# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.38
country_id: 2635167
description:
Nov 17 11:34:55 hosting dovecot: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.38, lip=200.150.196.245, TLS, session=<6PRDQMtD7P4jy9Mm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bZitQMtDcKuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.71.210.237
country_id: 3469034
description:
Nov 17 11:35:03 hosting dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<daniel@acmesolar.com.br>, method=PLAIN, rip=45.71.210.237, lip=200.150.196.245, TLS: Connection closed, session=<M/mUQMtDSLotR9Lt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:35:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:59340: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.97.42.13
country_id: 3469034
description:
Nov 17 11:35:09 hosting dovecot: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<joao.szimanski@calcautomacao.com.br>, method=PLAIN, rip=52.97.42.13, lip=200.150.196.245, TLS: Connection closed, session=<0wacQMtD4Ms0YSoN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.163.173.227
country_id: 3469034
description:
Nov 17 11:35:15 hosting dovecot: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<josiane@schneidersglass.com.br>, method=PLAIN, rip=179.163.173.227, lip=200.150.196.245, TLS, session=<jKNRQctDjdCzo63j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.47.88
country_id: 6252001
description:
2025-11-17 11:34:52 dovecot_login authenticator failed for ([10.143.41.218]) [143.244.47.88]:54474: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:34:54 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:56112: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Nov 17 11:35:46 hosting dovecot: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:35:21 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:55852: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9ol2QstDarqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.142.55.40
country_id: 1861060
description:
2025-11-17 11:35:35 dovecot_login authenticator failed for 40.55.142.133.rev.iijmobile.jp [133.142.55.40]:41425: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:36:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:53868: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-17 11:35:18 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:34706: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-11-17 11:35:30 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61631: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:35:41 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61544: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2025-11-17 11:35:44 dovecot_login authenticator failed for ([14.48.112.8]) [14.48.112.8]:2107: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:35:39 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:57003: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:35:57 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:57839: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2025-11-17 11:36:06 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:53827: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.163.119
country_id: 1880251
description:
[2025-11-17 11:35:16 -0300] info [cpaneld] 152.42.163.119 - OIxlhfZ8< "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.164.244.63
country_id: 6252001
description:
2025-11-17 11:35:21 dovecot_login authenticator failed for (ADMIN) [69.164.244.63]:55906: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-17 11:35:38 dovecot_login authenticator failed for (visaotur.sdr.gvt.net.br) [186.215.245.175]:33635: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:35:45 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:60736: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.121.0.32
country_id: 1814991
description:
2025-11-17 11:35:45 dovecot_login authenticator failed for ([123.121.0.32]) [123.121.0.32]:44254: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-11-17 11:35:45 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:38420: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:37:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:64508: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:36:50 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54661: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-17 11:36:52 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:34199: 535 Incorrect authentication data (set_id=compras.ricardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-17 11:36:58 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:42254: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-17 11:36:51 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:39726: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-17 11:37:08 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3236: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:36:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:59162: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.235.34
country_id: 1814991
description:
2025-11-17 11:36:37 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:51736: 535 Incorrect authentication data (set_id=compras.ricardo@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:36:27 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:58097: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ISQHRstDJN2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:37:03 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:60033: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:36:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:50258: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:36:22 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49215: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:37:53 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:54573: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.40.247
country_id: 6252001
description:
2025-11-17 11:38:03 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:43206: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:38:03 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:49244: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:38:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:63274: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-11-17 11:37:16 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:36092: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DEWbSctDwo2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:37:57 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:59741: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:38:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XclrS8tDRJ2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-11-17 11:38:33 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:43008: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 11:38:50 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:50294: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:39:07 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:49398: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:39:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:53920: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-11-17 11:39:14 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:51992: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.24.126.18
country_id: 1562822
description:
2025-11-17 11:39:15 dovecot_login authenticator failed for (dynamic.vdc.vn) [123.24.126.18]:35888: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:38:17 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:54485: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.209.182
country_id: 1269750
description:
2025-11-17 11:38:32 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [122.166.209.182]:37454: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:38:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54325: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-17 11:39:00 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:40152: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jh0tTctD4KyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:38:41 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:50095: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:39:01 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:63957: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.157.32
country_id: 337996
description:
2025-11-17 11:38:46 dovecot_login authenticator failed for ([196.189.44.177]) [196.190.157.32]:1348: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.78.131
country_id: 2077456
description:
2025-11-17 11:38:53 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:51116: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:38:52 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:60859: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.91.119
country_id: 2017370
description:
2025-11-17 11:39:36 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:38477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-17 11:40:02 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:54184: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:39:29 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:54466: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hFvAUMtDEM2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-17 11:39:35 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:48284: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:39:40 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:62770: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:39:58 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:55414: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:39:26 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:54350: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-17 11:39:43 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:58054: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 11:40:07 dovecot_login authenticator failed for (1rfWlBx) [91.92.243.111]:57528: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-17 11:39:21 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:45066: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-11-17 11:39:26 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:52360: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:39:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:63716: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:40:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:52499: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 11:40:26 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:51740: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2025-11-17 11:40:30 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:52283: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:40:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:53340: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:41:01 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:52699: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:41:00 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:53479: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 10100
name: First time user logged in.
abuser: 191.243.199.212
country_id: 3469034
description:
Nov 17 11:41:11 hosting sshd[17186]: Accepted password for root from 191.243.199.212 port 57884 ssh2


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PPVTVMtDwIGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:40:32 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:60464: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 11:40:39 dovecot_login authenticator failed for (0AB6vTht) [91.92.243.111]:54962: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-17 11:40:54 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:35130: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 11:41:03 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64838: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:40:58 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:62250: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:41:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:51537: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<S50kVstDHI+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:41:43 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49247: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:41:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:62580: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.204.32
country_id: 1814991
description:
2025-11-17 11:41:52 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:52522: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:41:55 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:56783: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.53.112
country_id: 3469034
description:
Nov 17 11:41:34 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=170.82.53.112, lip=200.150.196.245, TLS, session=<j5GCVstDq7GqUjVw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.69.12
country_id: 1269750
description:
2025-11-17 11:41:51 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:42794: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 11:41:30 dovecot_login authenticator failed for (RWf34COSiN) [91.92.243.111]:51160: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oNblV8tD4pqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:41:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:59916: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:41:37 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:64228: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:41:48 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:57858: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:42:10 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:52776: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.47.242
country_id: 2017370
description:
2025-11-17 11:42:10 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:58974: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.135.250
country_id: 6252001
description:
2025-11-17 11:41:21 dovecot_login authenticator failed for host250.sub-63-47-135.myvzw.com [63.47.135.250]:50513: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 11:41:25 dovecot_login authenticator failed for (brinquelocacoes.com) [111.122.211.212]:55902: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-11-17 11:41:33 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:43472: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-11-17 11:42:12 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:33676: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:43:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:63913: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:42:19 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:59966: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:42:35 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:59974: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
country_id: 1814991
description:
2025-11-17 11:42:46 dovecot_login authenticator failed for ([183.237.33.162]) [183.237.33.162]:62064: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:42:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:54664: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 11:42:57 dovecot_login authenticator failed for (KAZu4PZVA) [91.92.243.111]:56642: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:42:32 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:49681: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xRB+W8tDrL6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-17 11:42:43 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:51807: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:43:00 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:62144: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2XQKX8tDquKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2025-11-17 11:43:35 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:56061: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:43:56 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:54180: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2025-11-17 11:44:11 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:38144: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:44:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:63401: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:43:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54763: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 11:43:34 dovecot_login authenticator failed for (2xx40lK0ND) [91.92.243.111]:49275: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pb3bYMtDxICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-17 11:44:05 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:52667: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:44:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:58234: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-17 11:43:18 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:52740: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:43:19 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61531: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-17 11:43:38 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:47666: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:44:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:64905: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:44:45 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61846: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:44:54 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:58240: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:44:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:49790: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7mOjYstD2pOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:44:35 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:64011: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 11:44:35 dovecot_login authenticator failed for (fUqb91QF1) [91.92.243.111]:61204: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:44:48 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:60545: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 181.77.193.194
country_id: 3469034
description:
[2025-11-17 11:45:01 -0300] info [webmaild] 181.77.193.194 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
country_id: 1814991
description:
2025-11-17 11:45:09 dovecot_login authenticator failed for ([112.27.129.78]) [112.27.129.78]:41103: 535 Incorrect authentication data (set_id=ms@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:44:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:57752: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-17 11:45:38 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:47508: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:45:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:51849: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:45:55 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:52551: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0mIxZstDJK+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2025-11-17 11:45:31 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:57902: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:45:32 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:52968: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:45:32 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:52486: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-17 11:45:58 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:25322: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:45:18 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49781: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-17 11:45:19 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:35580: 535 Incorrect authentication data (set_id=ms)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-17 11:45:47 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:54568: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:45:56 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:65248: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:46:16 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:57485: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:46:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:55409: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:46:51 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:51870: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:47:08 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:62118: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:47:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:50376: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:46:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:53326: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1LbDactDQNCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:46:47 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:56290: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:46:50 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:65044: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:46:54 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:49909: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<woKUa8tDyNuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:47:42 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:50717: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:48:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:51025: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 11:47:24 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:33064: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:47:40 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:55872: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RiRXbctD7IGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-11-17 11:47:40 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:44972: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.248.40.27
country_id: 3057568
description:
Nov 17 11:47:56 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=85.248.40.27, lip=200.150.196.245, TLS, session=<CxHObctD9+pV+Cgb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:48:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:56826: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-17 11:47:18 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:40809: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 11:47:20 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess8351698287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-17 11:48:37 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:16912: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:49:02 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:49837: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-17 11:49:08 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:54666: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:48:27 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:58832: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-11-17 11:49:00 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:35760: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-11-17 11:48:42 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:57434: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:48:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:58927: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:49:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:60847: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-17 11:49:10 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:54803: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-17 11:48:19 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:43213: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-11-17 11:48:24 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:55639: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tAv2cMtDjqCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 11:48:34 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:50535: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:48:45 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:63945: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:48:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:58566: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 11:49:00 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:60830: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 11:48:20 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess8351698287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:49:43 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:60643: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.91.215.100
