iExim Auth failed2025-11-18 11:53:50 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:38753: 535 Incorrect authentication data (set_id=contato)27.212.198.2261814991j6  -a' ossec13001i`Exim Auth failed2025-11-18 11:53:20 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:49726: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)103.93.37.1781269750  "?FS9Y-P[3U  A_' ossec11302iFTP Authentication failed.Nov 18 11:54:56 hosting pure-ftpd: (?@34.76.134.123) [WARNING] Authentication failed for user [anonymous]34.76.134.1232802361qT  -k+ ossec13001iExim Auth failed2025-11-18 11:54:56 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:37988: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)123.209.104.1422077456YS -=' ossec13001iExim Auth failed2025-11-18 11:54:47 dovecot_login authenticator failed for (sulindustrial.com) [61.50.119.110]:14166: 535 Incorrect authentication data (set_id=nologin)61.50.119.1101814991(R  e#+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:55:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=125.130.113.2041835841\Q  -C) ossec13001iExim Auth failed2025-11-18 11:55:15 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:42636: 535 Incorrect authentication data (set_id=secretaria)85.116.125.2392017370P W' ossec9708iDovecot Aborted Login with empty userNov 18 11:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034oO  -k' ossec13001iExim Auth failed2025-11-18 11:54:28 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:58752: 535 Incorrect authentication data (set_id=envios)212.51.34.2292510769uN  -y% ossec13001iExim Auth failed2025-11-18 11:54:24 dovecot_login authenticator failed for (static.bb.btd.59.99.153.21.bsnl.in) [59.99.153.21]:25771: 535 Incorrect authentication data (set_id=finance@deproi.com.br)59.99.153.211269750_M  -I) ossec13001iExim Auth failed2025-11-18 11:54:56 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:40929: 535 Incorrect authentication data (set_id=paulo)46.212.110.2373144096!L 3G' ossec11301iNew FTP connection.Nov 18 11:54:51 hosting pure-ftpd: (?@34.76.134.123) [INFO] New connection from 34.76.134.12334.76.134.1232802361^K  -I' ossec13001iExim Auth failed2025-11-18 11:54:51 dovecot_login authenticator failed for ([45.148.10.118]) [45.148.10.118]:62510: 535 Incorrect authentication data (set_id=amministrazione)45.148.10.1182750405hJ  -]' ossec13001iExim Auth failed2025-11-18 11:54:28 dovecot_login authenticator failed for ([27.39.130.144]) [27.39.130.144]:36014: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)27.39.130.1441814991-I  e-+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:55:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=112.217.233.24218358410H  e7' ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:55:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<9bxnpt9DloQtPZWl>45.61.149.1656252001iG  -_' ossec13001iExim Auth failed2025-11-18 11:54:36 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:38075: 535 Incorrect authentication data (set_id=finance)74.218.95.1546252001F  W' ossec9708iDovecot Aborted Login with empty userNov 18 11:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+aJ2ot9DFt+xV3kv>177.87.121.473469034 : 9   "O6:Se  -5% ossec13001ieExim Auth failed2025-11-18 11:57:41 dovecot_login authenticator failed for ([45.148.10.35]) [45.148.10.35]:59916: 535 Incorrect authentication data (set_id=kontakt)45.148.10.352750405Ad  [_+ ossec5706i5SSH insecure connection attempt (scan).Nov 18 11:56:52 hosting sshd[5755]: Did not receive identification string from 162.216.149.170 port 64500162.216.149.1706252001c  k' ossec9709i!Multiple Dovecot Aborted Logins with empty userNov 18 11:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034kb  -_+ ossec13001iExim Auth failed2025-11-18 11:56:21 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:41404: 535 Incorrect authentication data (set_id=billing)128.106.196.1501880251ea  -U) ossec13001iOExim Auth failed2025-11-18 11:57:17 dovecot_login authenticator failed for ([93.157.254.194]) [93.157.254.194]:42638: 535 Incorrect authentication data (set_id=press@deproi.com.br)93.157.254.19420173703`  e=' ossec9710iIDovecot Auth failed on disconnected session.Nov 18 11:57:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001*_  e-% ossec9710iGDovecot Auth failed on disconnected session.Nov 18 11:57:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841^  W' ossec9708i?Dovecot Aborted Login with empty userNov 18 11:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034O]  --% ossec13001iExim Auth failed2025-11-18 11:55:44 dovecot_login authenticator failed for ([45.148.10.97]) [45.148.10.97]:59354: 535 Incorrect authentication data (set_id=111)45.148.10.972750405V\  -9' ossec13001iExim Auth failed2025-11-18 11:55:34 dovecot_login authenticator failed for ([45.148.10.120]) [45.148.10.120]:54958: 535 Incorrect authentication data (set_id=exadmin)45.148.10.1202750405[ W' ossec9708iDovecot Aborted Login with empty userNov 18 11:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034mZ  -e) ossec13001iExim Auth failed2025-11-18 11:55:59 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:54428: 535 Incorrect authentication data (set_id=billing@maringaparts.com.br)223.166.87.1451814991.Y  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=64.23.244.396252001 X  3G' ossec11301iNew FTP connection.Nov 18 11:55:51 hosting pure-ftpd: (?