# incident

plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<u1oBMNNDmOGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 21:03:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<U7nGMdNDerNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 21:03:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<TABuMtND7oMXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2025-11-17 21:04:02 dovecot_login authenticator failed for ([111.26.106.115]) [111.26.106.115]:40806: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 21:03:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<tU5gMNNDeNtAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 21:03:22 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:53646: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 21:03:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<NSFBMdNDpM0zTY0d>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZwLCMdNDUoWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-11-17 21:04:17 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:45397: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 21:04:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<F/gjNdNDMOaUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4GNgNdNDBKKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 21:04:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<mqS8NdNDnsTBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 21:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<bWzSOdNDYkaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 21:05:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<dPaDONNDxrhzR+4E>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PNDrONNDpL6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 21:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<SY/QOdNDrpBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 21:05:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@oabsjp.org.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<57LxONNDCudn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-11-17 21:05:43 dovecot_login authenticator failed for ([188.59.6.176]) [188.59.6.176]:56237: 535 Incorrect authentication data (set_id=comercial.user.support)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3Z+9OtND4tGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-11-17 21:05:06 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:53776: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-11-17 21:05:21 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:56214: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.173.227
country_id: 2017370
description:
2025-11-17 21:05:27 dovecot_login authenticator failed for ([109.202.173.227]) [109.202.173.227]:35234: 535 Incorrect authentication data (set_id=comercial.user.support@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:06:34 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MI+fPNNDat2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2025-11-17 21:06:41 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:39056: 535 Incorrect authentication data (set_id=produccion@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 21:06:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<r1T4PNND17F3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-17 21:06:54 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:54068: 535 Incorrect authentication data (set_id=produccion)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.230.181
country_id: 1269750
description:
Nov 17 21:07:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<valderesandreto@maringasoldas.com.br>, method=PLAIN, rip=122.187.230.181, lip=200.150.196.245, TLS, session=<WmnpPNNDb4h6u+a1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 21:06:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<dBmzO9NDMNVSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 58.49.113.138
country_id: 1814991
description:
Nov 17 21:06:36 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<valderesandreto@maringasoldas.com.br>, method=PLAIN, rip=58.49.113.138, lip=200.150.196.245, session=<i7mMPNNDM0o6MXGK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.218
country_id: 1269750
description:
Nov 17 21:06:13 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<valderesandreto@maringasoldas.com.br>, method=PLAIN, rip=122.187.229.218, lip=200.150.196.245, session=<MJQlO9NDK4J6u+Xa>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yvMcQNNDbo6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 21:07:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<AvelPtNDVOV2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.170
country_id: 1814991
description:
2025-11-17 21:07:27 dovecot_login authenticator failed for (pc170.zz.ha.cn) [61.168.104.170]:45405: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.195.126.170
country_id: 2017370
description:
2025-11-17 21:08:37 dovecot_login authenticator failed for ([176.195.126.170]) [176.195.126.170]:57074: 535 Incorrect authentication data (set_id=aginfo@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AuptRdNDbrmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 21:09:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<BXk/RdNDppad5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 21:09:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<0EV8RdND0rCl0xnK>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qrunQ9NDtKixV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 21:08:44 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess9146545787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-17 21:08:47 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:40376: 535 Incorrect authentication data (set_id=aginfo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:09:02 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51539: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 21:09:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<4d5ORdNDDqM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 21:09:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@f5assessoria.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<qLt3R9NDGOhn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-17 21:09:46 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:50408: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 21:09:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<uPsERtNDgI07GIXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 21:09:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=</2NBRtNDENKUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-11-17 21:09:23 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:46360: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E24+R9NDlMSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-11-17 21:10:16 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:42940: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 17 21:10:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<JIF3StNDBs6qQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-17 21:10:29 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:48958: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KRrLStNDguKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.124
country_id: 1210997
description:
2025-11-17 21:10:40 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:37268: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:11:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<s57LTtNDiustPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 21:11:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<QW6yTdNDgKBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 21:11:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53675: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FH5oTtNDYpOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 17 21:11:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<O8FGT9NDoqOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 17 21:12:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<dTXjT9ND0KcvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-17 21:11:08 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:33387: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-11-17 21:11:10 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:43102: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-17 21:11:20 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:32922: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UNkpUNNDSp+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2025-11-17 21:13:04 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:58574: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 17 21:12:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<kDX+UNND8LQIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-17 21:12:27 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:39276: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Boj7UdNDjKyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 21:12:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<3NBQUtNDwswrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:12:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<J+itUtNDSqAtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 21:12:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<xo1yU9NDlNwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 21:12:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Th1YUNNDYIokMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:13:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52085: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 21:13:17 dovecot_login authenticator failed for (compensadosparana.com.br) [112.122.54.54]:48373: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-17 21:13:18 dovecot_login authenticator failed for ([201.183.225.156]) [201.183.225.156]:58650: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cZePVdNDEMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-17 21:13:36 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:33734: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.78.131
country_id: 2077456
description:
2025-11-17 21:13:51 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:42520: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 21:14:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<goHmV9NDEoZSnOdL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DiMcWdNDDumxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GzXtWtNDCoaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 17 21:14:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<4Ha9WdND2NJbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-17 21:15:00 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:40582: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 21:14:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<f/O/V9ND/tGnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 21:14:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<SSMEWNNDOqx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 21:14:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<KZOnWNNDZNhxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-17 21:14:44 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:54269: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 21:15:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<DZk9W9NDwLNzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-17 21:15:18 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:57296: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.194.233.62
country_id: 1814991
description:
2025-11-17 21:15:21 dovecot_login authenticator failed for ([111.194.233.62]) [111.194.233.62]:52832: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gaOsXNNDUpmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 21:15:49 dovecot_login authenticator failed for (brilhometal.com.br) [61.50.119.110]:26928: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-17 21:16:04 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:36430: 535 Incorrect authentication data (set_id=fernandabrum@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 21:16:14 dovecot_login authenticator failed for (brilhometal.com.br) [61.50.119.110]:31430: 535 Incorrect authentication data (set_id=test@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-17 21:16:25 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:34953: 535 Incorrect authentication data (set_id=fernandabrum)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7LdJYNND4K+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 21:17:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<AGrKY9NDONVvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-17 21:17:37 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:42875: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 21:17:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<GHJ2ZNNDfpQnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-11-17 21:17:54 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:59650: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 21:17:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<nebLY9NDaqKB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-17 21:17:46 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:53118: 535 Incorrect authentication data (set_id=info.user.support@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 21:17:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<L5HdYtNDoO2kXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 21:17:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<XxJ8YtNDMIFns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:17:30 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52253: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3KnbY9NDaMyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-17 21:17:33 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:42680: 535 Incorrect authentication data (set_id=andre.nascimento.support@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-17 21:17:50 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:42587: 535 Incorrect authentication data (set_id=juliana@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-17 21:18:06 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:63321: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 21:17:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<oTdpYtNDAo5xoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QAucZdND3NexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-17 21:18:04 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:35704: 535 Incorrect authentication data (set_id=info.user.support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-17 21:17:50 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:56670: 535 Incorrect authentication data (set_id=andre.nascimento.support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.224.169.221
country_id: 3469034
description:
Nov 17 21:18:17 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida>, method=PLAIN, rip=45.224.169.221, lip=200.150.196.245, TLS, session=<ahxrZdNDTrgt4Knd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.236.53.198
country_id: 1814991
description:
2025-11-17 21:18:50 dovecot_login authenticator failed for ([115.236.53.198]) [115.236.53.198]:48904: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-17 21:18:08 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:47266: 535 Incorrect authentication data (set_id=juliana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-11-17 21:18:10 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:49232: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.41.142.164
country_id: 1835841
description:
2025-11-17 21:18:21 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:44660: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rgRrZ9NDLumxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 21:18:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<GX6yZ9NDtL9SczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-11-17 21:18:42 dovecot_login authenticator failed for ([211.104.166.110]) [211.104.166.110]:55700: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-17 21:19:19 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:49726: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ni/5atNDpJSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2025-11-17 21:19:43 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:41141: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 21:19:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<vEgWbNND9J8naoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 21:19:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64385: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 21:19:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<0kAybNNDeJikXF7M>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WcKUbtNDdq2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-11-17 21:20:38 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:44672: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 21:20:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<PUGnb9NDNIpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 21:21:02 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:34284: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SVRicNND2L6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 21:21:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<TTV3cNND1LiGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 21:20:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<KSTAbdNDYK93xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 21:20:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<i9webtNDLuqkXLll>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 2.58.84.61
country_id: 2921044
description:
Nov 17 21:20:32 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-11-17 21:20:46 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:47480: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-17 21:20:50 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42300: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.155.213.175
country_id: 1668284
description:
2025-11-17 21:22:04 dovecot_login authenticator failed for 182-155-213-175.veetime.com [182.155.213.175]:42178: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 21:21:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<Tg7YcNNDzNudQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 21:21:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<i3UbctNDXNaElIx5>


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 2.58.84.61
country_id: 2921044
description:
Nov 17 21:21:36 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-17 21:21:40 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:34566: 535 Incorrect authentication data (set_id=alcindo@box911.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 2.58.84.61
country_id: 2921044
description:
Nov 17 21:21:09 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-17 21:21:16 dovecot_login authenticator failed for ([118.121.234.5]) [118.121.234.5]:37876: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YTEhctNDgsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-11-17 21:21:55 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:38584: 535 Incorrect authentication data (set_id=alcindo)


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 2.58.84.61
country_id: 2921044
description:
Nov 17 21:22:14 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2025-11-17 21:22:20 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:39544: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+gO6ddNDpOaxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 21:22:57 H=(195.3.134.135) [179.0.178.53]:65453 F=<erictremblaysi@hotmail.com> rejected RCPT <contato@cartazesetiquetas.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:65453 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 21:22:13 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:50168: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 21:22:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<YkGCdtNDcoq317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 21:23:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<rYR6d9NDEI9vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.15.2
country_id: 1668284
description:
2025-11-17 21:22:13 dovecot_login authenticator failed for ([58.115.15.2]) [58.115.15.2]:50396: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 21:22:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<YbptdNNDTmCvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 21:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<En7ZdNNDrrWkXLll>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 2.58.84.61
country_id: 2921044
description:
Nov 17 21:22:21 hosting pure-ftpd: (?@2.58.84.61) [WARNING] Authentication failed for user [profetizandoasmulheres]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-17 21:22:52 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:33418: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vxNJedNDsI6xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:24:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gecee9NDxp6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 21:23:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<l7WLeNND6JEv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 21:23:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<XvzPeNNDZ6V3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 21:24:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<DCyIe9NDAso+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-11-17 21:24:13 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:56763: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-11-17 21:24:18 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:55342: 535 Incorrect authentication data (set_id=isabella@eloempresas.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 21:24:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Y7T4e9NDlOyYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 21:24:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<lGM4fNNDgrkrZDwA>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ho7ifNNDnqixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-17 21:24:36 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:36680: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-11-17 21:24:36 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:39311: 535 Incorrect authentication data (set_id=isabella)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-11-17 21:24:46 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:40855: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:24:53 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51671: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 21:24:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<qNhLftNDyrWl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.253
country_id: 6290252
description:
2025-11-17 21:25:07 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:50386: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-17 21:25:25 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:56983: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gF12gNNDmsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-17 21:25:53 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:57083: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.196
country_id: 3175395
description:
Nov 17 21:25:58 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=185.68.178.196, lip=200.150.196.245, TLS, session=<JnH1gNNDt825RLLE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 21:25:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<iyUpf9ND/MqP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-11-17 21:25:30 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:43218: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 21:25:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<47uBgNNDWLKUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 21:26:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<y1tjgtNDMoCkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-17 21:25:29 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:56540: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-11-17 21:26:15 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:43834: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 17 21:26:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<HpQbg9NDMt4kMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.16.237
country_id: 1562822
description:
2025-11-17 21:26:58 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.16.237]:45561: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T+rQhdND3IWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-17 21:26:59 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:1569: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-17 21:26:15 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:58726: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-17 21:26:21 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:46629: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<arIEhNNDXOmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.221.50.183
country_id: 953987
description:
Nov 17 21:26:31 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=45.221.50.183, lip=200.150.196.245, TLS, session=<DlNegtNDJIIt3TK3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-17 21:27:33 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:34617: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-17 21:27:35 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:38627: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 21:27:42 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53948: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-17 21:27:47 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:55475: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-17 21:27:50 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43390: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.236
country_id: 1733045
description:
2025-11-17 21:28:00 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:33074: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<osWYh9NDVpuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 17 21:27:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<dbGch9NDpoV6kIMZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-17 21:27:43 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:43966: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 21:27:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<iSG5iNND9oN9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-17 21:27:56 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:47678: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 21:27:33 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:42175: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.96.228.60
country_id: 1814991
description:
2025-11-17 21:28:16 dovecot_login authenticator failed for ([150.129.138.198]) [112.96.228.60]:36486: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ygQ1i9NDPrqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 21:28:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<uX5djNND5Ox2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 21:29:33 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:41446: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-11-17 21:29:43 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:49632: 535 Incorrect authentication data (set_id=administracion)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UH2MkNNDHOOxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 21:29:32 H=(195.3.134.135) [179.0.178.53]:54433 F=<erictremblaysi@hotmail.com> rejected RCPT <paulo@radiolouvoreterno.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:54433 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.142.242
country_id: 1814991
description:
2025-11-17 21:29:53 dovecot_login authenticator failed for ([222.85.202.86]) [59.51.142.242]:48151: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 21:29:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<KQ3MjdNDJLcXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 21:29:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<n8NvjtNDlqMv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
country_id: 1814991
description:
2025-11-17 21:29:29 dovecot_login authenticator failed for ([222.185.255.229]) [222.185.255.227]:32903: 535 Incorrect authentication data (set_id=administracion@lixadoracuritiba.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vNDJjtND3NexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 21:30:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<YP6gkdNDsMmiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 21:30:53 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:61872: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.60.205.220
country_id: 6252001
description:
2025-11-17 21:31:01 dovecot_plain authenticator failed for (bcoazzi7xbnx59rv903ceh4s061gs55) [38.60.205.220]:62226: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.235.243
country_id: 1814991
description:
2025-11-17 21:31:02 dovecot_login authenticator failed for ([117.175.235.243]) [117.175.235.243]:52672: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 21:30:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<5O+7kNND4OVCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-17 21:30:10 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:42982: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.104.200.38
country_id: 1814991
description:
2025-11-17 21:30:29 dovecot_login authenticator failed for ([14.104.200.38]) [14.104.200.38]:45926: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<b7xZktNDaIexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-17 21:31:15 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:39943: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KWjlldNDOKSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 21:31:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<blISltNDSqhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 21:32:52 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:58690: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 21:33:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<LzIKm9ND+Mp9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xipHm9ND+taxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:32:49 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51793: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 21:32:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<o47ml9NDEqFAF/Qn>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EBF3mdNDOsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.245.87
country_id: 2510769
description:
2025-11-17 21:32:32 dovecot_login authenticator failed for (h-91-126-245-87.wholesale.adamo.es) [91.126.245.87]:49338: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-17 21:32:41 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:49487: 535 Incorrect authentication data (set_id=ti)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3IQXndNDNOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 21:33:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<4yE1ntND3tanR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-11-17 21:33:57 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:41660: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:33:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51814: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 21:33:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=</71cnNNDbueB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 21:33:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<FzXrnNNDhtN57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 21:34:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@primiciapersianas.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<QWHMntNDnu1n76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-17 21:33:31 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:43582: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:34:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<P0P8odNDfLAtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 21:35:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<pDmWotNDgLSiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 21:34:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<dWlJn9ND9qFns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 21:34:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<BQzin9NDwN0vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 17 21:34:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<0wHnoNNDgN4O4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:35:02 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52058: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NXOkoNNDAJqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 21:35:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<y+9UotNDfM9rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.77.73
country_id: 2542007
description:
2025-11-17 21:35:36 dovecot_login authenticator failed for (ADMIN) [196.117.77.73]:56657: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-11-17 21:35:51 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:47688: 535 Incorrect authentication data (set_id=colonialrodas@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 21:35:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<djQco9NDZrzSATzz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 21:35:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<kIe8o9NDFLGB4rs4>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q/U3pNNDdL2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 21:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<ju7Yo9NDbMvSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 21:36:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<I1HfpdNDmKGP9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uUsGptNDBtOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 21:36:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<eiC0ptNDvI8kMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Dx3Fp9NDBOKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.101.36.206
country_id: 1814991
description:
Nov 17 21:36:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<CKoHqNNDGDYvZSTO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 17 21:36:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<TGJ8ptNDKJ8I1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-11-17 21:36:06 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:48162: 535 Incorrect authentication data (set_id=colonialrodas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 21:36:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<H7PSqNND7t+l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 21:36:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=</UELqdNDZoErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 21:36:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<XHkvqdNDXp1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 21:36:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<ygdAqdND/r6kXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.65.113
country_id: 597427
description:
Nov 17 21:36:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=69.62.65.113, lip=200.150.196.245, session=<ZbEhptND1rlFPkFx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.253.17.168
country_id: 1814991
description:
2025-11-17 21:37:19 dovecot_login authenticator failed for ([120.253.17.168]) [120.253.17.168]:46009: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VJhbq9ND8JWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.11.231.177
country_id: 1814991
description:
2025-11-17 21:37:34 dovecot_login authenticator failed for ([1.15.123.146]) [175.11.231.177]:45892: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-17 21:37:45 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:57476: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 21:38:00 dovecot_login authenticator failed for (User) [177.74.174.120]:58259: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.85.6
country_id: 3469034
description:
2025-11-17 21:38:06 dovecot_login authenticator failed for (200-138-85-6.ctaje701.dsl.brasiltelecom.net.br) [200.138.85.6]:33475: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-17 21:37:18 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:33724: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.215.243.6
country_id: 1814991
description:
2025-11-17 21:37:35 dovecot_login authenticator failed for ([58.215.243.6]) [58.215.243.6]:39755: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 21:37:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<bLwurNNDtouYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-11-17 21:37:48 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:50731: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 21:38:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<sRMkrdND4MCd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 21:38:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<OE1ErtNDoqKvfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TUz4rtNDOryxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 17 21:38:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<tnQQr9NDDKwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 21:38:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<5qWRr9NDJrlw2eny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yK65sNNDqM2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 21:38:16 dovecot_login authenticator failed for (User) [177.74.174.120]:58259: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 21:38:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<AbwYrtNDiN3Bl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 21:39:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<IxyXsdNDouyKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xvmJstND1NmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 17 21:39:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<M2hms9NDxMUI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 21:39:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<4V2Ks9NDfqvSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 21:39:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<sJyistNDCuFCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 21:39:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<DMvZstNDfpB3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 21:39:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<wFUrsdNDfMF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 21:39:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<qQRpsdNDSLBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 21:39:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<dKARstND8KAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 21:39:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<4e9zstNDfIZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-11-17 21:40:11 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4867: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 21:40:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<jfX4tNND0n1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-17 21:40:43 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:43130: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 21:40:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=</nlYt9NDytqGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.77
country_id: 1814991
description:
2025-11-17 21:41:02 dovecot_login authenticator failed for ([111.26.101.76]) [111.26.101.77]:38118: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 21:40:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<8G91tNNDFMZns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 21:40:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<akh5tdNDHNyl0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Wb4cttNDAJSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:40:33 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51501: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-17 21:40:49 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:46388: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 21:40:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<xVAst9NDgruB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 21:40:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<gZZytNNDYJyYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-17 21:40:17 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:48086: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 21:40:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=</hI0ttNDusJSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 21:40:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59595: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.160.52.28
country_id: 2017370
description:
2025-11-17 21:41:51 dovecot_login authenticator failed for (ip28.net52.ivn.ttksever.ru) [46.160.52.28]:49468: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-17 21:41:54 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:32836: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.22.0.76
country_id: 1814991
description:
2025-11-17 21:41:20 dovecot_login authenticator failed for ([111.22.0.76]) [111.22.0.76]:55342: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2uqoudND7rGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-17 21:41:36 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:53072: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.239.84.130
country_id: 2017370
description:
Nov 17 21:41:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=83.239.84.130, lip=200.150.196.245, TLS, session=<tr+DudNDl+VT71SC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 21:41:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fernandotonet.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<sgGuutNDCoFn76Vy>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TfF2u9NDmLyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 21:41:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<MNF3udNDNsxAF/Qn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kzY/vdNDxsexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 21:42:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<XdclvdNDqs0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 21:42:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<ls6hvdNDDOaElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.18.49.14
country_id: 1814991
description:
Nov 17 21:42:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@inovasite.com>, method=PLAIN, rip=121.18.49.14, lip=200.150.196.245, TLS, session=<3871vNND3oF5EjEO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.132.150.162
country_id: 6252001
description:
Nov 17 21:42:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=57.132.150.162, lip=200.150.196.245, TLS, session=<l0rRutNDnqU5hJai>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 21:42:12 dovecot_login authenticator failed for ([182.95.57.158]) [182.95.57.158]:40468: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 21:42:21 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:52108: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.21.240
country_id: 1562822
description:
2025-11-17 21:42:35 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:35278: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 123.193.152.64
country_id: 1668284
description:
Nov 17 21:42:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=123.193.152.64, lip=200.150.196.245, session=<WdF1vtNDOIV7wZhA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-11-17 21:44:06 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:34468: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sJzSwNNDyOexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<6QjFwNNDbsUtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.250.94
country_id: 1814991
description:
2025-11-17 21:43:49 dovecot_login authenticator failed for ([60.11.250.94]) [60.11.250.94]:58354: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 21:43:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<2dLWwNNDQJFns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
country_id: 1835841
description:
2025-11-17 21:43:47 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:59646: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.101.36.206
country_id: 1814991
description:
Nov 17 21:43:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<zFbov9NDOn0vZSTO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 21:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<SQ++wNNDVp1rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-17 21:43:34 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:58922: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:44:36 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52022: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 21:44:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<TtjrxNNDIJqKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 21:44:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<HBbUxNNDduxn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3tEqxtNDlKSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.95.221
country_id: 2017370
description:
2025-11-17 21:45:05 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:34724: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C7lsxNNDepmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-17 21:45:51 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:39530: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-17 21:45:13 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:28076: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 17 21:45:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<celso@inovasite.com>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=<jnCFx9NDVsLE+2Qw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-11-17 21:45:37 dovecot_login authenticator failed for ([65.20.250.93]) [65.20.250.93]:36285: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.17.130
country_id: 2017370
description:
2025-11-17 21:45:33 dovecot_login authenticator failed for ([5.142.17.130]) [5.142.17.130]:45298: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 21:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<2DOSyNNDRuBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 21:46:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<T4/QydNDJK5SczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 21:45:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<6136xtNDvteUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-17 21:45:24 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:32908: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r0X6x9NDpLexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.61
country_id: 6252001
description:
2025-11-17 21:46:26 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:56283: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MW+Ky9NDjNCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 21:46:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<jiEJzdNDyIGd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2025-11-17 21:46:52 dovecot_login authenticator failed for ([46.163.189.191]) [46.163.189.191]:40448: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.239.67.146
country_id: 1814991
description:
2025-11-17 21:47:05 dovecot_login authenticator failed for ([121.239.67.146]) [121.239.67.146]:50364: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 21:46:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<4NfBytNDjuHBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2025-11-17 21:46:40 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:51300: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.196.185
country_id: 2017370
description:
2025-11-17 21:46:50 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:34619: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i8Unz9NDmoCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2025-11-17 21:47:33 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:58423: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2025-11-17 21:47:38 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:42949: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-17 21:47:58 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:42770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-11-17 21:47:07 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:60746: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-11-17 21:47:11 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:57526: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.7
country_id: 1668284
description:
2025-11-17 21:47:32 dovecot_login authenticator failed for 111-70-32-7.emome-ip.hinet.net [111.70.32.7]:44377: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-17 21:47:15 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11979: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-17 21:47:29 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:33692: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JbTy0NNDgI6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 21:48:12 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50963: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.169.45.158
country_id: 6252001
description:
2025-11-17 21:48:33 dovecot_login authenticator failed for 158.45.169.34.bc.googleusercontent.com ([34.82.26.7]) [34.169.45.158]:40584: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-17 21:48:43 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:57134: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 21:49:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<xyM71NNDIsg+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-17 21:49:02 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:37391: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.210
country_id: 3469034
description:
Nov 17 21:48:26 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida@1075fm.com.br>, method=PLAIN, rip=190.89.136.210, lip=200.150.196.245, TLS, session=<5JxQ0dNDtqG+WYjS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r4Cx0tND9p+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2025-11-17 21:49:06 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:6236: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2025-11-17 21:49:55 dovecot_login authenticator failed for ([45.155.146.33]) [45.155.146.33]:52240: 535 Incorrect authentication data (set_id=bianca.user.tech@globalmedica.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 21:50:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<iQfm19NDXoWUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 21:49:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<oA8g1dNDoJA+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vqVF1tNDHLuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.194.136.3
country_id: 1668284
description:
2025-11-17 21:50:44 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:36820: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-17 21:50:59 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:39755: 535 Incorrect authentication data (set_id=paulo.user.tech)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 21:50:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<L53n2dNDBLXBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2025-11-17 21:50:39 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:49256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<imyh29NDfOqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-11-17 21:50:09 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:56225: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-17 21:50:13 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:52296: 535 Incorrect authentication data (set_id=bianca.user.tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-17 21:50:30 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:54222: 535 Incorrect authentication data (set_id=paulo.user.tech@louvoreterno.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mpna2dNDYtexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 21:51:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Hw8r3tNDjKWl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 21:52:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<tMw639NDdO07GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-17 21:52:07 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:59690: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.126
country_id: 2750405
description:
2025-11-17 21:51:14 dovecot_plain authenticator failed for ([203.159.90.126]) [203.159.90.126]:61944: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 21:51:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<BfRs3NND8b13xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FL1r3dNDyIaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2025-11-17 21:51:34 dovecot_login authenticator failed for ([111.26.69.159]) [111.26.69.160]:35354: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-11-17 21:53:03 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:58478: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-11-17 21:52:27 dovecot_login authenticator failed for ([117.175.160.58]) [117.175.160.58]:38222: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8wcG4dNDWKaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:52:40 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52226: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-17 21:52:40 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:38041: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-17 21:52:40 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:57630: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.64.26
country_id: 1861060
description:
2025-11-17 21:52:58 dovecot_login authenticator failed for 133.232.64.26.static.zoot.jp [133.232.64.26]:59568: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-17 21:53:11 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:33714: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-11-17 21:53:17 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:37606: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:53:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<st4G5tNDXNUtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-17 21:53:13 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:57144: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 21:53:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Wu+i49NDzIVA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<D1di5tND4s+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 21:53:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<hz9F49NDytsrmxBp>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fsae5NNDTMCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 17 21:53:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<wQeu5dNDlsCWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-17 21:53:26 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:43112: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-17 21:53:26 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:55180: 535 Incorrect authentication data (set_id=loopert)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 21:53:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<h/pp5NNDzqAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-11-17 21:53:50 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:48758: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 21:55:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<hfWx6dNDwLg+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 17 21:54:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<E9rW5tNDpICqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 17 21:54:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<9MoD59NDAqwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 21:54:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Ag2r59NDzpMkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 21:54:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<nrP659NDCtUrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2025-11-17 21:54:40 dovecot_login authenticator failed for ([213.234.9.218]) [213.234.9.218]:52928: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:54:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8box6NND3tqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2025-11-17 21:54:51 dovecot_login authenticator failed for 149.51.222.87.dynamic.jazztel.es [87.222.51.149]:46592: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:55:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<JAHe6dNDxKItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-17 21:56:00 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:53554: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 21:55:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58740: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-11-17 21:55:44 dovecot_login authenticator failed for (nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:58476: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 17 21:55:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<CD/W7NNDuo5bejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 21:55:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<0LcJ7dNDIKJxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-17 21:55:56 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:49918: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-11-17 21:55:58 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:36990: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-11-17 21:56:05 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:54578: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-17 21:55:19 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:54492: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Qw/B69NDWoqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.70.26
country_id: 248816
description:
2025-11-17 21:55:43 dovecot_login authenticator failed for (212.35.70.26.ua.batelco.jo) [212.35.70.26]:42021: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-11-17 21:55:49 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:60796: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-17 21:56:36 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:40640: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 21:56:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<bkIr8NNDlJinR+bm>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K0VW79NDgqexV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.102
country_id: 2264397
description:
Nov 17 21:56:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.102, lip=200.150.207.122, TLS, session=<WBNb79NDZ6YtnIFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2025-11-17 21:56:37 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:40406: 535 Incorrect authentication data (set_id=comercial.user.tech@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.124
country_id: 1210997
description:
2025-11-17 21:56:53 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:42024: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zYQc8dNDCLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2025-11-17 21:56:15 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:60509: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.100
country_id: 2264397
description:
Nov 17 21:56:24 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.100, lip=200.150.207.122, session=<PzTT7tNDQZUtnIFk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.101
country_id: 2264397
description:
Nov 17 21:56:26 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.101, lip=200.150.207.122, TLS, session=<4e7y7tNDJ4otnIFl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 17 21:56:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<3jzU7dND1pkIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.233.24
country_id: 1835841
description:
2025-11-17 21:56:13 dovecot_login authenticator failed for ([175.207.233.24]) [175.207.233.24]:45385: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:56:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52223: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-17 21:56:51 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:48009: 535 Incorrect authentication data (set_id=comercial.user.tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-17 21:56:07 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:52582: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-17 21:56:09 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:54702: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.27
country_id: 3175395
description:
Nov 17 21:56:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=185.208.188.27, lip=200.150.196.245, TLS, session=<UKZR79NDq9W50Lwb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<u/Ps8tNDkL2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-11-17 21:57:39 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:35424: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 21:57:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<w72B89NDVKxns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 21:57:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<AY2a89NDnsNSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2025-11-17 21:57:52 dovecot_login authenticator failed for (109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:50482: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-11-17 21:58:02 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:52496: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 21:58:05 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64189: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2025-11-17 21:58:09 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:38955: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.181.191.152
country_id: 2017370
description:
2025-11-17 21:59:02 dovecot_login authenticator failed for ([94.181.191.152]) [94.181.191.152]:53406: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 21:59:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<E+oI+NNDjt1zR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 21:58:27 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59741: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2025-11-17 21:58:40 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:46024: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OvB99tNDHtuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 21:58:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<9UGp9tNDBoRxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-17 21:58:41 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:57107: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.114
country_id: 1814991
description:
2025-11-17 21:58:26 dovecot_login authenticator failed for ([125.90.72.114]) [125.90.72.114]:52453: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.237.94
country_id: 1814991
description:
2025-11-17 21:58:27 dovecot_login authenticator failed for ([36.154.237.94]) [36.154.237.94]:54912: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2025-11-17 21:58:42 dovecot_login authenticator failed for ([211.63.34.149]) [211.63.34.149]:56593: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 21:58:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3JFK9dNDHMCB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 21:58:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<t6MK9tNDtOdSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 21:59:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<mwNs+9NDBMUnaoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:00:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZYrd+9NDcpaxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AjoL+tNDcoqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kTKg/dNDcKqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-17 22:00:37 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:47901: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.30.248.213
country_id: 2017370
description:
2025-11-17 22:00:49 dovecot_login authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:49854: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.199.10.82
country_id: 3175395
description:
2025-11-17 22:01:00 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:50431: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 22:01:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<KLgf/9NDzptvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-11-17 22:00:26 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:36101: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-17 22:00:32 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:41405: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 22:01:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<vVVNAtRDtLakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 22:02:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<tQvnAtRDAuiElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-17 22:01:08 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:37196: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-11-17 22:01:26 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:52854: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cgcwAdRDRMKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.153.189.66
country_id: 1814991
description:
2025-11-17 22:01:37 dovecot_login authenticator failed for ([36.153.189.66]) [36.153.189.66]:54843: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.220
country_id: 1835841
description:
2025-11-17 22:02:41 dovecot_login authenticator failed for ([211.116.107.220]) [211.116.107.220]:33947: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:03:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RkyYBtRDTISxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 22:02:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<20M7A9RDdIknaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZBHCBNRDCOGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 22:02:56 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:44893: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-11-17 22:03:01 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:27497: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 22:03:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<ABZ4BtRDrt+YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 22:02:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@alcantaraemonteiro.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<XUUQBNRDhoVn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 22:02:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<VDXOBNRD/Jwv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<G1BgCNRD9pSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 22:03:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<zlO2CNRDztiGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 22:03:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<V4XZBtRDFu5A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 22:03:21 dovecot_login authenticator failed for (User) [177.74.174.120]:55990: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.179.206.6
country_id: 6252001
description:
2025-11-17 22:03:57 dovecot_login authenticator failed for (syn-072-179-206-006.res.spectrum.com) [72.179.206.6]:35233: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-17 22:03:57 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:41554: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-17 22:03:20 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:55163: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.20
country_id: 1643084
description:
2025-11-17 22:03:38 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:50266: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 22:04:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<ECqhDNRDXbt3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-11-17 22:04:59 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:37511: 535 Incorrect authentication data (set_id=marcos@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.87
country_id: 1814991
description:
2025-11-17 22:04:08 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:57748: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.141
country_id: 1835841
description:
2025-11-17 22:04:28 dovecot_login authenticator failed for ([121.131.220.141]) [121.131.220.141]:56137: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DSv0C9RDVLaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 22:05:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<pxgpENRDyOedQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 22:05:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<lKdCENRDIL4rZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2025-11-17 22:05:55 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:49080: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZbVREdRDvuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.188
country_id: 1814991
description:
2025-11-17 22:05:14 dovecot_login authenticator failed for ([163.179.123.188]) [163.179.123.188]:46822: 535 Incorrect authentication data (set_id=marcos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.32.144.232
country_id: 6252001
description:
2025-11-17 22:05:27 dovecot_login authenticator failed for ([65.32.144.232]) [65.32.144.232]:48426: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zmWBD9RDqs+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 22:06:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<pFJsEtRD2r52wSaf>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:06:34 H=(localhost) [54.165.171.241]:34414 F=<user@example.org> rejected RCPT <ZwThfAbCCuHP7o6@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-17 22:06:44 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:54163: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SsAPE9RDyIOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 22:07:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<UEqUFNRDZEOvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 22:06:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<EwZdEdRDgOCUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-17 22:06:26 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:40180: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 22:06:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0cXmEtRDuK9vAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 22:07:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<R/XrFtRD3qWl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 17 22:07:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<FrI/F9RDdi8kMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 22:07:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<qoisF9RDZ7F3xBIC>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:07:26 H=(localhost) [54.165.171.241]:23350 F=<user@example.org> rejected RCPT <YbjcC2U1L8ZnjhT@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vpSwFtRDAqaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.70
country_id: 3865483
description:
Nov 17 22:08:17 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=45.238.107.70, lip=200.150.196.245, TLS, session=<PYcwGNRDJegt7mtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2025-11-17 22:08:57 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:52948: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 22:08:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<qCryGtRDCJx9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-17 22:08:53 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:33778: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-11-17 22:08:53 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:36778: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6uoBHNRD8NKxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:08:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YFFDGtRDUsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-17 22:08:51 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:40900: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:09:05 dovecot_login authenticator failed for (OmJbw2) [213.209.157.84]:65355: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 22:08:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<6HObGNRDcrykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 22:08:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=</YS+GtRDhrcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 22:08:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<XtpcG9RDqrWP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-17 22:09:05 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:44378: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 22:09:08 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:58380: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2025-11-17 22:09:25 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:53386: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-17 22:09:38 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:54522: 535 Incorrect authentication data (set_id=info.user.tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.221.15.76
country_id: 2017370
description:
2025-11-17 22:09:54 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:56224: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-17 22:09:18 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:56598: 535 Incorrect authentication data (set_id=info.user.tech@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-17 22:09:20 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:41638: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-11-17 22:09:22 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:54941: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 22:09:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<CvIsH9RDbpJCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-17 22:09:09 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:41594: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-17 22:09:27 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:34970: 535 Incorrect authentication data (set_id=andre.nascimento.tech@calcautomacao.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:09:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BqjXHdRDVuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:09:29 dovecot_login authenticator failed for (qNvWQUtt0) [213.209.157.84]:49920: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
country_id: 1814991
description:
2025-11-17 22:09:37 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:35223: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-17 22:09:39 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:57044: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 22:10:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<vz3DIdRDRsJAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2025-11-17 22:10:58 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:56273: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:10:13 dovecot_login authenticator failed for (GRXeJx1kp) [213.209.157.84]:50413: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-11-17 22:10:13 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:53974: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.224.249
country_id: 290557
description:
2025-11-17 22:10:15 dovecot_login authenticator failed for ([5.30.224.249]) [5.30.224.249]:59425: 535 Incorrect authentication data (set_id=andre.nascimento.tech@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.19.166
country_id: 290557
description:
2025-11-17 22:10:15 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:51377: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 22:10:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57589: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-11-17 22:10:39 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:59350: 535 Incorrect authentication data (set_id=andre.nascimento.tech)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RbVoIdRDLJexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 22:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<meU7IdRD+gu317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-17 22:10:42 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:41932: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-17 22:10:44 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:44861: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
country_id: 1814991
description:
2025-11-17 22:11:14 dovecot_login authenticator failed for ([112.98.177.66]) [112.98.177.66]:51272: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:11:25 dovecot_login authenticator failed for (bLxKiC) [213.209.157.84]:59621: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.62.41
country_id: 1814991
description:
2025-11-17 22:11:29 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:37978: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.119
country_id: 3996063
description:
2025-11-17 22:12:00 dovecot_login authenticator failed for (201.173.97.119-clientes-izzi.mx) [201.173.97.119]:46200: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.9
country_id: 1668284
description:
2025-11-17 22:11:09 dovecot_login authenticator failed for 111-70-32-9.emome-ip.hinet.net [111.70.32.9]:39990: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 22:11:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<xIxGJNRDNN8vWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-11-17 22:11:24 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:57412: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Fxj2JNRDNrixV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:11:34 H=(localhost) [54.165.171.241]:13945 F=<user@example.org> rejected RCPT <94zk8IZxROIAm4o@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2025-11-17 22:11:45 dovecot_login authenticator failed for ([60.172.41.103]) [60.172.41.103]:59696: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x7jFJtRDpMSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:12:13 dovecot_login authenticator failed for (LBgx516Xbp) [213.209.157.84]:64345: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-11-17 22:12:14 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:50766: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-17 22:12:28 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:51958: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 22:12:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<xOehKdRDYuxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.95
country_id: 1814991
description:
2025-11-17 22:12:26 dovecot_login authenticator failed for ([27.24.141.95]) [27.24.141.95]:48900: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:12:27 H=(localhost) [54.165.171.241]:17900 F=<user@example.org> rejected RCPT <JQoY2B77Ea9ozwM@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<b4KIKNRDctWxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 17 22:12:32 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 3 secs): user=<>, rip=194.164.107.4, lip=200.150.207.122, TLS, session=<2d6NKNRDFrjCpGsE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.119.87
country_id: 1814991
description:
2025-11-17 22:12:49 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:47408: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 22:12:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<Kp3PKdRD3oBw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2025-11-17 22:13:52 dovecot_login authenticator failed for ([124.65.160.234]) [124.65.160.234]:45230: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.146.241
country_id: 2017370
description:
2025-11-17 22:13:09 dovecot_login authenticator failed for ([185.129.146.241]) [185.129.146.241]:55980: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 17 22:13:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<HQldK9RDRswv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:13:25 dovecot_login authenticator failed for (YpGAOy) [213.209.157.84]:54851: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.175.81.54
country_id: 2017370
description:
2025-11-17 22:13:28 dovecot_login authenticator failed for ([85.175.81.54]) [85.175.81.54]:55062: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-17 22:13:33 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:45834: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.104.200.38
country_id: 1814991
description:
2025-11-17 22:13:18 dovecot_login authenticator failed for ([14.104.200.38]) [14.104.200.38]:36720: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nhQiLNRDkIixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-17 22:13:44 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:52575: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 22:13:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<P3VPLdRDXuN9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:14:30 dovecot_login authenticator failed for (dxeKenXA1) [213.209.157.84]:55346: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-17 22:14:12 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:56957: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-17 22:14:25 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:60261: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rJa5L9RDWKuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 22:14:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<MaPPL9RDiNVzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 22:14:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<3yC3MNRDDtVns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oSF7MdRDvruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-17 22:14:13 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:42616: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.150.242
country_id: 1814991
description:
2025-11-17 22:16:06 dovecot_login authenticator failed for ([218.1.150.242]) [218.1.150.242]:34754: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 22:15:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<o8p/MtRDHhto7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Mk9JM9RDbNGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:15:39 dovecot_login authenticator failed for (ItJRZWv0TT) [213.209.157.84]:62300: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 22:15:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<9zGENNRDHtCB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 22:16:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<zoTuNNRDNNF2wSaf>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:16:38 H=(localhost) [54.165.171.241]:31921 F=<user@example.org> rejected RCPT <s1gbg6sLquxbbDN@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.19.168.104
country_id: 2017370
description:
2025-11-17 22:16:56 dovecot_login authenticator failed for (94.19.168.104.pool.sknt.ru) [94.19.168.104]:59386: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 22:16:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<69DDNdRDWtGB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 22:16:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<qzlzNtRDstQvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:16:27 dovecot_login authenticator failed for (VLyQdWTcc) [213.209.157.84]:49750: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 22:16:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<QsykNtRD2p2YNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ve/ZNtRDzIGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 22:17:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<sjTnOdRDzt5rhr+5>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:17:30 H=(localhost) [54.165.171.241]:8099 F=<user@example.org> rejected RCPT <KPMzhX3grz8YOhc@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yultOtRDTqaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-11-17 22:18:00 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:56191: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SRw8PNRDZLexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 22:17:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<XXpiOdRDxM4tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 22:17:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<7KkLOtRDwrbSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 22:17:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<3hJ0OtRDerMrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.84
country_id: 2921044
description:
2025-11-17 22:17:15 dovecot_login authenticator failed for (qhOvTV6) [213.209.157.84]:60759: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-17 22:18:21 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51250: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 22:18:24 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:65482: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 22:18:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<fCrePtRDrsyYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.7.89
country_id: 2395170
description:
Nov 17 22:18:26 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=41.74.7.89, lip=200.150.196.245, TLS, session=<DYxiPNRDxMQpSgdZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 17 22:18:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<oc+EPdRDQOwI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 22:18:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<gYWzPdRDLJkkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bmH+PdRDiMmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 22:18:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<2uZLPdRDsIOkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 22:18:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<rdw1PtRD8vxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.189.195
country_id: 1643084
description:
2025-11-17 22:18:59 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:50168: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-11-17 22:18:19 dovecot_login authenticator failed for (nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:45540: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 17 22:18:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<d75APdRDls8I1et7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 22:18:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<OI80P9RDFtWP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 22:19:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<c8LCP9RDVq4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 22:20:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<bdclQ9RDBppAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-11-17 22:19:17 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62675: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 17 22:19:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<wyYUQdRDrqUv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 22:19:53 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:39792: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.120.169
country_id: 1814991
description:
2025-11-17 22:19:53 dovecot_login authenticator failed for ([58.35.120.169]) [58.35.120.169]:18785: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 22:19:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<66UJQdRD1p1CYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vaKNQdRDQOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.56.178
country_id: 1668284
description:
2025-11-17 22:19:35 dovecot_login authenticator failed for (h178-192-72-56.seed.net.tw) [192.72.56.178]:40279: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Tqf1RtRD6rCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 22:20:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<vdAxRNRDIux57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 17 22:20:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<f/vIRNRDgJkO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-17 22:20:31 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:38096: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-11-17 22:20:48 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:52987: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 22:20:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<HkEaRtRDoJJns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.221.149
country_id: 2077456
description:
2025-11-17 22:20:15 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:60276: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WGokRdRDkJuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 22:20:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<YA69RdRD2qZn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:21:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NWHCSNRDPLyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 22:21:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<gl8YSdRDrs0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 22:21:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<FSrASdRDCJfSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-11-17 22:21:10 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:23558: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 22:21:23 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:54846: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 22:21:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<9Xt2SNRD8pWkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 22:22:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<ZBC+StRDGt1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.87.182
country_id: 1814991
description:
2025-11-17 22:22:09 dovecot_login authenticator failed for ([39.129.87.182]) [39.129.87.182]:48214: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 22:22:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<zLJCS9RDbqiGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Kp5LTNRDwN2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 22:22:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<7a0sTdRDaIOl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:22:56 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51991: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-11-17 22:22:30 dovecot_login authenticator failed for ([121.73.163.22]) [121.73.163.22]:47982: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-17 22:22:44 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:35087: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.102.254.198
country_id: 2017370
description:
2025-11-17 22:23:00 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:36687: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 22:23:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<C+btTdRDWoWvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.250
country_id: 2186224
description:
2025-11-17 22:23:03 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:50306: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 22:23:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<gpEmTtRDFtt2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 22:23:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<BJIjT9RDasCkXLll>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qGDfT9RDoI6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 22:23:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<ti1vUNRDtJqElIx5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<13StUdRD+pyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 22:24:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<nQmqUdRDaZx3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 22:23:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<TOINUdRDCMnBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.15
country_id: 2186224
description:
2025-11-17 22:23:15 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:57012: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 22:23:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=</QJIT9RDutiB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 22:23:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<1mWGT9RDJspzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 22:23:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<FmyqT9RDXv6KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2025-11-17 22:23:51 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:39403: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 22:25:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<7oUUVdRDFKWd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.232.65.142
country_id: 3469034
description:
Nov 17 22:24:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=45.232.65.142, lip=200.150.196.245, TLS, session=<BVLxUNRDvrgt6EGO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 22:24:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<8J1zUtRDiM1ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.93
country_id: 3175395
description:
Nov 17 22:24:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=185.15.171.93, lip=200.150.196.245, TLS, session=<6eYYUtRDHp65D6td>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ciNxU9RDRqqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<h9MIV9RDBs6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 22:25:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<sz35VtRDurhCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 22:25:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<jmJoV9RDkuNSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 22:25:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<iDt5V9RDorGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 22:25:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<ogAjWNRDGpZSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 22:25:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<bZ9JWNRDFL4tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 22:25:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<FlZeWNRD6p5n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:25:17 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52099: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 22:25:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<cBgiVtRD7Ktrhr+5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NdVrXNRD4JGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:26:11 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51945: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-17 22:26:26 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:34003: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uHKZWtRDwICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-11-17 22:26:42 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:42016: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-11-17 22:27:19 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:23741: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Cj0yXtRDdqOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.167
country_id: 2186224
description:
2025-11-17 22:28:00 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:34948: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2025-11-17 22:28:37 dovecot_login authenticator failed for ([111.26.62.42]) [111.26.62.42]:57238: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-11-17 22:28:43 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:43312: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-17 22:28:49 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:47604: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:28:53 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51610: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-17 22:28:56 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:63653: 535 Incorrect authentication data (set_id=orcamento@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2025-11-17 22:28:19 dovecot_login authenticator failed for ([111.26.62.45]) [111.26.62.46]:48014: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3DXDYdRDasSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.196.185
country_id: 2017370
description:
2025-11-17 22:29:30 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:45405: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rGRSZdRDVuyxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:29:08 H=(localhost) [54.165.171.241]:50436 F=<user@example.org> rejected RCPT <5tk0BKniPZdeZjp@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.234.68.221
country_id: 1814991
description:
2025-11-17 22:29:19 dovecot_login authenticator failed for ([116.234.68.221]) [116.234.68.221]:63366: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.196.185
country_id: 2017370
description:
2025-11-17 22:29:21 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:52450: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.199.89
country_id: 1814991
description:
2025-11-17 22:29:26 dovecot_login authenticator failed for ([112.102.199.89]) [112.102.199.89]:54890: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 22:30:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=</xU1Z9RDvME+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-11-17 22:29:08 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:55544: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.129
country_id: 1814991
description:
2025-11-17 22:29:09 dovecot_login authenticator failed for ([112.102.48.129]) [112.102.48.129]:41436: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-11-17 22:29:53 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:47653: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WdYlZ9RD1oixV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<t7jkaNRD9pyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-11-17 22:30:14 dovecot_login authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:63484: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 22:30:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<VulyaNRDSouUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-17 22:30:30 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:42824: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<++h3bNRDmrWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-17 22:32:19 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34216: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-17 22:32:23 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:55689: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-11-17 22:32:42 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [182.72.143.2]:35080: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-17 22:32:47 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:40538: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9xXecdRDYOexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 22:32:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1pZ0btRDourBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.28.244
country_id: 2017370
description:
2025-11-17 22:32:26 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:51839: 535 Incorrect authentication data (set_id=financeiro@quintalbrincante.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c0UMcNRDmNmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-11-17 22:32:39 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:46378: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<49Cfc9RDmoyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-17 22:33:50 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:56315: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 22:33:58 dovecot_login authenticator failed for ([182.95.57.158]) [182.95.57.158]:50210: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2025-11-17 22:34:06 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:40585: 535 Incorrect authentication data (set_id=memaagostinho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-11-17 22:34:00 dovecot_login authenticator failed for ([95.79.57.221]) [95.79.57.221]:57566: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 22:33:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<4SxvctRDkr2l0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2025-11-17 22:33:16 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:55554: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.133.126
country_id: 3595528
description:
2025-11-17 22:33:38 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:42095: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-17 22:33:54 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:39622: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 22:33:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<rbkSddRDztormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 22:34:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<JKZpddRD1tormxBp>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:34:08 H=(localhost) [54.165.171.241]:14424 F=<user@example.org> rejected RCPT <ZR3pmt5adlhbS6n@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.180.252.183
country_id: 6252001
description:
2025-11-17 22:34:11 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:59364: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+Jg6d9RDKrGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 22:34:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<GeB9eNRDPOA7GIXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 22:35:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<JDy4e9RDhNUrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.152.206.155
country_id: 1814991
description:
2025-11-17 22:35:53 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:58100: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XsiUfNRDDOKxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<avrEetRDPsyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 22:35:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<AjpDe9RD68l3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 22:36:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<G4tSfdRDUt8tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-17 22:36:38 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:56664: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 17 22:36:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<wlXVfNRDyOKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 17 22:36:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<Qk+cf9RDzuVbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:36:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51797: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 22:36:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<OCxrfdRDtNDBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 22:36:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<qOIiftRDPJ0kMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nv5bftRDBIKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-17 22:36:40 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:38571: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2025-11-17 22:36:11 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:60882: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 22:36:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<z3MffdRDiIZA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-17 22:36:17 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:40810: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 22:36:41 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51037: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 17 22:37:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<9zEqgdRDhtvBHmEh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SH/xgdRD1KSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 22:37:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<i/AugdRDBOctPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 22:37:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<CU0AgtRDbqx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 22:37:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<9NUEg9RD3LRxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 17 22:37:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<q90Gg9RDQreqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 22:38:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<KGivg9RDxuekXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2025-11-17 22:38:03 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:58180: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-11-17 22:38:23 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:48218: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 22:38:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<77R6hdRDjO1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.120
country_id: 1814991
description:
2025-11-17 22:38:39 dovecot_login authenticator failed for ([183.167.198.120]) [183.167.198.120]:48981: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 22:39:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<TCgjh9RDsKCB4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HflRh9RDBtGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 22:38:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<FlwqhNRDVsBSczCz>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iBOChdRDKsCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 22:38:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53540: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-17 22:38:48 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61410: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 22:40:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:49201: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 54.165.171.241
country_id: 6252001
description:
2025-11-17 22:39:08 H=(localhost) [54.165.171.241]:32209 F=<user@example.org> rejected RCPT <hbzVgbgJikFoYJr@palestrantexavier.com.br>: Sender verify failed


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kxwYidRDTN+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 17 22:39:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<4D2RidRDyOwIiXsk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.79
country_id: 2635167
description:
Nov 17 22:39:54 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.79, lip=191.243.196.56, TLS, session=<EIxmitRDM+xX7LBP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<G2qzjNRDVpOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 22:40:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<NbXqjNRDEuFxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 22:40:43 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64923: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.232.110
country_id: 2017370
description:
2025-11-17 22:40:13 dovecot_login authenticator failed for ([178.70.232.110]) [178.70.232.110]:51938: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-17 22:40:23 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:61850: 535 Incorrect authentication data (set_id=maia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
country_id: 1835841
description:
2025-11-17 22:41:51 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:50040: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-17 22:41:52 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:49974: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 22:41:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<CO6NkdRDoqUv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<djIKktRDVLmxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KSk6kNRDiK6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 22:41:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=</9MdkdRDeNWYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 22:42:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<yzeClNRD7MInaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-17 22:43:06 dovecot_login authenticator failed for ([87.200.226.113]) [87.200.226.113]:56958: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.121.0.32