country_id: 1814991
description:
2025-11-17 11:49:53 dovecot_login authenticator failed for ([106.91.215.100]) [106.91.215.100]:57668: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:49:58 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:57829: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:49:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:55705: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-17 11:49:23 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:34514: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.118
country_id: 1269750
description:
2025-11-17 11:50:02 dovecot_login authenticator failed for ([128.185.166.65]) [182.95.222.118]:52602: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zQtOdstDyNqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:50:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49558: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-17 11:50:03 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:57924: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:49:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<asGMdMtDcMCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
country_id: 2017370
description:
2025-11-17 11:49:44 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:57297: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-17 11:50:15 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:44508: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-17 11:49:32 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:38200: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:50:01 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:59635: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:49:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:52926: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-11-17 11:49:35 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:47068: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2025-11-17 11:49:45 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:53080: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.91.215.99
country_id: 1814991
description:
2025-11-17 11:50:05 dovecot_login authenticator failed for ([106.91.215.99]) [106.91.215.99]:45359: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2025-11-17 11:50:15 dovecot_login authenticator failed for ([111.26.62.46]) [111.26.62.46]:40958: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 11:49:20 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess8351698287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-17 11:49:32 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:38427: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.23.53.80
country_id: 6252001
description:
2025-11-17 11:49:47 dovecot_login authenticator failed for (static.38.23.53.80.macminivault.com) [38.23.53.80]:65452: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-17 11:50:00 dovecot_login authenticator failed for ([178.232.116.165]) [178.232.116.165]:33383: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-17 11:49:26 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:64050: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 11:49:42 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:62650: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:50:00 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:50921: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.104.142
country_id: 2077456
description:
2025-11-17 11:50:21 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:46876: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x7cReMtDzOmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:51:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:57701: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-17 11:50:31 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:47552: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 11:50:32 dovecot_login authenticator failed for (User) [177.74.174.120]:56190: 535 Incorrect authentication data (set_id=default@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:50:37 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:61931: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-11-17 11:50:28 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:56738: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.231
country_id: 2921044
description:
2025-11-17 11:50:45 dovecot_login authenticator failed for (ADMIN) [77.90.185.231]:61108: 535 Incorrect authentication data (set_id=janine@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:50:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:64869: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:50:56 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:60804: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-11-17 11:50:27 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:47561: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-17 11:50:41 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:52334: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:50:58 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:59977: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.252.140.114
country_id: 1835841
description:
2025-11-17 11:52:13 dovecot_login authenticator failed for ([182.252.140.114]) [182.252.140.114]:59937: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</O6xe8tD/qWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:51:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:64738: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:51:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:56674: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2025-11-17 11:51:45 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:57880: 535 Incorrect authentication data (set_id=ilumix@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:51:53 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:54156: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.1.86
country_id: 798544
description:
Nov 17 11:51:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=89.186.1.86, lip=200.150.196.245, TLS, session=<NlU7fMtDbLNZugFW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:52:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:56177: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.246
country_id: 3017382
description:
2025-11-17 11:52:32 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:36478: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-11-17 11:53:09 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:42321: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-17 11:52:22 dovecot_login authenticator failed for ([177.135.64.89]) [177.135.67.189]:49292: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:52:25 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:61010: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:52:52 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:57847: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.98.253.231
country_id: 2017370
description:
2025-11-17 11:52:58 dovecot_login authenticator failed for (37.98.253.231-FTTB.planeta.tc) [37.98.253.231]:57971: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.0.186.190
country_id: 3895114
description:
Nov 17 11:52:19 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=161.0.186.190, lip=200.150.196.245, TLS, session=<u9hgfctDGNOhALq+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:52:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:53026: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B+06f8tD9L6xV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</UwGgctDONCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-17 11:52:17 dovecot_login authenticator failed for (letracaixa.art.br) [60.2.243.174]:44234: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:53:02 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:62302: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2025-11-17 11:52:17 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:40120: 535 Incorrect authentication data (set_id=ilumix)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:53:38 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:52400: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-11-17 11:53:40 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:38842: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-17 11:53:44 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:54012: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:53:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:63691: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:53:47 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:51195: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:53:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:62868: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:54:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:56961: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2025-11-17 11:53:35 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:33208: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.59.206.224
country_id: 1814991
description:
2025-11-17 11:54:12 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:64313: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lQbXgstDjN2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2025-11-17 11:53:18 dovecot_login authenticator failed for ([183.98.68.199]) [183.98.68.199]:58843: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:54:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:52735: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-17 11:55:06 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:53562: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-11-17 11:54:42 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:33585: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gltkhstD2pKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:54:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:59626: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:54:49 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:52333: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:54:55 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:59476: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.57.136.141
country_id: 2017370
description:
2025-11-17 11:55:02 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:40081: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:54:29 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:62631: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:55:18 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:64389: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:55:25 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:62801: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:55:25 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:65114: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 11:55:54 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:41158: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-17 11:56:00 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:56456: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:55:34 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:51006: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:55:46 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:54763: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:55:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:61018: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BDDIi8tDZsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.51
country_id: 1819730
description:
2025-11-17 11:55:23 dovecot_login authenticator failed for (182.239.80.51.hk.chinamobile.com) [182.239.80.51]:42384: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FNf0ictD9LOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.53
country_id: 1668284
description:
2025-11-17 11:55:52 dovecot_login authenticator failed for (ADMIN) [36.255.98.53]:54460: 535 Incorrect authentication data (set_id=jailson@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-17 11:55:55 dovecot_login authenticator failed for (89.140.17.22.static.user.ono.com) [81.0.54.119]:42641: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-17 11:56:09 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42666: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:56:19 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:49922: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
country_id: 1814991
description:
2025-11-17 11:56:53 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:35532: 535 Incorrect authentication data (set_id=junior)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-17 11:56:52 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:64125: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2025-11-17 11:57:03 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:35938: 535 Incorrect authentication data (set_id=junior)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6duQjctD0NGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-11-17 11:56:33 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:57504: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:56:45 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:49933: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-17 11:56:45 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:56696: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:56:53 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:61030: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.121.99
country_id: 1814991
description:
2025-11-17 11:56:29 dovecot_login authenticator failed for ([111.53.121.99]) [111.53.121.99]:42378: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-11-17 11:56:38 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:32793: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-17 11:57:09 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:46466: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-17 11:56:24 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:33384: 535 Incorrect authentication data (set_id=junior@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-17 11:56:58 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:45560: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:57:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:54235: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:57:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:56711: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 11:57:37 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:49673: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-17 11:57:50 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:40076: 535 Incorrect authentication data (set_id=carlo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-17 11:58:02 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:27969: 535 Incorrect authentication data (set_id=carlo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 11:58:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:60376: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:57:20 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:53900: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.86.2
country_id: 1814991
description:
2025-11-17 11:57:31 dovecot_login authenticator failed for ([223.82.86.2]) [223.82.86.2]:12658: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 11:57:30 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:42762: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r0cdkctDnISxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-17 11:58:50 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:32798: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.183.100.27
country_id: 2017370
description:
2025-11-17 11:59:02 dovecot_login authenticator failed for ([213.183.100.27]) [213.183.100.27]:59146: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-17 11:58:36 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:55664: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.51
country_id: 1668284
description:
2025-11-17 11:58:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.51]:50978: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 11:58:50 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:49564: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<o793lstDRrKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YJ+3lMtDvqOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 11:58:36 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:57416: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:00:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:61008: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.220.241.50
country_id: 1814991
description:
2025-11-17 11:59:18 dovecot_login authenticator failed for ([60.220.241.51]) [60.220.241.50]:48520: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 11:59:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:63223: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 11:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</QtNmMtD+OWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.61.137
country_id: 1562822
description:
2025-11-17 11:59:42 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:38504: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.213.224.4
country_id: 6252001
description:
2025-11-17 11:59:44 dovecot_login authenticator failed for ([140.235.89.71]) [162.213.224.4]:36240: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 11:59:45 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:61185: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.57.136.141
country_id: 2017370
description:
2025-11-17 12:00:10 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:55480: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 12:00:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:58517: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2025-11-17 12:00:16 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:58045: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-11-17 12:00:18 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:38767: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-11-17 12:00:25 dovecot_login authenticator failed for ([49.207.15.25]) [49.207.15.25]:53203: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-17 12:00:25 dovecot_login authenticator failed for ([220.67.139.254]) [221.145.5.14]:36398: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.120.26
country_id: 1814991
description:
2025-11-17 12:00:27 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:38308: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 12:00:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:59746: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2025-11-17 12:00:38 dovecot_login authenticator failed for ([183.6.115.88]) [183.6.115.88]:37318: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 12:00:40 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:62475: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-17 12:00:41 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:44624: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kdzbm8tD9q6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-17 12:00:49 dovecot_login authenticator failed for ([24.144.4.218]) [38.87.177.252]:46222: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:00:59 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:61257: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EQM5octDPtuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.14
country_id: 130758
description:
2025-11-17 12:01:24 dovecot_login authenticator failed for (ADMIN) [62.60.131.14]:51714: 535 Incorrect authentication data (set_id=atendimento@deputadamaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:01:28 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:64737: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ENhtn8tD6MixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 12:01:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57877: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 12:01:54 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:50146: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.111.3.59
country_id: 2017370
description:
2025-11-17 12:02:40 dovecot_login authenticator failed for (noname.vdonsk.ru) [193.111.3.59]:40124: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-11-17 12:02:54 dovecot_login authenticator failed for (18980204017.user.veloxzone.com.br) [189.80.146.46]:44691: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-17 12:02:56 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:34958: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 12:03:00 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:54206: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 12:03:10 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:55512: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.80.56
country_id: 2017370
description:
2025-11-17 12:03:14 dovecot_login authenticator failed for ([5.141.80.56]) [5.141.80.56]:48022: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.61.229.158
country_id: 1814991
description:
2025-11-17 12:02:24 dovecot_login authenticator failed for (158.229.61.59.broad.qz.fj.dynamic.163data.com.cn) [59.61.229.158]:54101: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:02:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:65077: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ADAIo8tDJuexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.41.142.164
country_id: 1835841
description:
2025-11-17 12:02:35 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:34917: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-11-17 12:02:53 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:50284: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 12:04:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:58929: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.54.224
country_id: 798544
description:
2025-11-17 12:03:22 dovecot_login authenticator failed for 89-67-54-224.dynamic.play.pl [89.67.54.224]:52612: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 12:03:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:54717: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6sCapstDVpixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:03:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:61256: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:04:06 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:59031: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:04:29 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:50718: 535 Incorrect authentication data (set_id=ieqecoville@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YVsvqstDPrGxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QsDvq8tDPsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.87
country_id: 130758
description:
2025-11-17 12:05:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.87]:58259: 535 Incorrect authentication data (set_id=atendimento@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.32
country_id: 1668284
description:
2025-11-17 12:04:25 dovecot_login authenticator failed for (ADMIN) [36.255.98.32]:57293: 535 Incorrect authentication data (set_id=atendimento@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:05:42 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:59027: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.203.38
country_id: 1835841
description:
2025-11-17 12:05:53 dovecot_login authenticator failed for ([59.6.203.38]) [59.6.203.38]:47462: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:06:07 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:53406: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 12:06:12 H=(195.3.134.135) [179.0.178.53]:52396 F=<erictremblaysi@hotmail.com> rejected RCPT <hedson@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:52396 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-17 12:05:18 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:58082: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-11-17 12:05:28 dovecot_login authenticator failed for ([189.8.125.130]) [189.8.125.130]:54488: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RxS+rctDXtCxV3kv>


plugin: ossec
rule: 5403
name: First time user executed sudo.