@115.231.78.11) [INFO] New connection from 115.231.78.11115.231.78.111814991$W  e## ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:55:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<2LqLqN9D9tVCYSpH>66.97.42.713865483wV  -{' ossec13001iExim Auth failed2025-11-18 11:55:04 dovecot_login authenticator failed for ([152.52.234.232]) [103.251.31.34]:44604: 535 Incorrect authentication data (set_id=secretaria@contabilidadefollador.com.br)103.251.31.341269750   6 * $=cvnu  -g) ossec13001iExim Auth failed2025-11-18 11:59:02 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:44522: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)125.154.62.2291835841t W' ossec9708iDovecot Aborted Login with empty userNov 18 11:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7raGst9DYpWxV3kv>177.87.121.473469034Rs  -3% ossec13001iExim Auth failed2025-11-18 11:58:23 dovecot_login authenticator failed for ([45.148.10.69]) [45.148.10.69]:64902: 535 Incorrect authentication data (set_id=camara)45.148.10.692750405Or  -/# ossec13001iExim Auth failed2025-11-18 11:59:10 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:50340: 535 Incorrect authentication data (set_id=envios)180.71.9.311835841Yq  -=) ossec13001iExim Auth failed2025-11-18 11:58:50 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:35412: 535 Incorrect authentication data (set_id=compras)188.170.40.2312017370ip  -]) ossec13001iExim Auth failed2025-11-18 11:58:45 dovecot_login authenticator failed for ([183.249.89.108]) [183.249.89.108]:48723: 535 Incorrect authentication data (set_id=envios@comercial.art.br)183.249.89.1081814991Vo  -7) ossec13001iExim Auth failed2025-11-18 11:58:40 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:42390: 535 Incorrect authentication data (set_id=info)154.144.243.932542007cn  -W# ossec13001iExim Auth failed2025-11-18 11:58:37 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:39416: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)14.98.28.431269750vm  -u+ ossec13001iExim Auth failed2025-11-18 11:58:30 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:58356: 535 Incorrect authentication data (set_id=info@educacionalevangelico.com.br)121.160.166.1611835841Zl  -=+ ossec13001i_Exim Auth failed2025-11-18 11:57:33 dovecot_login authenticator failed for ([122.175.193.134]) [122.175.193.134]:57688: 535 Incorrect authentication data (set_id=press)122.175.193.1341269750*k  e'+ ossec9710iYDovecot Auth failed on disconnected session.Nov 18 11:57:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=183.215.179.1541814991j  -+ ossec13001iyExim Auth failed2025-11-18 11:58:00 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:47592: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)203.198.173.1371819730ci  -U% ossec13001iuExim Auth failed2025-11-18 11:57:56 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:51029: 535 Incorrect authentication data (set_id=feedback)111.70.3.1221668284nh  -g) ossec13001igExim Auth failed2025-11-18 11:57:43 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:52190: 535 Incorrect authentication data (set_id=feedback@maringaparts.com.br)92.126.223.1752017370Sg  -5% ossec13001ieExim Auth failed2025-11-18 11:57:40 dovecot_login authenticator failed for ([45.148.10.44]) [45.148.10.44]:49159: 535 Incorrect authentication data (set_id=billing)45.148.10.442750405f W' ossec9708i]Dovecot Aborted Login with empty userNov 18 11:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8777rt9DgOKxV3kv>177.87.121.473469034 [ 7  'AM3<[]  -G) ossec13001iExim Auth failed2025-11-18 12:00:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:34148: 535 Incorrect authentication data (set_id=comercial@inovasite.com)193.32.162.226798549s  -s' ossec13001iExim Auth failed2025-11-18 12:00:32 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:34462: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)111.26.95.1201814991 W' ossec9708iDovecot Aborted Login with empty userNov 18 12:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p  -k) ossec13001iExim Auth failed2025-11-18 12:00:23 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:37774: 535 Incorrect authentication data (set_id=toro@toromartelinho.com.br)109.207.33.2536290252b  -U# ossec13001i/Exim Auth failed2025-11-18 12:01:03 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:53665: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)221.2.40.101814991P  -/% ossec13001i)Exim Auth failed2025-11-18 12:00:57 dovecot_login authenticator failed for ([58.37.100.53]) [58.37.100.53]:51516: 535 Incorrect authentication data (set_id=toro)58.37.100.531814991d  -U' ossec13001iExim Auth failed2025-11-18 11:59:30 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:48612: 535 Incorrect authentication data (set_id=contato)177.159.99.953469034O~  --% ossec13001iExim Auth failed2025-11-18 12:00:04 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)8.243.166.663686110]}  -C+ ossec13001iExim Auth failed2025-11-18 12:00:00 dovecot_login authenticator failed for ([220.118.190.204]) [220.118.190.204]:45907: 535 Incorrect authentication data (set_id=partners)220.118.190.2041835841.|  e5% ossec9710iDovecot Auth failed on disconnected session.Nov 18 11:59:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841{  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 11:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034.z  e/+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:00:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=107.134.191.1856252001y  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034dx  -S) ossec13001iExim Auth failed2025-11-18 11:59:53 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:34149: 535 Incorrect authentication data (set_id=info@1075fm.com.br)120.29.140.1401835841kw  -c' ossec13001iExim Auth failed2025-11-18 11:59:47 dovecot_login authenticator failed for ([94.19.168.104]) [94.19.168.104]:59098: 535 Incorrect authentication data (set_id=partners@maringaparts.com.br)94.19.168.1042017370nv  -m% ossec13001iExim Auth failed2025-11-18 11:58:25 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:38348: 535 Incorrect authentication data (set_id=assessoria)5.199.161.79597427 % 6 F   9Y@w SQ) ossec11000iLogin failed on the cpanel service.