country_id: 1814991
description:
2025-11-17 22:42:08 dovecot_login authenticator failed for ([123.121.0.32]) [123.121.0.32]:59940: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:42:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<t7Dok9RDRMOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 22:42:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<3hJXlNRD8MhSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.99
country_id: 1814991
description:
2025-11-17 22:43:31 dovecot_login authenticator failed for ([111.26.100.98]) [111.26.100.99]:53296: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uOZjl9RDxt+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 22:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<U/hUl9RDxIeGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.61
country_id: 6252001
description:
2025-11-17 22:43:46 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:35762: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 22:43:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<xi6kltRD1ugXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 22:43:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<4Y5tl9RD8qqElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 22:43:54 dovecot_login authenticator failed for (User) [177.74.174.120]:56799: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 22:43:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<qoisltRDpKc+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UAvBnNRDgpmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 22:44:10 dovecot_login authenticator failed for (User) [177.74.174.120]:56799: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 22:44:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<bBbFmdRDYrdvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 22:44:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<s9YNmtRDRq6kXF7M>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IgX1mtRDro6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.194.136.3
country_id: 1668284
description:
2025-11-17 22:44:33 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:56396: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 22:44:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<b95qnNRDVLQnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.182
country_id: 1814991
description:
2025-11-17 22:45:14 dovecot_login authenticator failed for ([219.128.55.182]) [219.128.55.182]:48526: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-17 22:45:31 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:48759: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RVeUntRDkKqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-11-17 22:45:44 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:45860: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-11-17 22:46:02 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:38745: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.135.166
country_id: 1820814
description:
2025-11-17 22:46:05 dovecot_login authenticator failed for (166-135.adsl.static.espeed.com.bn) [119.160.135.166]:54258: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 22:46:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<UvOQoNRD6rxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.210.137
country_id: 290557
description:
2025-11-17 22:46:29 dovecot_login authenticator failed for ([87.200.210.137]) [87.200.210.137]:50653: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZNYnotRDbsGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 22:46:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<HvsGotRDwuaUcQQF>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<woO5pdRD2t2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.181
country_id: 2186224
description:
2025-11-17 22:47:41 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:55860: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 22:48:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<oNdcp9RDxLkv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.148.205
country_id: 2017370
description:
2025-11-17 22:48:04 dovecot_login authenticator failed for ([92.124.148.205]) [92.124.148.205]:41434: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 22:47:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<8KdipNRD5qgrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 22:47:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<2BNwpdRDzMGdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:47:40 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51574: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 22:47:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<1sKPptRD3Ll2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rGB5p9RDMOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.221.149
country_id: 2077456
description:
2025-11-17 22:48:02 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:35086: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 22:47:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<RjsipNRDRrZw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-17 22:47:09 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:50324: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-17 22:48:36 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:34196: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 22:48:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<qoWjqdRDzqwvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 17 22:48:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<mN/AqdRDgCIkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-17 22:48:08 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:45330: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-17 22:48:15 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:49076: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-17 22:48:27 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:48640: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 22:49:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<FaLOqtRDZrRAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2025-11-17 22:48:15 dovecot_login authenticator failed for (109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:49224: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 22:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<TmveqNRD7cZ3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LbdIqdRDiouxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
country_id: 1814991
description:
2025-11-17 22:49:38 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:38463: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 22:49:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<3fdGrdRDmtZvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.37.100.53
country_id: 1814991
description:
2025-11-17 22:50:07 dovecot_login authenticator failed for ([58.37.100.53]) [58.37.100.53]:55686: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2025-11-17 22:49:25 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:46132: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fVjdrNRDGqOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 22:49:48 dovecot_login authenticator failed for (User) [177.74.174.120]:59347: 535 Incorrect authentication data (set_id=pereira@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-11-17 22:49:52 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42502: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-17 22:49:16 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:41242: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 22:49:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<e6u/rdRDPrZ9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 22:49:10 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57358: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 22:49:41 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:49689: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 22:49:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<eOyKrNRDhoaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 22:50:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<Wl93rtRD3LWl0iHB>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<n/dysNRD2r6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2025-11-17 22:51:01 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:43408: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.244.6.94
country_id: 2017370
description:
2025-11-17 22:50:32 dovecot_login authenticator failed for (ws6-94.maryno.net) [188.244.6.94]:55306: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 22:50:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<4ccmsdRD+MpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.198.173.145
country_id: 1819730
description:
Nov 17 22:50:52 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=203.198.173.145, lip=200.150.196.245, TLS, session=<+49GsNRDC43Lxq2R>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-11-17 22:51:05 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:56446: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gB84stRDGM2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 22:50:21 dovecot_login authenticator failed for (User) [177.74.174.120]:59347: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.167.193.127
country_id: 1814991
description:
Nov 17 22:50:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=183.167.193.127, lip=200.150.196.245, TLS, session=<3kCtrtRDjNS3p8F/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.160.52.28
country_id: 2017370
description:
2025-11-17 22:50:30 dovecot_login authenticator failed for (ip28.net52.ivn.ttksever.ru) [46.160.52.28]:54764: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 22:50:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<j5uLsNRD2JKkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.8.74
country_id: 6252001
description:
2025-11-17 22:50:50 dovecot_login authenticator failed for ([162.243.8.74]) [162.243.8.74]:47146: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-17 22:51:03 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:54601: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-17 22:51:24 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:56520: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2025-11-17 22:51:28 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:46729: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yg4BtNRDrtmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 222.74.136.222
country_id: 1814991
description:
Nov 17 22:52:00 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=222.74.136.222, lip=200.150.196.245, session=<Nrx8tdRDxLLeSoje>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2025-11-17 22:51:13 dovecot_login authenticator failed for (125.234.135.54.hcm.viettel.vn) [125.234.135.54]:58466: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.173
country_id: 1668284
description:
2025-11-17 22:51:27 dovecot_login authenticator failed for 221-120-57-173.emome-ip.hinet.net [221.120.57.173]:49110: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-17 22:51:44 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:60972: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-17 22:51:44 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:57118: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 22:51:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<PFIMtdRDziWvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.240.125.200
country_id: 2635167
description:
2025-11-17 22:51:57 dovecot_login authenticator failed for host-89-240-125-200.as13285.net [89.240.125.200]:38671: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 22:51:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<0oPzstRDzrx3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:53:05 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51742: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.155
country_id: 3469034
description:
Nov 17 22:52:30 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=186.209.247.155, lip=200.150.196.245, TLS, session=</ERhttRD77O60feb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<F52St9RDmoaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.106
country_id: 3175395
description:
Nov 17 22:52:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=217.26.178.106, lip=200.150.196.245, TLS, session=<MK2Kt9RDrJ3ZGrJq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.99
country_id: 1814991
description:
2025-11-17 22:52:52 dovecot_login authenticator failed for ([111.26.100.99]) [111.26.100.99]:36434: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.176.195
country_id: 798544
description:
2025-11-17 22:53:01 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:37984: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:53:48 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52074: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 17 22:53:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<vw7WutRDipcv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.241
country_id: 1668284
description:
2025-11-17 22:53:10 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:50153: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-17 22:53:22 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3682: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-11-17 22:53:26 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:35093: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.50
country_id: 3175395
description:
Nov 17 22:53:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida@1075fm.com.br>, method=PLAIN, rip=185.47.136.50, lip=200.150.196.245, TLS, session=<XHi+uNRD55i5L4gy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 22:53:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<xvkUvNRDkOEvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.172.33.52
country_id: 1814991
description:
2025-11-17 22:53:50 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:33524: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 22:53:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<Es9NvNRDyk9o7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YpXwvNRDzKqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 22:54:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<GWvtvNRDaNSd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.194.136.3
country_id: 1668284
description:
2025-11-17 22:53:24 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:44236: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0O0uu9RD/JmxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s43CvtRDFLSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 22:54:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<ptsewNRDEI99gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-11-17 22:55:02 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:56207: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 22:54:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<kx6cvdRD9NRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-17 22:55:15 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:59358: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 22:55:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<SQBcwdRDSJOYNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JhJNwtRDPs+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 22:55:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<iAWQwtRDNK5ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-17 22:55:56 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:41154: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2025-11-17 22:56:13 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:55016: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 22:57:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<jj9zx9RD1MCKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Yh+rx9RDEIOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 22:57:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3Bm5x9RDcrGB4rs4>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5mbpxdRDUuexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.194.132
country_id: 2017370
description:
2025-11-17 22:56:46 dovecot_login authenticator failed for (79x136x194x132.dynamic.saratov.ertelecom.ru) [79.136.194.132]:56108: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
country_id: 2017370
description:
2025-11-17 22:57:06 dovecot_login authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:60654: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 22:57:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<4vOpydRD+LKYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2025-11-17 22:57:46 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:45071: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 22:57:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<EPikytRDks9rhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 17 22:57:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<D7rIx9RD9KoI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 22:57:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<olsZyNRDeDlo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 22:57:13 dovecot_login authenticator failed for (netoscotoadvogados.com.br) [61.50.119.110]:21194: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r4Z8ydRDRIyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 22:58:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<xL4IzNRDnKuB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2025-11-17 22:58:18 dovecot_login authenticator failed for ([121.185.89.74]) [121.185.89.74]:58768: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 22:58:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<OOmQzNRD8OdAF/Qn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0l4JzdRDcqSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 22:58:10 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51869: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 22:58:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<vZXVy9RDEpErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 22:58:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<DmXSzNRDlHq317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-17 22:58:42 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:35958: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-17 22:59:24 dovecot_login authenticator failed for ([128.185.252.110]) [128.185.252.110]:41604: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.111.4
country_id: 2510769
description:
2025-11-17 22:59:25 dovecot_login authenticator failed for 4.red-79-154-111.dynamicip.rima-tde.net [79.154.111.4]:50987: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 22:59:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<ZkZd0NRDwqotPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 22:59:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<5IV20NRDuImP9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dTdt0tRD7sexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 23:00:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<hKZX0tRDpNyl0xnK>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 22:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HAqb0NRD1r2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.164.95.228
country_id: 2635167
description:
2025-11-17 22:59:33 dovecot_login authenticator failed for ([194.164.95.228]) [194.164.95.228]:54978: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-17 22:59:42 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:34987: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 22:59:58 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:60438: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.196.185
country_id: 2017370
description:
2025-11-17 23:00:12 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:52552: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ADQ01NRDRtmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-11-17 23:00:50 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:44909: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.150
country_id: 1668284
description:
2025-11-17 23:00:07 dovecot_login authenticator failed for 110-25-112-150.adsl.fetnet.net [110.25.112.150]:38289: 535 Incorrect authentication data (set_id=mariacarla@transoltransportes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.208.124
country_id: 3175395
description:
Nov 17 23:00:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=94.198.208.124, lip=200.150.196.245, TLS, session=<Y7bS0dRDD6pextB8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 23:00:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<iv4i09RDTuRCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.168.98
country_id: 1814991
description:
2025-11-17 23:00:20 dovecot_login authenticator failed for (98.168.158.61.ha.cnc) [61.158.168.98]:33074: 535 Incorrect authentication data (set_id=mariacarla)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.159.86
country_id: 1814991
description:
2025-11-17 23:00:22 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:50165: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 17 23:00:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<dAFT1NRDup8v7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EfXL19RD3uyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 23:01:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Iy4E2NRDJtdns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.70.149.210