description:
Nov 17 12:06:34 hosting sudo: wp-toolkit : (command continued) user-48=hiperces user-49=observde user-50=cleverso user-51=arksonco user-52=espacopr user-53=compatad user-54=palmetto user-55=schneide user-56=oabsjp user-57=hubopera user-58=joelbuen user-59=eaglebpo user-60=vidaenge user-61=thebesta user-62=fundamen user-63=pmulheres user-64=editora user-65=radiosar user-66=highqual user-67=advguilh user-68=sulindus user-69=persiana user-70=jvscurso user-71=moltrico user-72=singsegu user-73=bethelpa user-74=elotelec user-75=vmaralima user-76=reidaspe user-77=quintalg user-78=eloempre user-79=metalurg user-80=cartazes user-81=raquelas user-82=acqualuz user-83=wwwmagad user-84=vivocons user-85=polloste user-86=shalom user-87=pirajusolucoesco user-88=maringas user-89=proareco user-90=joycesco user-91=lorussoi user-92=salamuni user-93=opsconso user-94=centroga user-95=pousadar user-96=wwfmovei user-97=sinodode user-98=pibtrind user-99=innovati user-100=seventre user-101=projetoc


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2adWsctDhu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-17 12:06:43 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:51287: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 12:06:57 dovecot_login authenticator failed for (brinquelocacoes.com) [61.50.119.110]:54524: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:06:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:58081: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:06:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:65485: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZMqxtstDBqqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:08:08 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:60077: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 12:07:21 dovecot_login authenticator failed for (brinquelocacoes.com) [61.50.119.110]:58756: 535 Incorrect authentication data (set_id=test@brinquelocacoes.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AfTgtMtD7p2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 12:08:52 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:35574: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-17 12:08:20 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:58662: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:08:27 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:54238: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0OhyuMtD3raxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.140.7.210
country_id: 2017370
description:
2025-11-17 12:08:33 dovecot_login authenticator failed for n7-c210.client.tomica.ru [78.140.7.210]:50208: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4pwHvMtDTtSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:09:38 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:54343: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.37
country_id: 1269750
description:
Nov 17 12:10:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=103.18.166.37, lip=200.150.196.245, TLS, session=<nbLTvMtDEYtnEqYl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-11-17 12:10:14 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:43642: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.2.199
country_id: 953987
description:
Nov 17 12:09:30 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=102.66.2.199, lip=200.150.196.245, TLS, session=<CfqWustDtrVmQgLH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.19.166
country_id: 290557
description:
2025-11-17 12:10:34 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:40046: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.126.90.69
country_id: 1814991
description:
2025-11-17 12:10:56 dovecot_login authenticator failed for ([119.126.90.69]) [119.126.90.69]:41841: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EAVnwctDMJOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:10:19 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:55293: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-17 12:10:26 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:50568: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:10:27 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54970: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mIabv8tDGIexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-17 12:11:24 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:33003: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:11:44 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:50947: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-17 12:11:52 dovecot_login authenticator failed for ([182.79.95.231]) [152.52.244.46]:51412: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.184.202
country_id: 1814991
description:
2025-11-17 12:12:04 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:55032: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.193.143.197
country_id: 6252001
description:
2025-11-17 12:12:12 dovecot_login authenticator failed for ([216.193.143.197]) [216.193.143.197]:37006: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AAcuw8tDVq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.228.220
country_id: 3175395
description:
2025-11-17 12:11:39 dovecot_login authenticator failed for (85-117-228-220.customers.onetek.premierenet.net) [85.117.228.220]:58869: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-11-17 12:11:45 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:33318: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-17 12:11:57 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:58058: 535 Incorrect authentication data (set_id=gerson.comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:13:06 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:59872: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-11-17 12:12:33 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:47496: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-11-17 12:12:40 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:57736: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:13:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:60406: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-11-17 12:12:35 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:40082: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-17 12:12:56 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:45425: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-11-17 12:12:56 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:46064: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.87.145
country_id: 1814991
description:
2025-11-17 12:13:12 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:46064: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-17 12:12:20 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:55441: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-17 12:12:23 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:54878: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:12:29 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:61257: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8x3HxstDQMqxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:14:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HbwrzMtDeI2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:14:04 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:53689: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-17 12:14:08 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:36904: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 12:14:11 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50041: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OoxbystDKu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-11-17 12:15:08 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:33544: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-11-17 12:14:19 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:62754: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9onmzctDequxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.132.142
country_id: 6290252
description:
Nov 17 12:14:34 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse>, method=PLAIN, rip=91.234.132.142, lip=200.150.196.245, TLS, session=<zHL9zMtDqeNb6oSO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.59.206.224
country_id: 1814991
description:
2025-11-17 12:14:39 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:55206: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:14:43 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:33894: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.220.241.50
country_id: 1814991
description:
2025-11-17 12:14:37 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:41261: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-17 12:14:53 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:34289: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.182.94
country_id: 6252001
description:
2025-11-17 12:14:55 dovecot_login authenticator failed for host94.sub-63-47-182.myvzw.com [63.47.182.94]:7764: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-17 12:16:05 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:55474: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.242.189
country_id: 2750405
description:
2025-11-17 12:15:18 H=([91.92.242.189]) [91.92.242.189]:53173 F=<info@um.bzidq.com> rejected RCPT <contato@betmetalurgica.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.84.107.200
country_id: 2661886
description:
Nov 17 12:15:23 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<paulo@louvoreterno.com.br>, method=PLAIN, rip=45.84.107.200, lip=200.150.196.245, TLS: Connection closed, session=<UC8Q0MtDaLItVGvI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:15:23 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:62893: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gDGE0ctDosqxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.85.88.44
country_id: 3469034
description:
2025-11-17 12:15:36 H=(localhost) [187.85.88.44]:25003 F=<hello@localhost> rejected RCPT <Eac3RbkusG7lj9Y@partnerscapital.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:15:48 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54957: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-17 12:16:40 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:48514: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 186.208.218.149
country_id: 3469034
description:
[2025-11-17 12:16:43 -0300] info [webmaild] 186.208.218.149 - priscilasalles@advsalles.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:16:45 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:49572: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sZTY1stD8pGxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qVwX1ctD/uyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-17 12:17:15 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:53938: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.50
country_id: 1668284
description:
2025-11-17 12:17:24 dovecot_login authenticator failed for (ADMIN) [36.255.98.50]:52547: 535 Incorrect authentication data (set_id=francine@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-17 12:17:27 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:62193: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2zep2MtDrJ6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-11-17 12:18:08 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:57163: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:18:09 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54287: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
country_id: 1562822
description:
2025-11-17 12:18:38 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:18000: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2025-11-17 12:18:52 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:30248: 535 Incorrect authentication data (set_id=loopert)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-11-17 12:18:23 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:54207: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9x023MtD8ryxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.9.55
country_id: 2635167
description:
Nov 17 12:18:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andre.nascimento@calcautomacao.com.br>, method=PLAIN, rip=46.101.9.55, lip=200.150.196.245, session=<ZONs3MtD8tYuZQk3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2025-11-17 12:18:52 dovecot_login authenticator failed for ([222.128.15.132]) [222.128.15.132]:39456: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 90.160.139.163
country_id: 2510769
description:
Nov 17 12:19:00 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andre.nascimento@calcautomacao.com.br>, method=PLAIN, rip=90.160.139.163, lip=200.150.196.245, TLS, session=<8euy3MtDx+paoIuj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.0.81.84
country_id: 1814991
description:
2025-11-17 12:19:10 dovecot_login authenticator failed for ([111.0.81.84]) [111.0.81.84]:56450: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2025-11-17 12:20:00 dovecot_login authenticator failed for ([85.236.187.43]) [85.236.187.43]:53554: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1Wae4ctDzuuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 221.165.172.38
country_id: 1835841
description:
Nov 17 12:19:25 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andre.nascimento>, method=PLAIN, rip=221.165.172.38, lip=200.150.196.245, TLS, session=<9cwO3stDFJHdpawm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xHLS38tDINixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-17 12:19:36 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:48578: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:19:43 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:62455: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-11-17 12:20:48 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:35826: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.255.104
country_id: 2017370
description:
2025-11-17 12:20:53 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:46154: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-17 12:21:10 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:63845: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:20:22 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:62082: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-11-17 12:20:27 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:33098: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tSxf48tDsIuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 221.167.21.148
country_id: 1835841
description:
Nov 17 12:22:14 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info>, method=PLAIN, rip=221.167.21.148, lip=200.150.196.245, TLS, session=<khMi6MtDeqbdpxWU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2025-11-17 12:21:42 dovecot_login authenticator failed for ([111.26.62.45]) [111.26.62.46]:43334: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2025-11-17 12:21:50 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:47869: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-17 12:22:12 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:52066: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:21:44 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:46014: 535 Incorrect authentication data (set_id=ieqecoville@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.7.112.130
country_id: 1605651
description:
Nov 17 12:21:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=171.7.112.130, lip=200.150.196.245, TLS, session=<Whel5stDas+rB3CC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
country_id: 1814991
description:
2025-11-17 12:21:55 dovecot_login authenticator failed for ([60.18.139.82]) [60.18.139.82]:49704: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-11-17 12:22:04 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:54562: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-11-17 12:21:24 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:57488: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.234.68.221
country_id: 1814991
description:
2025-11-17 12:21:30 dovecot_login authenticator failed for ([116.234.68.221]) [116.234.68.221]:12584: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rNT25stD3KuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:22:11 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:50840: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iH+L6stDaMyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.95