[2025-11-18 12:02:59 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect191.177.160.6434690340 UA) ossec11001iDeferred login on the cpanel service[2025-11-18 12:02:52 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect191.177.160.643469034w  -}% ossec13001iExim Auth failed2025-11-18 12:02:48 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:49727: 535 Incorrect authentication data (set_id=legal@maringaparts.com.br)75.64.207.526252001,  e3# ossec9710i}Dovecot Auth failed on disconnected session.Nov 18 12:02:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=23.95.63.996252001  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034\  -C) ossec13001iExim Auth failed2025-11-18 12:02:23 dovecot_login authenticator failed for (host-by.00.net) [103.77.211.101]:50269: 535 Incorrect authentication data (set_id=junior.gomes)103.77.211.10118197309 E ossec2501iUser authentication failure. cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127%  e%# ossec9710isDovecot Auth failed on disconnected session.Nov 18 12:02:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<1p96v99DeKpCYSpH>66.97.42.713865483`  -O' ossec13001ioExim Auth failed2025-11-18 12:02:07 dovecot_plain authenticator failed for (miateny) [178.16.90.246]:34178: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)178.16.90.246690791  -+ ossec13001ikExim Auth failed2025-11-18 12:02:02 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:54705: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)122.187.227.16412697501  e;' ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 12:01:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=62.60.131.139130758l  -a+ ossec13001iYExim Auth failed2025-11-18 12:01:45 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62425: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)165.154.121.2311605651Q  -3# ossec13001iMExim Auth failed2025-11-18 12:01:32 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:37542: 535 Incorrect authentication data (set_id=rene)187.8.17.383469034 W' ossec9708iMDovecot Aborted Login with empty userNov 18 12:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034W  -;' ossec13001i%Exim Auth failed2025-11-18 12:00:53 dovecot_login authenticator failed for ([45.148.10.119]) [45.148.10.119]:64265: 535 Incorrect authentication data (set_id=accounts)45.148.10.1192750405 + /(+y$  -' ossec13001iExim Auth failed2025-11-18 12:03:48 dovecot_login authenticator failed for 62-122-195-14.broadband.opcom.ru [62.122.195.14]:48626: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)62.122.195.142017370i#  -]) ossec13001iExim Auth failed2025-11-18 12:03:32 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:57482: 535 Incorrect authentication data (set_id=comercial@inovasite.com)121.73.169.2032186224" W' ossec9708iDovecot Aborted Login with empty userNov 18 12:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034[!  -A) ossec13001iExim Auth failed2025-11-18 12:03:52 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:47574: 535 Incorrect authentication data (set_id=comercial)121.159.71.2491835841]  -M! ossec13001iExim Auth failed2025-11-18 12:03:30 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:42381: 535 Incorrect authentication data (set_id=comercial@inovasite.com)59.51.87.91814991h  -]' ossec13001iExim Auth failed2025-11-18 12:03:20 dovecot_login authenticator failed for 40.ip-217-182-65.eu [217.182.65.40]:59192: 535 Incorrect authentication data (set_id=comercial@inovasite.com)217.182.65.403017382[  -A) ossec13001iExim Auth failed2025-11-18 12:04:09 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:53805: 535 Incorrect authentication data (set_id=comercial)180.137.151.931814991w  -y) ossec13001iExim Auth failed2025-11-18 12:04:06 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:65161: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)70.183.221.1686252001"  e% ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:03:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=8.216.40.2281861060v  -y) ossec13001iExim Auth failed2025-11-18 12:03:40 dovecot_login authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:49008: 535 Incorrect authentication data (set_id=comercial)91.202.230.214798544W  -9) ossec13001iExim Auth failed2025-11-18 12:03:05 dovecot_login authenticator failed for ([112.102.48.161]) [112.102.48.161]:47217: 535 Incorrect authentication data (set_id=legal)112.102.48.1611814991+  e-' ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:02:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=164.92.94.2046252001Y  -C% ossec13001iExim Auth failed2025-11-18 12:02:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53790: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)62.60.131.40130758%  e#% ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:02:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=47.79.88.1991861060t  -s) ossec13001iExim Auth failed2025-11-18 12:02:32 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:52764: 535 Incorrect authentication data (set_id=junior.gomes)178.140.212.922017370  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 12:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 7 W h | $ 9X()3  k' ossec9709i=Multiple Dovecot Aborted Logins with empty userNov 18 12:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6AiXy99DgJyxV3kv>177.87.121.473469034d2  -S) ossec13001i7Exim Auth failed2025-11-18 12:05:26 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:52232: 535 Incorrect authentication data (set_id=sac)151.192.57.1181880251-1  e1' ossec9710i]Dovecot Auth failed on disconnected session.Nov 18 12:06:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.17915228670  W' ossec9708i[Dovecot Aborted Login with empty userNov 18 12:06:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a/  -K+ ossec13001iExim Auth failed2025-11-18 12:04:36 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18412: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)181.191.136.1423469034. W' ossec9708iDovecot Aborted Login with empty userNov 18 12:04:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034,-  e-) ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:04:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387],  -E) ossec13001iExim Auth failed2025-11-18 12:04:26 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:60084: 535 Incorrect authentication data (set_id=aureovieira)121.73.163.2322186224g+  -]' ossec13001iExim Auth failed2025-11-18 12:04:26 dovecot_plain authenticator failed for (phydis) [178.16.90.176]:53502: 535 Incorrect authentication data (set_id=jomma@contabilidadefollador.com.br)178.16.90.176690791T*  ;)% ossec13008i%Mail Recipient rejected2025-11-18 12:05:09 H=(195.3.134.135) [179.0.178.53]:57317 