country_id: 1814991
description:
2025-11-17 23:01:10 dovecot_login authenticator failed for ([223.70.149.210]) [223.70.149.210]:59331: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 23:02:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<A8rR2tRDQL6Gx8nN>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8t1a29RDcJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-11-17 23:02:52 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:41066: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mUEg3dRDiKaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 23:02:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<bqUm2tRDlORn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 23:02:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<MoXE2tRDwnCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.82
country_id: 6252001
description:
2025-11-17 23:02:39 dovecot_login authenticator failed for ([70.174.168.82]) [70.174.168.82]:49142: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 23:02:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<Kace3NRDQMCnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.175.81.54
country_id: 2017370
description:
2025-11-17 23:02:49 dovecot_login authenticator failed for ([85.175.81.54]) [85.175.81.54]:50752: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 23:03:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<XLb43NRDVtqd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-17 23:03:19 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:41018: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SbHw3tRDgLaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 23:03:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<0xp+39RD4J+ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 23:04:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<fzNw4NRDVMIXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<q0B94tRDFNCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 23:05:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<rRAl5NRD/M2l0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 23:04:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<wxzw4NRDHoPSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-17 23:05:45 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:52979: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 23:05:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<ucBf59RDoOVSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 23:06:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<q4/m59RDCLKUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 23:05:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<nnlv5NRDRKNns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 23:05:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<jOC55NRDoIpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2025-11-17 23:05:16 dovecot_login authenticator failed for ([211.116.107.222]) [211.116.107.222]:39713: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PIQR5tRDduWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 23:05:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<DrIr59RDENKB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 23:05:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<k/tF59RDTqRrhr+5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<A8vf59RDVomxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 23:06:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<GKY76dRDyNpCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Demp6dRDIp+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-17 23:06:45 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:45722: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-17 23:06:56 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:61790: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 23:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<OtEM69RDpsJzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 17 23:06:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<iwxT6NRDluAO4dKR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 23:06:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<aYnK6NRDMad3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-11-17 23:07:34 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:43742: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-17 23:07:42 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:36574: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-17 23:07:49 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:49692: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 23:08:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<IzPR7tRDOGivfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-17 23:07:26 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:55281: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.30.253
country_id: 1814991
description:
2025-11-17 23:07:31 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:41052: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-11-17 23:07:53 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:42198: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-17 23:07:57 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:43902: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-11-17 23:07:10 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:57044: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.202
country_id: 1269750
description:
2025-11-17 23:07:18 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:52144: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 23:07:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<HfKI7NRDbsZn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xv417dRDqruxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 23:08:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<kdQt79RDIsItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2025-11-17 23:08:14 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:44540: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iofU8NRD9tWxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 23:08:51 H=(195.3.134.135) [179.0.178.53]:57674 F=<erictremblaysi@hotmail.com> rejected RCPT <exceedcon@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57674 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 23:09:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<nFp58tRDRNLBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-11-17 23:08:24 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:46006: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-17 23:08:30 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:37978: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 23:08:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<+Q/D8NRDNrM+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wgmT8tRDQuOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 23:09:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<Mll79dRDIog+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-17 23:10:05 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:56601: 535 Incorrect authentication data (set_id=reservas@hoteljoinvillense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m2df9NRDMu2xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+zf699RDvJmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 23:10:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<2unE+NRD3p2UcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:10:10 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51870: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.123
country_id: 2017370
description:
2025-11-17 23:10:18 dovecot_login authenticator failed for ([178.178.194.123]) [178.178.194.123]:55766: 535 Incorrect authentication data (set_id=reservas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 23:10:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<uSBe99RDnrlSnOdL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<acCN+9RDLLSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2025-11-17 23:11:58 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:34657: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 23:12:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<EIMl/dRDIKp57bKF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<v6hV/dRDlL2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-17 23:12:20 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:34778: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.168.190
country_id: 1814991
description:
2025-11-17 23:12:27 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:21932: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TCYY/9RDEsexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-17 23:12:34 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:63618: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 23:12:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62484: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-11-17 23:13:03 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:48796: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.93.205
country_id: 1668284
description:
2025-11-17 23:13:37 dovecot_login authenticator failed for 110-25-93-205.adsl.fetnet.net [110.25.93.205]:42535: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.20
country_id: 1643084
description:
2025-11-17 23:13:47 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:59953: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.28.246.4
country_id: 2264397
description:
Nov 17 23:13:59 hosting pure-ftpd: (?@104.28.246.4) [WARNING] Authentication failed for user [OIxlhfZ8<]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 17 23:13:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<comercial@inovasite.com>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=<BRS7AdVDmI/E+2Qw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HgKsAtVDsuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.2
country_id: 1668284
description:
2025-11-17 23:13:32 dovecot_login authenticator failed for 111-70-32-2.emome-ip.hinet.net [111.70.32.2]:40281: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.251
country_id: 1668284
description:
2025-11-17 23:13:42 dovecot_login authenticator failed for 111-70-23-251.emome-ip.hinet.net [111.70.23.251]:36841: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2025-11-17 23:14:02 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:34658: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-17 23:13:14 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:58776: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.148
country_id: 1835841
description:
2025-11-17 23:13:21 dovecot_login authenticator failed for ([121.131.220.148]) [121.131.220.148]:45593: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.222.124.164
country_id: 1814991
description:
2025-11-17 23:13:41 dovecot_login authenticator failed for (164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [222.222.124.164]:42536: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZVFDBtVDco+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 23:14:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<Mb1yBtVDJuYrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2025-11-17 23:14:53 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:55566: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 23:15:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<6hnQB9VDHJV2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1AgRCNVD/JexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-11-17 23:15:04 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:58440: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 17 23:14:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<47J+BNVDnsMI1et7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 23:14:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<LbNjBdVDeLI+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 23:14:25 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:45380: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-17 23:14:52 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:60786: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:15:02 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64313: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 23:14:15 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:34031: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:15:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64494: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ljzSCdVDwKKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-11-17 23:15:32 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:57384: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 23:15:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<t6LuCtVDWJql0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.7.89
country_id: 2017370
description:
2025-11-17 23:15:07 dovecot_login authenticator failed for ([78.36.7.89]) [78.36.7.89]:57329: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2025-11-17 23:15:14 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:7302: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Br1mDdVDqMaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-17 23:16:52 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:49452: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 23:17:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<jTdWD9VDItR3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 23:17:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<owZbEdVDuKYkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3h/EEtVD0OixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-11-17 23:18:06 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:50974: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
country_id: 1814991
description:
2025-11-17 23:18:07 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:52552: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 23:17:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<cLCKENVDbI7Bl4nP>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ADX6ENVDbuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-17 23:17:35 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:43946: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-17 23:17:43 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:47860: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2025-11-17 23:17:44 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:52372: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:17:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:52008: 535 Incorrect authentication data (set_id=info@cleservicosindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2025-11-17 23:17:21 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:51352: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 23:17:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<mPaYENVD0tUrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-11-17 23:18:32 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:32834: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 23:18:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<MG31EtVDNNY7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2025-11-17 23:18:09 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:62926: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.206.10
country_id: 1814991
description:
2025-11-17 23:18:15 dovecot_login authenticator failed for ([124.115.206.10]) [124.115.206.10]:58420: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.148.205
country_id: 2017370
description:
2025-11-17 23:18:15 dovecot_login authenticator failed for ([92.124.148.205]) [92.124.148.205]:52356: 535 Incorrect authentication data (set_id=mecati)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<flOUFNVD7oixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 17 23:18:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<mZY7E9VDILVbejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 23:18:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<7WSEE9VDttlSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 23:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<vXOmFNVDfsEtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2025-11-17 23:18:18 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:44956: 535 Incorrect authentication data (set_id=design)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 17 23:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<Sy6lFNVD1u2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.141
country_id: 1835841
description:
2025-11-17 23:18:44 dovecot_login authenticator failed for ([121.131.220.141]) [121.131.220.141]:34945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:18:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49551: 535 Incorrect authentication data (set_id=contact@cleservicosindustriais.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dG0jGNVDrJ2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 23:19:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<JmMWGNVDLrlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 23:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<ApHtGNVDmLFns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2025-11-17 23:19:48 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:54805: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2025-11-17 23:20:01 dovecot_login authenticator failed for ([106.247.22.181]) [106.247.22.181]:53171: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-11-17 23:20:04 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:58523: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-17 23:19:41 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:48130: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.130.35.29
country_id: 2017370
description:
2025-11-17 23:19:59 dovecot_login authenticator failed for ([31.130.35.29]) [31.130.35.29]:46012: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 23:19:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<o9iBGNVDYp4tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-11-17 23:19:52 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4667: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:19:57 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64822: 535 Incorrect authentication data (set_id=office@cleservicosindustriais.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 23:19:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<twmIGdVDONRxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 23:19:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<Uy0wGNVD7tikXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-17 23:20:06 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:43849: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 23:20:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<bfzfHNVDHqQv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Nd19HdVDwsOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.253.122
country_id: 1814991
description:
2025-11-17 23:20:14 dovecot_login authenticator failed for ([112.25.253.122]) [112.25.253.122]:59626: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.132
country_id: 1814991
description:
2025-11-17 23:20:24 dovecot_login authenticator failed for (132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:35876: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:20:31 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52228: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UOm3G9VDsrqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 23:20:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<l5wqHNVDfoSYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 23:20:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<o2IsGtVD9siB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:20:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58548: 535 Incorrect authentication data (set_id=admin@cleservicosindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-17 23:20:27 dovecot_login authenticator failed for (dsl-tn-dynamic-129.221.22.125.airtelbroadband.in) [125.17.28.138]:49430: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.124
country_id: 3996063
description:
2025-11-17 23:20:36 dovecot_login authenticator failed for ([177.236.145.124]) [177.236.145.124]:54672: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 23:21:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53575: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 23:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<xCLNHtVDzOxw2eny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yIZNH9VDhtWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 23:21:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<voNsH9VD7r7Bl4nP>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 23:21:55 hosting dovecot: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=200.150.196.245, session=<tcKmINVDfpUDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 23:22:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<pupPI9VD1ohxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2025-11-17 23:22:49 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:44253: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dVncItVDfuuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.154
country_id: 1814991
description:
2025-11-17 23:22:34 dovecot_login authenticator failed for ([222.186.68.154]) [222.186.68.154]:36669: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 23:22:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<KwZBI9VDcJiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 17 23:22:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<zNdKI9VDjq2qQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 23:22:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<LYh+I9VD+OGkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-17 23:22:48 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:38834: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:22:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60011: 535 Incorrect authentication data (set_id=help@cleservicosindustriais.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 17 23:22:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<fAX1I9VDatEIiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 23:22:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<17I3ItVDqNdzR+4E>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.74
country_id: 2264397
description:
Nov 17 23:23:06 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.74, lip=200.150.196.245, session=<TvboJNVDD+ptadJK>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C5txJtVDLJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:23:13 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51499: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2025-11-17 23:23:46 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:59596: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.1.71
country_id: 1814991
description:
2025-11-17 23:23:32 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:56641: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
country_id: 1814991
description:
2025-11-17 23:23:20 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:59578: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-17 23:24:00 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:42664: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 23:24:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<jvJAKNVDAqSGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.235.187.158
country_id: 1814991
description:
2025-11-17 23:23:10 dovecot_login authenticator failed for ([123.235.187.158]) [123.235.187.158]:41297: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 23:23:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<GU+KJdVDjrcXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-17 23:23:47 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:48194: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.42.131
country_id: 6252001
description:
[2025-11-17 23:23:50 -0300] info [webmaild] 104.207.42.131 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DyVDKNVDpqSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.238.101.209
country_id: 3932488
description:
2025-11-17 23:23:16 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:55528: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.115
country_id: 3469034
description:
Nov 17 23:24:16 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=138.186.197.115, lip=200.150.196.245, TLS, session=<zcQIKNVD7pOKusVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.54
country_id: 1668284
description:
2025-11-17 23:24:19 dovecot_login authenticator failed for 111-70-13-54.emome-ip.hinet.net [111.70.13.54]:36726: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NZkJKtVDmLOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 23:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<MY84KtVDdK92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 23:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<YTs5KtVDfIikXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.223
country_id: 1668284
description:
2025-11-17 23:24:39 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:60718: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-17 23:24:43 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:58791: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-17 23:24:20 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:47312: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-11-17 23:24:44 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:40012: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2025-11-17 23:24:45 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:58588: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.32.156
country_id: 1880251
description:
2025-11-17 23:24:59 dovecot_login authenticator failed for (156.32.245.49.unknown.m1.com.sg) [49.245.32.156]:46393: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-17 23:24:59 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:55153: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 23:25:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<PZgCLtVDkssnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-11-17 23:25:12 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:44314: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-17 23:25:23 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:36532: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-11-17 23:25:25 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:39584: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.75.186
country_id: 1835841
description:
2025-11-17 23:25:08 dovecot_login authenticator failed for ([59.6.75.186]) [59.6.75.186]:57022: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QTucLdVDCNmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.11.15.126
country_id: 3469034
description:
2025-11-17 23:25:42 dovecot_login authenticator failed for ([189.11.15.126]) [189.11.15.126]:53927: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-11-17 23:25:45 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:60400: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c4z+MtVDPo6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2025-11-17 23:26:22 dovecot_login authenticator failed for ([61.37.150.6]) [61.37.150.6]:47390: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nUAwMdVDAOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-11-17 23:26:43 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:38985: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 23:26:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<t6IvMtVD5LmUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 23:26:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<8VduMtVDLrsv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 23:26:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<3GtlMtVDVuKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 23:27:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<qB7WNdVDnKQnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.129
country_id: 2186224
description:
2025-11-17 23:27:53 dovecot_login authenticator failed for ([121.73.168.129]) [121.73.168.129]:50894: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 23:27:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<StoKNNVDzKenR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 23:27:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<8p5xNNVDDtJSnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZFPJNNVD+JaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 23:27:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=</bzJNNVDYNFvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.212.17
country_id: 1835841
description:
2025-11-17 23:28:05 dovecot_login authenticator failed for ([61.74.212.17]) [61.74.212.17]:3479: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2025-11-17 23:27:33 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60330: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 23:27:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<ch4pNdVDrr1AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-17 23:27:47 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:45804: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 23:28:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<OwpuOdVDppQrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-17 23:28:57 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:6068: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.148
country_id: 1835841
description:
2025-11-17 23:28:10 dovecot_login authenticator failed for ([61.80.161.148]) [61.80.161.148]:45647: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2025-11-17 23:28:30 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:46904: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pptVONVDrLCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 17 23:29:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<vrSEOtVDhNskMrGr>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<avrqO9VDYMexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 23:29:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<7R8CPNVD/tB3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 23:30:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<DaWJPdVDlrmP9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9qG4PdVDJNOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.124
country_id: 1210997
description:
2025-11-17 23:29:10 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:51792: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 23:29:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<iAP0OtVDlJqdQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 23:29:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<p0GPO9VDwulA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 23:30:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<b8WHP9VD3sx9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-11-17 23:30:51 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:54560: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-17 23:30:51 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:52938: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-11-17 23:30:55 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:46694: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.241.59.150
country_id: 1562822
description:
2025-11-17 23:30:29 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.59.150]:45546: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.138.130.143
country_id: 2017370
description:
2025-11-17 23:30:30 dovecot_login authenticator failed for ([78.138.130.143]) [78.138.130.143]:53858: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:30:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tDqFP9VDuNyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-11-17 23:31:14 dovecot_login authenticator failed for ([125.20.231.225]) [128.185.231.6]:50424: 535 Incorrect authentication data (set_id=suporte@inovasite.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 17 23:31:32 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=<dSIPQ9VD8uexm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-17 23:31:57 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:53122: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:31:58 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51449: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-17 23:31:11 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:36170: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2025-11-17 23:31:25 dovecot_login authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:38547: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 17 23:31:30 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<dYLuQtVDmeexm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-17 23:31:30 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:48712: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PqMQQ9VDKJSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-17 23:31:33 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:50202: 535 Incorrect authentication data (set_id=suporte)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 23:31:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<QYd7Q9VDerd2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-17 23:31:09 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:39413: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 23:33:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<uOB/SNVDEtFvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 23:32:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<JA0cRdVDzqGd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 23:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<6ZXoRdVDCIFCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 23:32:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<YeoMRtVD4MZ3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EF+rRtVDJK+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 23:32:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<WP2mRtVDvq+l0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-11-17 23:32:57 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:36646: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 23:32:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<KtWDRdVDkptzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 23:32:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<HXttRtVDfrZo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<A4A2StVDlM2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 17 23:33:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<RpMdStVDws8v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.64.123.166
country_id: 3932488
description:
2025-11-17 23:33:40 dovecot_login authenticator failed for ([181.64.123.166]) [181.64.123.166]:48416: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.84.78.69
country_id: 630336
description:
2025-11-17 23:33:58 dovecot_login authenticator failed for ([93.84.78.69]) [93.84.78.69]:44179: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QLwDTNVDYNyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 23:33:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<NtLfSNVDBMukXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.55.99.226
country_id: 390903
description:
2025-11-17 23:33:25 dovecot_login authenticator failed for ppp005055099226.access.hol.gr [5.55.99.226]:35136: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 23:34:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<SVGRTNVDLJWYNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QmLSTdVDBuaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-17 23:35:15 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:43687: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-11-17 23:35:39 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:41262: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 17 23:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<01o2U9VDtKEI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.120.254
country_id: 6252001
description:
2025-11-17 23:35:21 dovecot_login authenticator failed for ([24.149.120.254]) [24.149.120.254]:39388: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 23:35:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<nZ+MUdVD1qR9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-17 23:35:43 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:55905: 535 Incorrect authentication data (set_id=sociais)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 23:35:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<Eiu1UtVDBkmKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-17 23:35:33 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:60098: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.120
country_id: 1814991
description:
2025-11-17 23:35:50 dovecot_login authenticator failed for ([183.167.198.120]) [183.167.198.120]:46912: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 23:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<kdUsU9VD6MZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-17 23:35:26 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:58441: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 23:35:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<3szJUNVD8MuiAOAm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LThhUdVDPpGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.241.251.240
country_id: 1562822
description:
2025-11-17 23:35:33 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.251.240]:51996: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-11-17 23:35:42 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:35612: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 23:35:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<zlo0UtVDUL5o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:36:04 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60006: 535 Incorrect authentication data (set_id=postmaster@cleservicosindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.92
country_id: 2186224
description:
2025-11-17 23:37:04 dovecot_login authenticator failed for ([121.73.163.92]) [121.73.163.92]:53376: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:36:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58406: 535 Incorrect authentication data (set_id=support@cleservicosindustriais.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 23:36:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Q1QMVtVDCtlns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Uub0VNVDFK2xV3kv>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.16.241.212
country_id: 2077456
description:
Nov 17 23:36:36 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.184
country_id: 953987
description:
Nov 17 23:37:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=102.129.60.184, lip=200.150.196.245, TLS, session=<6qF/VdVDRd5mgTy4>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2hG7VtVDUraxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 23:36:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<vSqTVNVDqgivfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 23:36:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<JmPaVNVDRKqYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.79.74
country_id: 3469034
description:
Nov 17 23:37:21 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=177.190.79.74, lip=200.150.196.245, TLS, session=<dZXLVtVDNMyxvk9K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 23:37:22 dovecot_login authenticator failed for (toromartelinho.com.br) [61.50.119.110]:57802: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.130.79
country_id: 2077456
description:
2025-11-17 23:37:27 dovecot_login authenticator failed for ([120.157.130.79]) [120.157.130.79]:57974: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 203.16.241.212
country_id: 2077456
description:
Nov 17 23:37:32 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7aiGWNVDPsCxV3kv>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.16.241.212
country_id: 2077456
description:
Nov 17 23:37:07 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 23:37:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<JP3hVtVDsoVAF/Qn>


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 203.16.241.212
country_id: 2077456
description:
Nov 17 23:37:13 hosting pure-ftpd: (?@203.16.241.212) [WARNING] Authentication failed for user [radiolouvoreterno]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 23:38:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<7KobXdVDTpQrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:38:07 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52239: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 23:38:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<jH4IW9VD3u2B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.87
country_id: 1814991
description:
2025-11-17 23:38:28 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:57440: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lMwcXNVD+tqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-17 23:38:41 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:34556: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-11-17 23:38:48 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:59244: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-17 23:38:19 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:47594: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6uGxX9VDNIexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 23:40:03 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49301: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.218.37.145
country_id: 1814991
description:
2025-11-17 23:39:11 dovecot_login authenticator failed for ([111.206.233.34]) [221.218.37.145]:56233: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.95
country_id: 6252001
description:
2025-11-17 23:39:21 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:60312: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
country_id: 2017370
description:
2025-11-17 23:39:22 dovecot_login authenticator failed for (est.giport.ru) [82.208.65.46]:3064: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:40:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MXJ+YdVD8pCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-17 23:40:04 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:62550: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 23:39:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<mDOeXtVD4rykXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-17 23:39:33 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:45133: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 23:39:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<3pUPYdVD1uSP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-17 23:41:05 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:54354: 535 Incorrect authentication data (set_id=contato)