country_id: 1814991
description:
2025-11-17 12:22:37 dovecot_login authenticator failed for ([36.135.62.94]) [36.135.62.95]:54872: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.69.12
country_id: 1269750
description:
2025-11-17 12:22:48 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:39694: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.67.122.230
country_id: 1835841
description:
2025-11-17 12:22:52 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:45360: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<I7lX7MtDAtqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-17 12:23:49 dovecot_login authenticator failed for ([187.58.241.90]) [187.58.241.90]:43489: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.233.215
country_id: 2017370
description:
2025-11-17 12:23:54 dovecot_login authenticator failed for ([212.164.233.215]) [212.164.233.215]:52216: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-17 12:24:07 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:34572: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 12:24:07 dovecot_login authenticator failed for (letracaixa.art.br) [111.122.211.212]:40308: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:23:21 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:46148: 535 Incorrect authentication data (set_id=hotelmarques@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:23:22 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:54599: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iFoX7stDJOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.62.88
country_id: 1835841
description:
2025-11-17 12:23:38 dovecot_login authenticator failed for ([119.206.62.88]) [119.206.62.88]:52350: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 12:23:38 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58000: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Sfy28ctDbpqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 12:24:34 dovecot_login authenticator failed for (letracaixa.art.br) [111.122.211.212]:45082: 535 Incorrect authentication data (set_id=admin@letracaixa.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.205.184.169
country_id: 146669
description:
2025-11-17 12:24:56 dovecot_login authenticator failed for ([185.205.184.169]) [185.205.184.169]:58736: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:25:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:51663: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-17 12:24:20 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:57456: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.91.154
country_id: 3469034
description:
2025-11-17 12:24:22 dovecot_login authenticator failed for ([186.227.91.154]) [186.227.91.154]:60716: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-17 12:24:33 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:58680: 535 Incorrect authentication data (set_id=ti)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 12:26:10 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:64788: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.20.106.40
country_id: 2017370
description:
2025-11-17 12:25:18 dovecot_login authenticator failed for (89.20.106.40.permonline.ru) [89.20.106.40]:58013: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c7tD9ctDtMWxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dMUT98tDvNGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.52
country_id: 1668284
description:
2025-11-17 12:26:05 dovecot_login authenticator failed for (ADMIN) [36.255.98.52]:49722: 535 Incorrect authentication data (set_id=hsw.skkull@transol.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 12:26:16 dovecot_login authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:64788: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-11-17 12:26:31 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:59850: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:26:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8WHf+MtDkOGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-11-17 12:26:56 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:37898: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:28:03 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:60209: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-17 12:27:24 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34776: 535 Incorrect authentication data (set_id=comercial@inovasite.net)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Um5m/MtD3o6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-17 12:27:37 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:54716: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-11-17 12:27:42 dovecot_login authenticator failed for ([14.194.128.158]) [14.194.128.158]:60792: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-17 12:27:56 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:56165: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hJcCAMxDeK2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-17 12:28:44 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:46462: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YLrBAcxDVrmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2025-11-17 12:29:04 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:42124: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sGCWA8xDds2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.144
country_id: 1733045
description:
2025-11-17 12:29:46 dovecot_login authenticator failed for ([183.171.4.144]) [183.171.4.144]:50872: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.104.142
country_id: 2077456
description:
2025-11-17 12:30:05 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:54552: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-11-17 12:29:30 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:41019: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.70
country_id: 2750405
description:
2025-11-17 12:30:23 dovecot_login authenticator failed for (ADMIN) [84.54.33.70]:56616: 535 Incorrect authentication data (set_id=ieqecoville@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<t2sfB8xDxOSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.43
country_id: 1668284
description:
2025-11-17 12:30:33 dovecot_login authenticator failed for (ADMIN) [36.255.98.43]:51636: 535 Incorrect authentication data (set_id=eduardo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.117
country_id: 1814991
description:
2025-11-17 12:30:46 dovecot_login authenticator failed for ([111.26.106.117]) [111.26.106.117]:38648: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.124.79.130
country_id: 732800
description:
Nov 17 12:30:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<financeiro>, method=PLAIN, rip=188.124.79.130, lip=200.150.196.245, TLS, session=<6UVzB8xDx8K8fE+C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.34.226
country_id: 2017370
description:
2025-11-17 12:31:00 dovecot_login authenticator failed for ([46.149.34.226]) [46.149.34.226]:59494: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 12:31:01 dovecot_login authenticator failed for (User) [177.74.174.120]:57064: 535 Incorrect authentication data (set_id=default@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 12:31:17 dovecot_login authenticator failed for (User) [177.74.174.120]:57064: 535 Incorrect authentication data (set_id=default@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 12:31:18 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:48063: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Vne7CsxDopSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.59.6.81
country_id: 1668284
description:
2025-11-17 12:31:46 dovecot_login authenticator failed for (h81-61-59-6.seed.net.tw) [61.59.6.81]:55653: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-17 12:31:56 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54510: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2025-11-17 12:31:58 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:50805: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-11-17 12:32:01 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:60130: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KpaBDMxD1qOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-17 12:32:16 dovecot_login authenticator failed for ([122.185.152.199]) [182.95.178.158]:57772: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 12:32:22 H=(195.3.134.135) [179.0.178.53]:57221 F=<erictremblaysi@hotmail.com> rejected RCPT <helcio@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57221 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-17 12:32:22 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:35608: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K0lLDsxDMLSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 12:32:42 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57862: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kDThEcxDxNSxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qGhCF8xD5JKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RjFxFcxDIO2xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GmMEGcxDWqSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.60
country_id: 2300660
description:
Nov 17 12:36:20 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=41.139.10.60, lip=200.150.196.245, TLS, session=<1JvWGsxD2uApiwo8>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dXmeHMxD4MSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-11-17 12:37:07 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:37436: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 12:37:16 dovecot_login authenticator failed for (User) [177.74.174.120]:59697: 535 Incorrect authentication data (set_id=default@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-11-17 12:37:20 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:51912: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s9syIMxDWuqxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WPr9IcxD1oyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-17 12:38:27 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:36551: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XYy+I8xDQJqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.27.146
country_id: 2300660
description:
2025-11-17 12:38:52 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:44644: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+w5XJ8xDjL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 12:39:17 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:45881: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-11-17 12:39:31 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:52255: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.205.104
country_id: 2017370
description:
2025-11-17 12:40:17 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:42160: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5IOxLMxD3ICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-17 12:40:48 dovecot_login authenticator failed for ([189.59.210.1]) [186.215.245.175]:47139: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-11-17 12:40:49 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:52707: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.133
country_id: 3996063
description:
2025-11-17 12:40:27 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:50388: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.74.82.7
country_id: 3469034
description:
2025-11-17 12:40:29 H=(localhost) [177.74.82.7]:49408 F=<hello@localhost> rejected RCPT <0B1HiE5MzUtf5HG@seventreinamentos.com.br>: Sender verify failed


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VprrKsxDzOKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.52.153
country_id: 2017370
description:
2025-11-17 12:40:42 dovecot_login authenticator failed for (95.105.52.153.static.str.ufanet.ru) [95.105.52.153]:51480: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-17 12:40:46 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:38942: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-17 12:41:13 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:58232: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.160.52.28
country_id: 2017370
description:
2025-11-17 12:41:27 dovecot_login authenticator failed for (ip28.net52.ivn.ttksever.ru) [46.160.52.28]:57860: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<84p3LsxDAI2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-17 12:41:53 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:43386: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.255.104
country_id: 2017370
description:
2025-11-17 12:42:23 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:56511: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mpYWMsxDvqqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 12:44:11 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58139: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-17 12:43:20 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:50404: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-17 12:44:00 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:51806: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-17 12:44:00 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:37760: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uHVmN8xDXNWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-17 12:44:13 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:43082: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kLigNcxDrsqxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.96.173
country_id: 1880251
description:
[2025-11-17 12:43:38 -0300] info [cpaneld] 146.190.96.173 - mecanicodeelite "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mecanicodeelite (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-17 12:44:22 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:60146: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 181.77.193.245
country_id: 3469034
description:
[2025-11-17 12:45:16 -0300] info [webmaild] 181.77.193.245 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-17 12:44:40 dovecot_login authenticator failed for ([70.91.135.181]) [70.91.135.181]:52677: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.115.177.212
country_id: 6251999
description:
2025-11-17 12:44:49 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:41820: 535 Incorrect authentication data (set_id=noreplay.vendas3@singseguros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.226.196
country_id: 1814991
description:
2025-11-17 12:45:11 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:36384: 535 Incorrect authentication data (set_id=noreplay.vendas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-17 12:44:22 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:59288: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EDYyOcxDFu6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-17 12:44:40 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:64572: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 12:45:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56653: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3L7QPMxDHp6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2025-11-17 12:45:20 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:41916: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4Q8uQsxD4MmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-17 12:47:09 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:42424: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GFJhQMxD6rqxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.146.14
country_id: 1210997
description:
[2025-11-17 12:46:31 -0300] info [cpaneld] 103.55.146.14 - OIxlhfZ8< "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.80.56
country_id: 2017370
description:
2025-11-17 12:48:03 dovecot_login authenticator failed for (adsl-5-141-80-56.salekhard.ru) [5.141.80.56]:35482: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-17 12:47:23 dovecot_login authenticator failed for ([87.200.226.113]) [87.200.226.113]:34857: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZiXxQ8xD4NmxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QA5/R8xDYoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-17 12:49:04 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:43186: 535 Incorrect authentication data (set_id=vendas.pedro@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-17 12:50:10 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:53752: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-17 12:49:27 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:51094: 535 Incorrect authentication data (set_id=vendas.pedro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ci8fS8xDZqCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-17 12:49:40 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:34488: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-11-17 12:50:00 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:42156: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vIreTMxDOLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-11-17 12:50:48 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:40856: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-17 12:50:48 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:42342: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-17 12:51:00 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:60801: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.95.221
country_id: 2017370
description:
2025-11-17 12:51:07 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:57502: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-17 12:50:27 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:33600: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-17 12:50:31 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:45244: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.150.242
country_id: 1814991
description:
2025-11-17 12:51:10 dovecot_login authenticator failed for ([218.1.150.242]) [218.1.150.242]:38020: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-17 12:50:35 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:56168: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-11-17 12:50:17 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:37718: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MkGuTsxD1r6xV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.237.116
country_id: 6252001
description:
[2025-11-17 12:51:29 -0300] info [webmaild] 216.26.237.116 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<o+JAUsxDbumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.57.136.141
country_id: 2017370
description:
2025-11-17 12:51:36 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:49327: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-17 12:51:20 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:58748: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-17 12:52:36 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:36582: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-17 12:53:07 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:56416: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-11-17 12:52:15 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:48986: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f3rRVcxDxpOxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2HygV8xDqKKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-17 12:53:05 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:57904: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-11-17 12:52:27 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:39994: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2025-11-17 12:52:51 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:51474: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.89.135.30
country_id: 2017370
description:
2025-11-17 12:53:24 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:56468: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZxtqWcxD5KyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 12:53:49 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:45329: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-17 12:53:24 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:44270: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-11-17 12:54:34 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:39804: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-17 12:54:53 dovecot_login authenticator failed for ([223.197.153.143]) [223.197.153.143]:50066: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.45.103.11
country_id: 3469034
description:
2025-11-17 12:55:11 dovecot_login authenticator failed for (ADMIN) [187.45.103.11]:61213: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-11-17 12:55:14 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:38754: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.75.92.136
country_id: 1814991
description:
2025-11-17 12:54:29 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:34154: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1I75XMxDAs2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-11-17 12:55:05 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:56206: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.33.115
country_id: 2017370
description:
2025-11-17 12:55:05 dovecot_login authenticator failed for ([95.220.33.115]) [95.220.33.115]:58150: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2025-11-17 12:54:52 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:42234: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.206.7.126
country_id: 1814991
description:
2025-11-17 12:55:01 dovecot_login authenticator failed for ([221.206.7.126]) [221.206.7.126]:42473: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UABTYsxD/omxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<as+TYMxD2uyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.157.254.194
country_id: 2017370
description:
2025-11-17 12:55:43 dovecot_login authenticator failed for ([93.157.254.194]) [93.157.254.194]:45932: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dJ4hZMxDSpixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-17 12:56:39 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:36022: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-11-17 12:56:58 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:56442: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.202.37.119
country_id: 1814991
description:
2025-11-17 12:57:03 dovecot_login authenticator failed for ([27.202.37.119]) [27.202.37.119]:49162: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.171.125
country_id: 1562822
description:
2025-11-17 12:57:10 dovecot_login authenticator failed for ([113.160.171.125]) [113.160.171.125]:56158: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.74.74.44
country_id: 1814991
description:
2025-11-17 12:57:24 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:37770: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.169
country_id: 6252001
description:
2025-11-17 12:57:29 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:46042: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qNuwZ8xDWrixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-17 12:57:44 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:40042: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-11-17 12:57:58 dovecot_login authenticator failed for (18980204017.user.veloxzone.com.br) [189.80.146.46]:58344: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-17 12:58:31 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:53298: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QVJOa8xDzNexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.243.7.4
country_id: 2635167
description:
2025-11-17 12:58:56 dovecot_login authenticator failed for host-89-243-7-4.as13285.net [89.243.7.4]:45480: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zXYObcxDhOKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-11-17 12:58:17 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:51044: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.60.193.98
country_id: 2264397
description:
2025-11-17 12:58:24 dovecot_login authenticator failed for 98.193.60.94.rev.vodafone.pt [94.60.193.98]:40628: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.64.123.166
country_id: 3932488
description:
2025-11-17 12:59:51 dovecot_login authenticator failed for ([181.64.123.166]) [181.64.123.166]:37614: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-17 13:00:04 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:35914: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-11-17 12:59:16 dovecot_login authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:55250: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 12:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IvfhbsxD9IexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.234.4
country_id: 1814991
description:
2025-11-17 12:59:32 dovecot_login authenticator failed for (dns58.online.tj.cn) [218.69.234.4]:17601: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2025-11-17 13:00:22 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:53596: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-11-17 13:00:22 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.64.170]:48662: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2025-11-17 13:00:31 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:63110: 535 Incorrect authentication data (set_id=memaagostinho)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fdVpcsxDsK6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.214.141.53
country_id: 1814991
description:
2025-11-17 13:00:44 dovecot_login authenticator failed for ([27.214.141.53]) [27.214.141.53]:56674: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.91.154
country_id: 3469034
description:
2025-11-17 13:01:01 dovecot_login authenticator failed for ([186.227.91.154]) [186.227.91.154]:50341: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-17 13:01:24 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:52032: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Vqj+dcxD/sOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-17 13:01:37 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:41710: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jmDGd8xD6tWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.136
country_id: 3175395
description:
Nov 17 13:02:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=185.197.8.136, lip=200.150.196.245, TLS, session=<lOAxd8xDo+u5xQiI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2025-11-17 13:02:43 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:50238: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 13:02:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:54884: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.113.109
country_id: 2017370
description:
2025-11-17 13:03:13 dovecot_login authenticator failed for ([95.105.113.109]) [95.105.113.109]:40146: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2025-11-17 13:02:18 dovecot_login authenticator failed for ([61.37.150.6]) [61.37.150.6]:43112: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<96qYecxDWOOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-17 13:03:21 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:33902: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-17 13:03:24 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:42046: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.31
country_id: 1814991
description:
2025-11-17 13:03:40 dovecot_login authenticator failed for ([117.57.205.31]) [117.57.205.31]:48864: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-17 13:04:03 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:52543: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<un8ufcxDkJOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 13:03:47 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:41144: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
country_id: 1835841
description:
2025-11-17 13:03:56 dovecot_login authenticator failed for ([119.220.16.46]) [119.220.16.46]:54275: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-17 13:04:03 dovecot_login authenticator failed for ([220.67.138.254]) [221.145.5.14]:55442: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.107
country_id: 6252001
description:
[2025-11-17 13:04:15 -0300] info [whostmgrd] 124.198.131.107 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2025-11-17 13:05:05 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:36577: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 13:05:10 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:50441: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 13:04:31 H=(195.3.134.135) [179.0.178.53]:52224 F=<erictremblaysi@hotmail.com> rejected RCPT <ricardo@ilumix.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:52224 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lHKEgsxDvL+xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EhW/gMxD3LKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.48.24.152
country_id: 1269750
description:
2025-11-17 13:04:37 dovecot_login authenticator failed for (abts-kk-dynamic-152.24.48.171.airtelbroadband.in) [171.48.24.152]:55498: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
country_id: 1814991
description:
2025-11-17 13:05:12 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:56375: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-11-17 13:04:24 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:34642: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2025-11-17 13:04:29 dovecot_login authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:39164: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-17 13:05:47 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:55910: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.196
country_id: 2186224
description:
2025-11-17 13:05:18 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:39722: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MbdShMxD3suxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B0Tkh8xD/uuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-17 13:06:49 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:52462: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2025-11-17 13:06:58 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:44885: 535 Incorrect authentication data (set_id=maia)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Uo97i8xDIp6xV3kv>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 139.59.57.131
country_id: 1269750
description:
Nov 17 13:07:51 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<F7U9jcxD9KqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-17 13:08:05 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:4541: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.226.80.143
country_id: 6252001
description:
2025-11-17 13:08:18 dovecot_login authenticator failed for dhcp-011-143.coonvalley.mwt.net [216.226.80.143]:55312: 535 Incorrect authentication data


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 139.59.57.131
country_id: 1269750
description:
Nov 17 13:08:22 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-17 13:08:38 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:31634: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 139.59.57.131
country_id: 1269750
description:
Nov 17 13:08:39 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 139.59.57.131
country_id: 1269750
description:
Nov 17 13:08:16 hosting pure-ftpd: (?@139.59.57.131) [WARNING] Authentication failed for user [louvoreterno]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-17 13:08:23 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:35622: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-11-17 13:08:26 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:57008: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kBIPj8xDHLmxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ta2aksxDCNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-17 13:10:42 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:46530: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-17 13:10:55 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:60665: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qXb4l8xDYJCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.181.191.152
country_id: 2017370
description:
2025-11-17 13:11:16 dovecot_login authenticator failed for (94x181x191x152.static-business.penza.ertelecom.ru) [94.181.191.152]:44778: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<u0c6lsxDGISxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nNbImcxDVqOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.121
country_id: 2963597
description:
Nov 17 13:11:51 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=37.203.49.121, lip=200.150.196.245, TLS, session=<47DcmcxDmYAlyzF5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-17 13:11:20 dovecot_login authenticator failed for ([121.202.146.144]) [121.202.146.144]:59124: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.159
country_id: 798544
description:
Nov 17 13:11:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=178.216.29.159, lip=200.150.196.245, TLS, session=<djO2mMxD1KSy2B2f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-11-17 13:12:59 dovecot_login authenticator failed for ([196.190.43.138]) [196.190.41.137]:31195: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-11-17 13:13:09 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:56114: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.194.76.194
country_id: 2017370
description:
2025-11-17 13:13:10 dovecot_login authenticator failed for ([176.194.76.194]) [176.194.76.194]:58096: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.7
country_id: 1668284
description:
2025-11-17 13:13:14 dovecot_login authenticator failed for 111-70-32-7.emome-ip.hinet.net [111.70.32.7]:57413: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-17 13:12:20 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:54504: 535 Incorrect authentication data (set_id=jose.comercial@sulindustrial.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3o5TncxD2rqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.34.2.179
country_id: 2017370
description:
2025-11-17 13:12:40 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:53217: 535 Incorrect authentication data (set_id=jose.comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-17 13:13:31 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:37495: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7hryoMxDdNmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2025-11-17 13:13:37 dovecot_login authenticator failed for ([113.108.88.121]) [113.108.88.121]:57666: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6ka1osxDbuaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.61.176.53
country_id: 2017370
description:
2025-11-17 13:14:05 dovecot_login authenticator failed for (37.61.176.53.svttk.ru) [37.61.176.53]:53350: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.20.87.113
country_id: 1814991
description:
2025-11-17 13:13:28 dovecot_login authenticator failed for ([58.20.76.243]) [58.20.87.113]:48439: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.53
country_id: 798544
description:
Nov 17 13:14:19 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=128.127.94.53, lip=200.150.196.245, TLS, session=<vBuwosxDzaCAf141>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-17 13:14:32 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:52316: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nfyEpMxD+oixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
country_id: 1835841
description:
2025-11-17 13:14:42 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:49553: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-11-17 13:14:51 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:11406: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.58.188.226
country_id: 2510769
description:
2025-11-17 13:15:07 dovecot_login authenticator failed for 226.red-83-58-188.dynamicip.rima-tde.net [83.58.188.226]:44202: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<F2YZqMxD2KexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 13:15:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63047: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 167.250.152.145
country_id: 3469034
description:
[2025-11-17 13:16:20 -0300] info [webmaild] 167.250.152.145 - vendas@brinquelocacoes.com "GET /cpsess9119813859/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WoOrq8xDoMCxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.54.66
country_id: 1643084
description:
[2025-11-17 13:16:40 -0300] info [cpaneld] 157.66.54.66 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lnZwrcxD2tSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.85.222.240
country_id: 6252001
description:
2025-11-17 13:17:32 dovecot_login authenticator failed for 64.85.222.240.reverse.socket.net [64.85.222.240]:36446: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Y7JBr8xDDuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.56.60.121
country_id: 298795
description:
2025-11-17 13:17:49 dovecot_login authenticator failed for ([31.56.60.121]) [31.56.60.121]:43130: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WP/QssxDhJWxV3kv>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.149.83
country_id: 6252001
description:
Nov 17 13:18:38 hosting sshd[540]: Did not receive identification string from 162.216.149.83 port 61648


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-17 13:19:21 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:41134: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-17 13:19:31 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:34679: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 222.59.173.105
country_id: 1814991
description:
2025-11-17 13:19:40 H=(200.150.196.245) [222.59.173.105]:19368 F=<mxirrrvzvshxvb@yahoo.co.jp> rejected RCPT <drovosek@ufamts.ru>: "JunkMail rejected - (200.150.196.245) [222.59.173.105]:19368 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/222.59.173.105"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-11-17 13:19:50 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:41101: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2025-11-17 13:20:08 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:59938: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CJJktsxDarWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-11-17 13:19:52 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:34354: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:20:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7fkyuMxD+MexV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Enz0ucxDsNWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-17 13:20:33 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:54800: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 13:21:07 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:65047: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-17 13:20:19 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:50374: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-17 13:20:20 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:37692: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-17 13:20:26 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:35033: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.52
country_id: 99237
description:
2025-11-17 13:20:35 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:44170: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-11-17 13:21:01 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:46736: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.190.16
country_id: 1814991
description:
2025-11-17 13:21:23 dovecot_login authenticator failed for (16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:54234: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PR2GvcxDIJexV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 13:21:40 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:21:45 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:60604: 535 Incorrect authentication data (set_id=contabilidade@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.196.95.34
country_id: 3017382
description:
Nov 17 13:22:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<comercial@inovasite.com>, method=PLAIN, rip=5.196.95.34, lip=200.150.196.245, TLS: Connection closed, session=<MuhUvsxD3K0FxF8i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-11-17 13:22:31 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:38641: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-17 13:22:48 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:39828: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<85/pwsxDlsexV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 201.24.236.41
country_id: 3469034
description:
[2025-11-17 13:23:11 -0300] info [webmaild] 201.24.236.41 - vendas@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.197.178.198
country_id: 1835841
description:
2025-11-17 13:22:19 dovecot_login authenticator failed for ([119.197.178.198]) [119.197.178.198]:45347: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-17 13:22:29 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:37158: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SgIXwcxDFLqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wP21xMxDbtexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 13:23:54 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:65151: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9/dIyMxD3o+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:24:43 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:49624: 535 Incorrect authentication data (set_id=contabilidade@transol.com.br)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Nov 17 13:25:18 hosting.inovasite.com.br cpanel_fileman_hook[10146]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user fourpsco


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uQmdzcxDLrqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-17 13:26:08 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11980: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.246
country_id: 1835841
description:
2025-11-17 13:26:10 dovecot_login authenticator failed for ([221.149.233.246]) [221.149.233.246]:56959: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6xTay8xDKK+xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</wVnz8xDvM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-11-17 13:26:35 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:49801: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.62.41
country_id: 1814991
description:
2025-11-17 13:26:40 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:41530: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-11-17 13:26:43 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:60680: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 13:26:59 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:38982: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2025-11-17 13:27:35 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:59451: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.226.196
country_id: 1814991
description:
2025-11-17 13:27:36 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:55674: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.21.18
country_id: 3469034
description:
2025-11-17 13:27:44 dovecot_login authenticator failed for (187.95.21.18.netjacarei.NipCable.com) [187.95.21.18]:48316: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.204
country_id: 1835841
description:
2025-11-17 13:27:52 dovecot_login authenticator failed for ([211.198.128.204]) [211.198.128.204]:49056: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-17 13:27:15 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:40128: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-17 13:27:31 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:60978: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 170.254.126.16
country_id: 3469034
description:
[2025-11-17 13:27:33 -0300] info [webmaild] 170.254.126.16 - design@ferramentasfranca.com.br "GET /cpsess2511887540/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SOb+0sxDUoWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.40.20.158
country_id: 3175395
description:
2025-11-17 13:27:50 dovecot_login authenticator failed for (adsl-ull-158-20.40-151.wind.it) [151.40.20.158]:32816: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2025-11-17 13:28:02 dovecot_login authenticator failed for 111-70-51-5.emome-ip.hinet.net [111.70.51.5]:55683: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 13:28:50 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.83
country_id: 3469034
description:
Nov 17 13:28:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=187.120.73.83, lip=200.150.196.245, TLS, session=</JEi18xDdOa7eElT>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hglc2MxD6LOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-17 13:28:17 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:45308: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.105
country_id: 1814991
description:
2025-11-17 13:28:19 dovecot_login authenticator failed for ([27.24.141.105]) [27.24.141.105]:52316: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Yy6N1sxDnKWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.218.36.28
country_id: 2661886
description:
2025-11-17 13:29:59 dovecot_login authenticator failed for c77-218-36-28.bredband.tele2.se [77.218.36.28]:56640: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.191.82
country_id: 1814991
description:
2025-11-17 13:29:24 dovecot_login authenticator failed for ([113.108.191.82]) [113.108.191.82]:37840: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 13:29:43 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:46494: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 167.250.152.145
country_id: 3469034
description:
[2025-11-17 13:29:33 -0300] info [webmaild] 167.250.152.145 - vendas@brinquelocacoes.com "GET /cpsess0017617181/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-11-17 13:29:53 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:32918: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-11-17 13:30:14 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:56495: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 13:29:22 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eTQs2sxDJsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-17 13:30:37 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:62124: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.217.177
country_id: 289688
description:
2025-11-17 13:30:38 dovecot_login authenticator failed for ([78.101.217.177]) [78.101.217.177]:55348: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-11-17 13:30:52 dovecot_login authenticator failed for ([181.93.60.253]) [181.93.60.253]:58145: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.43.156
country_id: 732800
description:
2025-11-17 13:31:03 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:58092: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-17 13:30:16 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:34324: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-17 13:30:25 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:41147: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qrK+3cxDcuqxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 13:31:19 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "POST /cpsess9230285596/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KmBU4cxDrJixV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tskV48xD9q6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-17 13:32:08 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:48418: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-11-17 13:32:13 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:58074: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:32:22 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:49581: 535 Incorrect authentication data (set_id=contato@administrarmais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.254
country_id: 1814991
description:
2025-11-17 13:32:37 dovecot_login authenticator failed for ([219.128.55.254]) [219.128.55.254]:37600: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.232.239.231
country_id: 1562822
description:
2025-11-17 13:32:54 dovecot_login authenticator failed for (static.vnpt.vn) [14.232.239.231]:56738: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-17 13:33:05 dovecot_login authenticator failed for ([122.185.152.199]) [182.95.178.158]:43372: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-11-17 13:33:13 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:49550: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.96.232