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57317 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034h)  -[) ossec13001i Exim Auth failed2025-11-18 12:04:43 dovecot_plain authenticator failed for (ovorbated) [213.142.48.143]:45008: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)213.142.48.1432017370k(  -c' ossec13001iExim Auth failed2025-11-18 12:04:57 dovecot_login authenticator failed for ([178.66.185.88]) [178.66.185.88]:49230: 535 Incorrect authentication data (set_id=sac@compensadosparana.com.br)178.66.185.882017370\'  -G% ossec13001iExim Auth failed2025-11-18 12:04:06 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:56926: 535 Incorrect authentication data (set_id=ieqcampocomprido)14.97.77.1821269750[&  -A) ossec13001iExim Auth failed2025-11-18 12:03:41 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:56646: 535 Incorrect authentication data (set_id=comercial)125.20.228.1461269750f%  -Y' ossec13001iExim Auth failed2025-11-18 12:03:24 dovecot_login authenticator failed for ([31.173.29.136]) [31.173.29.136]:56348: 535 Incorrect authentication data (set_id=comercial@inovasite.com)31.173.29.1362017370 ~ ~ E ] Ccur~pB  -m' ossec13001iExim Auth failed2025-11-18 12:08:51 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:47198: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)103.249.19.341643084A  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 12:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034p@  -m' ossec13001iExim Auth failed2025-11-18 12:09:04 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:48718: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)182.95.174.181269750T?  ;)% ossec13008iMail Recipient rejected2025-11-18 12:08:52 H=(200.150.196.245) [43.157.34.94]:57846 F= rejected RCPT : "JunkMail rejected - (200.150.196.245) [43.157.34.94]:57846 is in an RBL: Blocked - see https://www.spamcop.net/bl.shtml?43.157.34.94"43.157.34.942921044b>  -U# ossec13001iExim Auth failed2025-11-18 12:08:46 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:37268: 535 Incorrect authentication data (set_id=media@maringaparts.com.br)64.53.7.2316252001V=  -9' ossec13001iExim Auth failed2025-11-18 12:08:38 dovecot_login authenticator failed for ([182.95.57.158]) [182.95.57.158]:34220: 535 Incorrect authentication data (set_id=eliezer)182.95.57.1581269750P<  -/% ossec13001iExim Auth failed2025-11-18 12:08:36 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:49636: 535 Incorrect authentication data (set_id=info)117.135.6.101814991j;  -]+ ossec13001iExim Auth failed2025-11-18 12:07:55 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:55638: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)178.178.194.1352017370\: ;1+ ossec13008iMail Recipient rejected2025-11-18 12:07:35 H=(localhost) [186.249.235.228]:14707 F= rejected RCPT <5GLmoFPeGor4H6W@transol.com.br>: Sender verify failed186.249.235.22834690349 W' ossec9708iDovecot Aborted Login with empty userNov 18 12:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034d8  -Q+ ossec13001iExim Auth failed2025-11-18 12:06:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63771: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)165.154.121.231160565157  e?) ossec9710iyDovecot Auth failed on disconnected session.Nov 18 12:06:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.15918197306 W' ossec9708iyDovecot Aborted Login with empty userNov 18 12:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.47346903465  eA) ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750*4  e)) ossec9710iFDovecot Auth failed on disconnected session.Nov 18 12:05:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=175.126.37.2471835841 6~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~ t j ` V L B 8 . $      z 4 p R f H \ *  > bXvlD:0&N|r^TJ@6h,"Zxnd(PF<2 t`~jLB8.$V*f RH>\4zp  i/ i/ i/ i/ i/ i/ is/ ij/ i/ i{/ iy/ iw/ i/ in/ i/ i/ i/ i8/ i./ i`/ iP/ iL/ i/T i4/S i./R iX/Q i4/P i2/O i0/N i(/M i/L i/K i/J i/I i/H i/G i/F i/E i/D i/C i/B i/@ i/? i/> i/= i/< i/A i/; i/: i/9 i/5 i/8 iy/7 iy/6 i]/1 i[/0 iF/4 i=/3 i7/2 i%/* i/( i /) i// i/. i/- i/, i/+ i/ i/' i/ i/ i/! i/$ i/& i/ i/# i/" i/ i/% i/ i/ i/ i/ i/ i/ i/ i/ i/ i/ i/ i/ i/ i}/ is/ io/ ik/ i]/ iY/ iM/ iM/ i// i)/ i%/ i/ i/ i/ i/ i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. iy. iu. ig. ie. ie. i_. i]. iY. iO. iI. iG. i?. i5. i!. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i{. iu. io. im. if. if. ib. i`. i`. iP. iN. iG. i3. i+. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i. i~. i|. ^  ':2I^sx^R W' ossec9708i.Dovecot Aborted Login with empty userNov 18 12:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034+Q  e+) ossec9710iXDovecot Auth failed on disconnected session.Nov 18 12:10:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=14.225.210.1451562822uP  -w' ossec13001i4Exim Auth failed2025-11-18 12:09:39 dovecot_login authenticator failed for (radiosarabrasil.fm.br) [112.122.54.54]:20946: 535 Incorrect authentication data (set_id=postmaster@radiosarabrasil.fm.br)112.122.54.541814991OO  -/# ossec13001i2Exim Auth failed2025-11-18 12:09:36 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:57058: 535 Incorrect authentication data (set_id=gerson)46.44.40.822017370gN  -[' ossec13001i0Exim Auth failed2025-11-18 12:09:34 dovecot_login authenticator failed for ([222.75.248.46]) [222.75.248.46]:33794: 535 Incorrect authentication data (set_id=newsletter@deproi.com.br)222.75.248.461814991gM  -]% ossec13001i(Exim Auth failed2025-11-18 12:09:27 dovecot_login authenticator failed for ([38.156.1.127]) [38.156.1.127]:53052: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)38.156.1.1273469034eL  -S+ ossec13001iExim Auth failed2025-11-18 12:08:22 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:45066: 535 Incorrect authentication data (set_id=info@cieadep.com)196.203.231.2202464461K  -) ossec13001iExim Auth failed2025-11-18 12:08:44 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:55568: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)93.121.175.2203579143iJ  -_' ossec13001iExim Auth failed2025-11-18 12:08:37 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:48422: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)125.19.188.981269750XI  -A# ossec13001iExim Auth failed2025-11-18 12:09:15 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:54574: 535 Incorrect authentication data (set_id=rafael)46.44.24.402017370VH  -9' ossec13001iExim Auth failed2025-11-18 12:09:11 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:48853: 535 Incorrect authentication data (set_id=compras)112.27.30.2531814991TG  -5' ossec13001iExim Auth failed2025-11-18 12:09:10 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:45759: 535 Incorrect authentication data (set_id=media)200.37.179.833932488(F  -[) ossec13001iExim Auth failed2025-11-18 12:09:06 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:46448: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)179.48.229.1173469034"E  e+ ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:08:43 hosting dovecot: pop3-login: Disconnected: Inactivity (user disabled): user=, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=121.237.178.1331814991\D  -E' ossec13001iExim Auth failed2025-11-18 12:09:13 dovecot_login authenticator failed for (radiosarabrasil.fm.br) [112.122.54.54]:63070: 535 Incorrect authentication data (set_id=nologin)112.122.54.541814991C  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 K)7 H u 4 I/8[T1F[dKb  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1iTN4t9DJLmxV3kv>177.87.121.473469034sa  -o+ ossec13001iExim Auth failed2025-11-18 12:11:48 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:57780: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)128.185.235.1101269750g`  -Y) ossec13001iExim Auth failed2025-11-18 12:11:55 dovecot_login authenticator failed for ([91.102.231.190]) [91.102.231.190]:41186: 535 Incorrect authentication data (set_id=careers@deproi.com.br)91.102.231.1906290252g_  -Y) ossec13001iExim Auth failed2025-11-18 12:11:38 dovecot_login authenticator failed for (dm229.dialup.novoch.ru) [80.254.102.229]:43212: 535 Incorrect authentication data (set_id=administrativo1)80.254.102.2292017370^  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 12:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034]  -' ossec13001iExim Auth failed2025-11-18 12:11:27 dovecot_login authenticator failed for 149.51.222.87.dynamic.jazztel.es [87.222.51.149]:44570: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)87.222.51.1492510769Y\  -=) ossec13001iExim Auth failed2025-11-18 12:12:12 dovecot_login authenticator failed for ([182.135.63.175]) [182.135.63.175]:49858: 535 Incorrect authentication data (set_id=careers)182.135.63.1751814991s[  -s' ossec13001inExim Auth failed2025-11-18 12:10:36 dovecot_login authenticator failed for ([175.10.38.108]) [175.10.38.108]:55046: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)175.10.38.1081814991Z W' ossec9708ijDovecot Aborted Login with empty userNov 18 12:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034gY  -[' ossec13001iExim Auth failed2025-11-18 12:11:15 dovecot_login authenticator failed for (182.239.80.74.hk.chinamobile.com) [182.239.80.74]:37042: 535 Incorrect authentication data (set_id=adriana)182.239.80.741819730SX  ;'% ossec13008iMail Recipient rejected2025-11-18 12:10:58 H=(195.3.134.135) [179.0.178.53]:62184 F= rejected RCPT : "JunkMail rejected - (195.3.134.135) [179.0.178.53]:62184 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"179.0.178.533469034fW  -[% ossec13001izExim Auth failed2025-11-18 12:10:50 dovecot_login authenticator failed for 111-70-13-54.emome-ip.hinet.net [111.70.13.54]:51022: 535 Incorrect authentication data (set_id=alex.vendas)111.70.13.541668284OV  --% ossec13001ivExim Auth failed2025-11-18 12:10:45 dovecot_login authenticator failed for ([45.148.10.81]) [45.148.10.81]:50433: 535 Incorrect authentication data (set_id=crm)45.148.10.812750405kU  -e% ossec13001ipExim Auth failed2025-11-18 12:10:38 dovecot_login authenticator failed for ([112.65.27.43]) [112.65.27.43]:38046: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)112.65.27.431814991nT  -g) ossec13001i>Exim Auth failed2025-11-18 12:09:48 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:64114: 535 Incorrect authentication data (set_id=newsletter)220.246.42.2121819730SS  -5% ossec13001i4Exim Auth failed2025-11-18 12:09:39 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:39260: 535 Incorrect authentication data (set_id=contato)183.99.89.741835841   F \ { X invr  -w) ossec13001iExim Auth failed2025-11-18 12:12:40 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:53889: 535 Incorrect authentication data (set_id=billing@deproi.com.br)201.173.216.163996063iq  -c# ossec13001iExim Auth failed2025-11-18 12:12:40 dovecot_login authenticator failed for ([59.23.3.146]) [59.23.3.146]:52332: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)59.23.3.1461835841p W' ossec9708iDovecot Aborted Login with empty userNov 18 12:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6CGX5N9DSsWxV3kv>177.87.121.473469034do  -S) ossec13001iExim Auth failed2025-11-18 12:12:23 dovecot_login authenticator failed for 194-223-43-103.tpgi.com.au [194.223.43.103]:55750: 535 Incorrect authentication data (set_id=financeiro)194.223.43.1032077456Yn  -=) ossec13001iExim Auth failed2025-11-18 12:13:01 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:38961: 535 Incorrect authentication data (set_id=billing)187.12.112.1863469034Vm  -7) ossec13001iExim Auth failed2025-11-18 12:12:59 dovecot_login authenticator failed for ([178.70.232.110]) [178.70.232.110]:49686: 535 Incorrect authentication data (set_id=info)178.70.232.1102017370el  -W' ossec13001iExim Auth failed2025-11-18 12:12:39 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:47034: 535 Incorrect authentication data (set_id=atualizacoes)202.53.54.1912077456fk  -[% ossec13001iExim Auth failed2025-11-18 12:12:32 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:55833: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)59.22.68.2131835841wj  -w+ ossec13001iExim Auth failed2025-11-18 12:12:31 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:51640: 535 Incorrect authentication data (set_id=junior.gomes)122.184.127.1501269750ki  -a) ossec13001i Exim Auth failed2025-11-18 12:13:13 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:61407: 535 Incorrect authentication data (set_id=financeiro)95.210.105.2023175395h  -K' ossec13001iExim Auth failed2025-11-18 12:13:05 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:45303: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)179.184.33.863469034]g  -G' ossec13001iExim Auth failed2025-11-18 12:13:17 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:50980: 535 Incorrect authentication data (set_id=isabellylisboa)103.251.31.341269750ff  -W+ ossec13001iExim Auth failed2025-11-18 12:12:47 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:39975: 535 Incorrect authentication data (set_id=info@inovasite.com)185.255.212.178732800Se  -5% ossec13001iExim Auth failed2025-11-18 12:12:47 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:37873: 535 Incorrect authentication data (set_id=contato)58.16.201.521814991kd  -a) ossec13001iExim Auth failed2025-11-18 12:12:25 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:58646: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)122.184.120.981269750pc  -m) ossec13001iExim Auth failed2025-11-18 12:12:03 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:59270: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)196.189.59.226337996 I  - M z dqNI  -' ossec13001iExim Auth failed2025-11-18 12:15:18 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:34356: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)182.66.218.261269750  k' ossec9709iZMultiple Dovecot Aborted Logins with empty userNov 18 12:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034o  -k' ossec13001iXExim Auth failed2025-11-18 12:14:30 dovecot_login authenticator failed for ([111.50.73.130]) [111.50.73.130]:42169: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)111.50.73.1301814991+~  e/% ossec9710iVDovecot Auth failed on disconnected session.Nov 18 12:14:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=119.196.18.21835841(}  e%) ossec9710iRDovecot Auth failed on disconnected session.Nov 18 12:14:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=47.236.243.2541880251@|  [_) ossec5706iNSSH insecure connection attempt (scan).Nov 18 12:14:20 hosting sshd[25173]: Did not receive identification string from 162.216.149.89 port 63966162.216.149.896252001{  W' ossec9708ixDovecot Aborted Login with empty userNov 18 12:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034rz  -o) ossec13001ihExim Auth failed2025-11-18 12:14:47 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:33166: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)178.176.229.362017370dy  -Q+ ossec13001iVExim Auth failed2025-11-18 12:14:28 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:55673: 535 Incorrect authentication data (set_id=rodrigo)178.232.137.1273144096Ox  -/# ossec13001iDExim Auth failed2025-11-18 12:14:11 dovecot_login authenticator failed for ([221.4.153.7]) [221.4.153.7]:55896: 535 Incorrect authentication data (set_id=rafael)221.4.153.71814991\w  -C) ossec13001i4Exim Auth failed2025-11-18 12:13:55 dovecot_login authenticator failed for ([183.220.247.85]) [183.220.247.85]:44530: 535 Incorrect authentication data (set_id=financeiro)183.220.247.851814991fv  -[% ossec13001i2Exim Auth failed2025-11-18 12:13:53 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:43633: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)78.81.209.762017370_u  -G+ ossec13001i(Exim Auth failed2025-11-18 12:13:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18763: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)181.191.136.1423469034t W' ossec9708iDovecot Aborted Login with empty userNov 18 12:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034hs  -_% ossec13001iJExim Auth failed2025-11-18 12:14:17 dovecot_login authenticator failed for ([59.10.56.129]) [59.10.56.129]:56656: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)59.10.56.1291835841  [pmA [_) ossec5706i,SSH insecure connection attempt (scan).Nov 18 12:18:03 hosting sshd[28359]: Did not receive identification string from 162.216.150.17 port 64132162.216.150.176252001  k' ossec9709i Multiple Dovecot Aborted Logins with empty userNov 18 12:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 12:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034a  -O' ossec13001iExim Auth failed2025-11-18 12:17:15 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:38416: 535 Incorrect authentication data (set_id=doninha)31.151.70.1502750405w  -}% ossec13001iExim Auth failed2025-11-18 12:17:14 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:60943: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)67.83.30.1996252001b  -U' ossec13001iExim Auth failed2025-11-18 12:16:56 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:41091: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)65.20.167.16099237g  -]% ossec13001iExim Auth failed2025-11-18 12:16:48 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:38021: 535 Incorrect authentication data (set_id=contato)90.164.107.32510769/  e7% ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:16:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=115.71.238.41835841 W' ossec9708iDovecot Aborted Login with empty userNov 18 12:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034T  -9' ossec13001iExim Auth failed2025-11-18 12:15:30 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:41038: 535 Incorrect authentication data (set_id=contato)65.20.251.17099237   -#% ossec13001iExim Auth failed2025-11-18 12:15:56 dovecot_login authenticator failed for 41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:47396: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)41.184.94.752328926'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:15:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=82.156.231.7518149916  eA) ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:15:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730^  -G) ossec13001iExim Auth failed2025-11-18 12:15:33 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.238]:27022: 535 Incorrect authentication data (set_id=fabio.vendas)210.206.24.2381835841'  e%' ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001  t  -w' ossec13001i|Exim Auth failed2025-11-18 12:19:23 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:33412: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)85.29.246.199453733X  -A# ossec13001i`Exim Auth failed2025-11-18 12:18:55 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:61403: 535 Incorrect authentication data (set_id=comercial@inovasite.com)4.205.20.706251999$  e) ossec9710i\Dovecot Auth failed on disconnected session.Nov 18 12:18:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841_  -I) ossec13001iXExim Auth failed2025-11-18 12:18:47 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:43378: 535 Incorrect authentication data (set_id=memaagostinho)211.228.113.271835841p  -k) ossec13001iNExim Auth failed2025-11-18 12:18:38 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:23774: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)111.61.176.2441814991p  -k) ossec13001ivExim Auth failed2025-11-18 12:19:17 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:53345: 535 Incorrect authentication data (set_id=atualizacoes)200.141.211.583469034b  -O) ossec13001ijExim Auth failed2025-11-18 12:19:05 dovecot_login authenticator failed for ([176.115.201.37]) [176.115.201.37]:59248: 535 Incorrect authentication data (set_id=ieqcampocomprido)176.115.201.372017370   -!% ossec13001ihExim Auth failed2025-11-18 12:19:03 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:51551: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)100.37.16.116252001i  -_' ossec13001ibExim Auth failed2025-11-18 12:18:58 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:54544: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)88.84.205.1042017370e  -]% ossec13001iXExim Auth failed2025-11-18 12:18:47 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:60292: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)65.20.191.1299237 W' ossec9708iHDovecot Aborted Login with empty userNov 18 12:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034/  e5' ossec9710iBDovecot Auth failed on disconnected session.Nov 18 12:18:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=82.115.48.1791522867Y  -C# ossec13001iExim Auth failed2025-11-18 12:17:27 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:64608: 535 Incorrect authentication data (set_id=contato)58.27.253.611685793  e;) ossec9710i2Dovecot Auth failed on disconnected session.Nov 18 12:18:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=165.211.25.2022233387  W' ossec9708i,Dovecot Aborted Login with empty userNov 18 12:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034   # A F (4.  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}-  -' ossec13001iExim Auth failed2025-11-18 12:21:02 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br [201.61.40.117]:51580: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)201.61.40.1173469034q,  -k+ ossec13001iExim Auth failed2025-11-18 12:20:51 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:53986: 535 Incorrect authentication data (set_id=marialuiza)218.103.120.1501819730d+  -U' ossec13001iExim Auth failed2025-11-18 12:20:38 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:36460: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)152.89.135.302017370)*  e') ossec9710iDovecot Auth failed on disconnected session.Nov 18 12:20:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=64.227.136.1221269750)  k' ossec9709iMultiple Dovecot Aborted Logins with empty userNov 18 12:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8R4/AeBD1IGxV3kv>177.87.121.473469034_(  -G+ ossec13001iExim Auth failed2025-11-18 12:21:16 dovecot_login authenticator failed for ([218.144.149.177]) [218.144.149.177]:44976: 535 Incorrect authentication data (set_id=financeiro)218.144.149.1771835841 '  -%) ossec13001iExim Auth failed2025-11-18 12:19:54 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:38299: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)50.188.204.2136252001&  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:20:13 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=115.231.78.11, lip=186.233.225.118, TLS, session=115.231.78.111814991w%  -{' ossec13001izExim Auth failed2025-11-18 12:19:22 dovecot_login authenticator failed for (18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:60897: 535 Incorrect authentication data (set_id=contato)222.212.91.181814991^$  -G) ossec13001iExim Auth failed2025-11-18 12:20:10 dovecot_login authenticator failed for (rev.perfectinternet.in) [103.12.132.157]:44827: 535 Incorrect authentication data (set_id=gerson)103.12.132.1571269750n#  -i' ossec13001iExim Auth failed2025-11-18 12:20:04 dovecot_login authenticator failed for 223-22-241-32.mobile.dynamic.aptg.com.tw [223.22.241.32]:46883: 535 Incorrect authentication data (set_id=feedback)223.22.241.321668284k"  -_+ ossec13001iExim Auth failed2025-11-18 12:19:46 dovecot_login authenticator failed for ([222.189.211.114]) [222.189.211.114]:35634: 535 Incorrect authentication data (set_id=feedback@deproi.com.br)222.189.211.1141814991^!  -I' ossec13001iExim Auth failed2025-11-18 12:19:43 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:50210: 535 Incorrect authentication data (set_id=wesley)187.58.241.903469034 W' ossec9708iDovecot Aborted Login with empty userNov 18 12:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034    =  W' ossec9708iDovecot Aborted Login with empty userNov 18 12:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034< W' ossec9708i8Dovecot Aborted Login with empty userNov 18 12:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034k;  -_+ ossec13001i.Exim Auth failed2025-11-18 12:22:21 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:40514: 535 Incorrect authentication data (set_id=contato)213.238.254.1562661886r:  -o) ossec13001i`Exim Auth failed2025-11-18 12:23:11 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:55540: 535 Incorrect authentication data (set_id=fabio.vendas)181.50.250.1893686110l9  -g% ossec13001iPExim Auth failed2025-11-18 12:22:56 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:54039: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)180.165.1.711814991l8  -c) ossec13001iLExim Auth failed2025-11-18 12:22:52 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:53626: 535 Incorrect authentication data (set_id=tech)122.187.249.881269750j7  -_) ossec13001i<Exim Auth failed2025-11-18 12:22:35 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:37475: 535 Incorrect authentication data (set_id=tech@maringaparts.com.br)50.223.176.1716252001y6  -{+ ossec13001i^Exim Auth failed2025-11-18 12:23:09 dovecot_login authenticator failed for ([112.45.66.28]) [117.172.106.105]:39706: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)117.172.106.1051814991.5  e1) ossec9710ifDovecot Auth failed on disconnected session.Nov 18 12:23:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=210.114.18.1081835841}4  -) ossec13001i`Exim Auth failed2025-11-18 12:23:11 dovecot_login authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:47619: 535 Incorrect authentication data (set_id=accounting@maringaparts.com.br)218.26.205.154181499113  e7) ossec9710i'Dovecot Auth failed on disconnected session.Nov 18 12:22:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=118.193.38.1591819730|2  -) ossec13001iExim Auth failed2025-11-18 12:22:03 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:58730: 535 Incorrect authentication data (set_id=contato@lorussoimoveis.com.br)89.242.182.1592635167i1  -]) ossec13001iExim Auth failed2025-11-18 12:21:51 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:46353: 535 Incorrect authentication data (set_id=tech)90.161.217.2282510769a0  -O' ossec13001iExim Auth failed2025-11-18 12:21:32 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:34865: 535 Incorrect authentication data (set_id=tech@deproi.com.br)177.239.160.33996063/ W' ossec9708iDovecot Aborted Login with empty userNov 18 12:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034 &A U T 1   ,vM  -}% ossec13001iExim Auth failed2025-11-18 12:24:39 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:54274: 535 Incorrect authentication data (set_id=news@deproi.com.br)5.199.161.79597427L W' ossec9708iDovecot Aborted Login with empty userNov 18 12:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034aK  -S# ossec13001iExim Auth failed2025-11-18 12:25:12 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:10398: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)218.76.73.41814991\J  -I% ossec13001iExim Auth failed2025-11-18 12:25:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53091: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)62.60.131.40130758YI  -;+ ossec13001iExim Auth failed2025-11-18 12:24:52 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:52298: 535 Incorrect authentication data (set_id=news)186.215.245.1753469034H  59 ossec2934iYum package deleted.Nov 18 12:25:17 hosting yum[12512]: Erased: imunify360-firewall-cpanel-8.10.1-1.noarchpG  -m' ossec13001isExim Auth failed2025-11-18 12:23:29 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:41619: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)49.246.68.2201835841wF  -}% ossec13001ijExim Auth failed2025-11-18 12:23:22 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:56750: 535 Incorrect authentication data (set_id=isabellylisboa)83.221.15.762017370E  - ) ossec13001iExim Auth failed2025-11-18 12:23:55 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:56216: 535 Incorrect authentication data (set_id=help@maringaparts.com.br)122.186.244.341269750_D  -G+ ossec13001i{Exim Auth failed2025-11-18 12:23:37 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:49218: 535 Incorrect authentication data (set_id=assessoria)125.139.124.1201835841+C  e-' ossec9710iyDovecot Auth failed on disconnected session.Nov 18 12:23:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=45.61.149.1656252001B  k' ossec9709iwMultiple Dovecot Aborted Logins with empty userNov 18 12:23:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=177.87.121.473469034}A  -) ossec13001iExim Auth failed2025-11-18 12:23:47 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:44744: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)180.94.191.2191821275h@  -[) ossec13001inExim Auth failed2025-11-18 12:23:25 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:63836: 535 Incorrect authentication data (set_id=accounting)202.241.189.221861060a?  -O' ossec13001iExim Auth failed2025-11-18 12:24:17 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:54352: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)123.58.215.721819730V>  -7) ossec13001iExim Auth failed2025-11-18 12:24:14 dovecot_login authenticator failed for ([120.221.133.81]) [120.221.133.81]:44651: 535 Incorrect authentication data (set_id=help)120.221.133.811814991 ~qdWJ=0# znbVJ>2&  ~ q d W J = 0 #  z m ` S F 9 ,    v i \ O B 5 (    z m ` S F 9 ,    y l _ R E 8 +  2510769 2510769* 2510769 25107692 2510769 2510769 2510769J 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769L 248816) 248816 2464461/L 2464461# 2464461"_ 2464461 2464461V 2464461 2464461 2464461 2453866f 2440476f 2440476 241170% 241170V 241170V 241170 241170 241170 241170, 241170e 2403846c 2395170 2328926/ 2328926, 2328926, 2328926,? 2328926$( 2328926 2328926 2328926 2328926 2328926_ 2328926 2328926 2328926n 2328926 2328926 2328926 2328926 2328926 2300660'z 2300660%T 2300660 2300660^ 23006608 2300660/ 2287781- 2287781) 22877814 2287781 \ 2264397- 2264397+ 2264397' 2264397' 2264397' 2264397&9 2264397$ 2264397# 2264397! 2264397 2264397% 2264397 2264397 2264397 2264397l 22643970 2264397+ 2264397R 2264397 2264397 2264397 22643973 2264397 % 2264397 2264397 2264397 2264397 2264397 2264397T 2264397 2264397M 22643974 2264397 226074, 226074& 2260746 226074' 226074 226074 226074 v 226074  2245662) 2245662y 2233387/ 2233387/- 2233387, 2233387,s 2233387+x 2233387+. 2233387+ 2233387* 2233387) 2233387)} 2233387(w 2233387(: 2233387' 2233387' 2233387& 2233387& 2233387&V 2233387& 2233387%_ 2233387%9 2233387$ 2233387$ 2233387# 2233387# 2233387#h 2233387"} 2233387"^ 2233387!