country_id: 294640
description:
2025-11-17 13:33:14 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:51973: 535 Incorrect authentication data (set_id=vendas.dilson@maringasoldas.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 13:32:20 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "POST /cpsess9230285596/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.74.67
country_id: 1835841
description:
2025-11-17 13:32:24 dovecot_login authenticator failed for ([121.147.74.67]) [121.147.74.67]:51498: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.85
country_id: 1814991
description:
2025-11-17 13:32:30 dovecot_login authenticator failed for ([36.135.62.84]) [36.135.62.85]:39666: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<D7jZ5MxDzsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-11-17 13:32:32 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:44302: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-17 13:33:18 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:51034: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<P5126MxDUOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-11-17 13:33:36 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:43595: 535 Incorrect authentication data (set_id=vendas.dilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 13:33:42 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:34959: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.63.18
country_id: 1814991
description:
2025-11-17 13:34:00 dovecot_login authenticator failed for ([114.98.63.18]) [114.98.63.18]:58604: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-17 13:34:38 dovecot_login authenticator failed for ([125.22.221.129]) [125.17.28.138]:53850: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-17 13:34:49 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:40233: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-17 13:34:56 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:49058: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:34:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8TEP7MxDRJSxV3kv>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.149.79
country_id: 6252001
description:
Nov 17 13:34:32 hosting sshd[27320]: Did not receive identification string from 162.216.149.79 port 64126


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YJ7T7cxDZKaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-17 13:34:20 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46983: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 13:34:25 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50978: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2025-11-17 13:34:27 dovecot_login authenticator failed for broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:33456: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9xWU78xDNrSxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FHI088xDwNOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-17 13:37:01 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:46990: 535 Incorrect authentication data (set_id=mauricio@mag.adv.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-17 13:37:12 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:35602: 535 Incorrect authentication data (set_id=mauricio)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Xu+I+MxDbpOxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<z1XI9sxD+IexV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0WVW+sxDfKGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 13:39:50 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:52876: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+p7s/cxDIsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-11-17 13:39:38 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:55227: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HHRFA81DuIOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2025-11-17 13:41:06 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:51121: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.87.9
country_id: 1814991
description:
2025-11-17 13:40:28 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:33752: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H/V2Ac1DjOWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.223
country_id: 1668284
description:
2025-11-17 13:40:34 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:39858: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NdIVBc1DwpexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-17 13:42:04 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:53629: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.111.3.59
country_id: 2017370
description:
2025-11-17 13:42:08 dovecot_login authenticator failed for ([193.111.3.59]) [193.111.3.59]:56232: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:41:31 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54233: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-17 13:41:33 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:52864: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-11-17 13:41:44 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:55168: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-17 13:41:52 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:59951: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-11-17 13:42:26 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:50946: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-11-17 13:42:40 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:50762: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-17 13:42:49 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:52458: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-11-17 13:42:56 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.64.170]:36672: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-17 13:42:20 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:39730: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-17 13:42:37 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:56759: 535 Incorrect authentication data (set_id=vendas.pedro@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-11-17 13:43:12 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:48021: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.128.210
country_id: 1814991
description:
2025-11-17 13:42:22 dovecot_login authenticator failed for ([221.235.182.76]) [61.184.128.210]:44056: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2025-11-17 13:42:31 dovecot_login authenticator failed for (170-83-41-60.swtelecom.com.br) [170.83.41.60]:60557: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2025-11-17 13:42:40 dovecot_login authenticator failed for ([123.163.52.74]) [123.163.52.74]:48254: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-17 13:42:54 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:53412: 535 Incorrect authentication data (set_id=vendas.pedro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:43:01 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54720: 535 Incorrect authentication data (set_id=contato@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-17 13:42:25 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:51305: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MfCnCM1DArexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.62.41
country_id: 1814991
description:
2025-11-17 13:42:45 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:43442: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-17 13:43:00 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:49041: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.200.173
country_id: 6252001
description:
2025-11-17 13:44:09 dovecot_plain authenticator failed for ([2.58.200.173]) [2.58.200.173]:51864: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PLY4DM1DJNexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.143
country_id: 2186224
description:
2025-11-17 13:43:51 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:59246: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-17 13:44:06 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:46318: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-11-17 13:44:14 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:57324: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-11-17 13:44:16 dovecot_login authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:51165: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
country_id: 1814991
description:
2025-11-17 13:43:17 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:33630: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-17 13:43:34 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:60080: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Opn+Dc1D0uKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-17 13:45:01 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:35264: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.1.71
country_id: 1814991
description:
2025-11-17 13:45:08 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:41493: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.131.79
country_id: 1814991
description:
2025-11-17 13:44:50 dovecot_login authenticator failed for ([111.53.131.79]) [111.53.131.79]:54134: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-11-17 13:44:40 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:51004: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-17 13:44:49 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:49642: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
country_id: 1814991
description:
2025-11-17 13:44:53 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:45466: 535 Incorrect authentication data (set_id=mecati)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.77.157
country_id: 1814991
description:
2025-11-17 13:44:57 dovecot_login authenticator failed for ([223.210.0.110]) [111.48.77.157]:22489: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-17 13:44:58 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:45262: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2025-11-17 13:45:09 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:57720: 535 Incorrect authentication data (set_id=design)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-17 13:45:14 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:54870: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yJLFD81D/omxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2025-11-17 13:45:29 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:41212: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JLhlE81DZKWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.92.116.88
country_id: 1814991
description:
2025-11-17 13:45:45 dovecot_login authenticator failed for ([113.57.108.79]) [183.92.116.88]:3705: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.249.175.243
country_id: 298795
description:
2025-11-17 13:46:04 dovecot_login authenticator failed for ([185.250.240.220]) [88.249.175.243]:58091: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-11-17 13:46:22 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:42678: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:46:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eaL5Fs1DjsexV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EKm5GM1DsNmxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3LCKGs1DnoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:47:34 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:63335: 535 Incorrect authentication data (set_id=contato@compensadosparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-11-17 13:47:41 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:35628: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 13:47:48 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53953: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-17 13:48:10 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:46312: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2025-11-17 13:48:15 dovecot_login authenticator failed for ([218.13.214.18]) [218.13.214.18]:39982: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2025-11-17 13:49:07 dovecot_login authenticator failed for ([59.16.192.32]) [59.16.192.32]:34898: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vWYeHs1DLrCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 13:49:03 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:61175: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.57.136.141
country_id: 2017370
description:
2025-11-17 13:49:07 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:35828: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-17 13:49:12 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:36384: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.51.50
country_id: 953987
description:
2025-11-17 13:48:38 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:55964: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-11-17 13:48:57 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:57055: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-17 13:49:43 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:52366: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fxZ7I81DwOmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2025-11-17 13:49:21 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:51005: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-11-17 13:49:25 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:43268: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YcepIc1DkNGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-17 13:49:32 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:56113: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.144
country_id: 1835841
description:
2025-11-17 13:50:48 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:34084: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 13:50:28 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:61588: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zYQ+Jc1DoI6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-17 13:50:32 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:48422: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2025-11-17 13:51:53 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:39346: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:52:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DaqYKs1DeMixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-17 13:51:39 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:53828: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.127
country_id: 3508796
description:
2025-11-17 13:51:45 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:60136: 535 Incorrect authentication data (set_id=mailer-daemon@hosting.inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-17 13:51:55 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:40230: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.197.206.134
country_id: 1269750
description:
2025-11-17 13:51:20 dovecot_login authenticator failed for ([203.147.89.38]) [117.197.206.134]:50700: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0SllLM1D0N6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
country_id: 1814991
description:
2025-11-17 13:53:09 dovecot_login authenticator failed for ([61.185.30.170]) [61.185.30.170]:45919: 535 Incorrect authentication data (set_id=bianca.user.admin@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 13:52:23 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:51678: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.171
country_id: 1814991
description:
2025-11-17 13:52:26 dovecot_login authenticator failed for ([111.57.17.171]) [111.57.17.171]:46562: 535 Incorrect authentication data (set_id=mailer-daemon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-17 13:53:30 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:52309: 535 Incorrect authentication data (set_id=bianca.user.admin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dTQCMM1DNJixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 13:53:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<VQW/MM1DKq6Gx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.39.180
country_id: 2017370
description:
2025-11-17 13:55:06 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:36737: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-11-17 13:55:15 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:58002: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-11-17 13:54:24 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:35948: 535 Incorrect authentication data (set_id=paulo.user.admin@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 13:54:29 dovecot_login authenticator failed for (fernandabrumoficial.com) [111.122.211.212]:28658: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3DmIM81DzMKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2025-11-17 13:54:58 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:50308: 535 Incorrect authentication data (set_id=paulo.user.admin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</bEhN81DbO2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-11-17 13:55:37 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:54805: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.66.120.237
country_id: 6252001
description:
2025-11-17 13:55:37 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:50572: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 13:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<5SqIOM1DFsUXXz9j>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sG7xOM1DGI+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.128.225
country_id: 2017370
description:
2025-11-17 13:56:07 dovecot_login authenticator failed for (ip-178-46-128-225.dsl.surnet.ru) [178.46.128.225]:44363: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-11-17 13:56:15 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:46075: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2025-11-17 13:56:47 dovecot_login authenticator failed for ([111.26.62.46]) [111.26.62.46]:49904: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-17 13:57:00 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:22724: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-17 13:57:11 dovecot_login authenticator failed for ([178.232.65.99]) [178.232.65.99]:41353: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-11-17 13:56:25 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:51839: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-17 13:56:25 dovecot_login authenticator failed for ([111.26.67.36]) [111.26.67.36]:36866: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 13:56:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<8/VTOs1DioFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-17 13:56:35 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:38370: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1pOyOs1DFp+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-11-17 13:56:52 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:46006: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 13:57:07 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:46584: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-17 13:56:26 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:60828: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2025-11-17 13:56:27 dovecot_login authenticator failed for ([111.26.63.82]) [111.26.63.83]:54188: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-17 13:57:53 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:37066: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-17 13:57:28 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:50938: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-17 13:57:43 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:58000: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 13:57:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<zaSjPc1DqpmvfiX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BHhPPs1DYsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-17 13:58:04 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:42211: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 13:58:07 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:58785: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.78
country_id: 2328926
description:
2025-11-17 13:57:20 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:9602: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.252
country_id: 1814991
description:
2025-11-17 13:57:24 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:34422: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 13:58:19 dovecot_login authenticator failed for (User) [177.74.174.120]:62560: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GHPeQc1DmuaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-17 13:58:33 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:48602: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.236
country_id: 1733045
description:
2025-11-17 13:59:05 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:43382: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-17 13:59:18 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:49114: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 13:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QB9pRc1DSqGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-17 13:59:42 dovecot_login authenticator failed for ([187.51.252.236]) [186.201.54.90]:48581: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 14:00:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<WikDR81DUHpo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1/84R81DIrOxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.82.65.48
country_id: 2077456
description:
[2025-11-17 14:00:47 -0300] info [cpaneld] 103.82.65.48 - 1075fm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-11-17 14:00:52 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:51819: 535 Incorrect authentication data (set_id=comercial.user.admin@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-17 14:01:03 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:36694: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-17 14:01:14 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:42296: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-11-17 14:01:16 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:57392: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QNUHSc1DgsuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 14:00:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<UplgSc1DPsvSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 14:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<dgH2S81DBsFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 14:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<Fgj+S81DqqWdQi/y>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.107
country_id: 6252001
description:
[2025-11-17 14:01:51 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-17 14:01:21 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:57924: 535 Incorrect authentication data (set_id=comercial.user.admin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NiWcTM1DhICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-17 14:02:09 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:44668: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 14:02:16 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:57975: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-11-17 14:01:32 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:57712: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c838a0), "3rdparty/roundcube/", "jupiter") called at cpsrvd.pl line 5127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-11-17 14:02:23 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:32924: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rVMkUM1DUKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-11-17 14:02:31 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:56226: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BLPyUc1D4LuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2025-11-17 14:02:19 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:36640: 535 Incorrect authentication data (set_id=sociais)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2025-11-17 14:02:28 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:26098: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 14:02:22 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:53458: 535 Incorrect authentication data (set_id=contato@fottolegal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-17 14:02:39 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:61268: 535 Incorrect authentication data (set_id=jotadeschamps)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.140.240.184
country_id: 3469034
description:
[2025-11-17 14:02:55 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "GET /cpsess8984365187/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.140.240.184
country_id: 3469034
description:
[2025-11-17 14:02:59 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.68.199
country_id: 1835841
description:
2025-11-17 14:02:22 dovecot_login authenticator failed for ([183.98.68.199]) [183.98.68.199]:42343: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-11-17 14:02:37 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:32850: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 14:03:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<FCMoVM1DyKul0iHB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.140.240.184
country_id: 3469034
description:
[2025-11-17 14:03:26 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LdnBU81D7tGxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.140.240.184
country_id: 3469034
description:
[2025-11-17 14:03:36 -0300] info [webmaild] 200.140.240.184 - xavier@projetocircense.com.br "GET /cpsess8984365187/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-11-17 14:05:05 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:42385: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-11-17 14:05:13 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:47186: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 14:04:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51049: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5UFLV81DpIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.131.125
country_id: 2017370
description:
2025-11-17 14:04:50 dovecot_login authenticator failed for broadband-95-84-131-125.ip.moscow.rt.ru [95.84.131.125]:58670: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 14:04:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<hlA9WM1DyqvSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-17 14:06:04 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:48834: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-17 14:05:23 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:57567: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sdHmWs1DBKyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.191.196.220
country_id: 2017370
description:
2025-11-17 14:05:55 dovecot_login authenticator failed for ([95.191.196.220]) [95.191.196.220]:48801: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-17 14:05:46 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:59424: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HT+oXM1D1sOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2025-11-17 14:06:06 dovecot_login authenticator failed for ([111.61.97.5]) [111.61.97.5]:58892: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.158.244
country_id: 1835841
description:
2025-11-17 14:06:08 dovecot_login authenticator failed for ([183.99.158.244]) [183.99.158.244]:52046: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.133
country_id: 3996063
description:
2025-11-17 14:05:31 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:52627: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-17 14:05:34 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:41248: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 14:05:41 H=(195.3.134.135) [179.0.178.53]:53331 F=<erictremblaysi@hotmail.com> rejected RCPT <tatiane.queiroz@kglsolucoes.com>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:53331 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-17 14:06:31 dovecot_login authenticator failed for (177-174-15-69.user.vivozap.com.br) [177.174.15.69]:43474: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-11-17 14:06:36 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:59072: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.186.93
country_id: 1562822
description:
2025-11-17 14:06:55 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.186.93]:38108: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2025-11-17 14:06:18 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:36088: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-17 14:06:23 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:45481: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-17 14:06:24 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:59854: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nrZ7Xs1DftSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-17 14:06:45 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:54026: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-11-17 14:06:47 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:37172: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 14:06:57 dovecot_login authenticator failed for (bethelpainting.com) [112.122.54.54]:19820: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-17 14:07:01 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:41284: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 14:07:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<z02IYM1DCJokMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Rx4HYs1DgJCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.111.3.59
country_id: 2017370
description:
2025-11-17 14:07:54 dovecot_login authenticator failed for (noname.vdonsk.ru) [193.111.3.59]:43368: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2025-11-17 14:07:55 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:38363: 535 Incorrect authentication data (set_id=lu@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-17 14:08:05 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:36828: 535 Incorrect authentication data (set_id=lu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-11-17 14:08:14 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:53503: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2025-11-17 14:07:15 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:52776: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 14:07:22 dovecot_login authenticator failed for (bethelpainting.com) [112.122.54.54]:46308: 535 Incorrect authentication data (set_id=postmaster@bethelpainting.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.53.245.92
country_id: 2017370
description:
2025-11-17 14:09:11 dovecot_login authenticator failed for ([95.53.245.92]) [95.53.245.92]:46838: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-17 14:09:15 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39023: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:08:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FJCmZc1DgrOxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ca5oZ81DwsOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.59.238
country_id: 2017370
description:
2025-11-17 14:09:05 dovecot_login authenticator failed for (5.189.59.238-FTTB.planeta.tc) [5.189.59.238]:57736: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-17 14:09:02 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:38252: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-17 14:09:22 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:59632: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 14:09:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9ieraM1DSMNn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ITw3ac1D0NGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.21.240
country_id: 1562822
description:
2025-11-17 14:09:37 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:36629: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 14:09:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<35RHas1DFtBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.85
country_id: 1668284
description:
2025-11-17 14:09:56 dovecot_login authenticator failed for 116-59-11-85.emome-ip.hinet.net [116.59.11.85]:52101: 535 Incorrect authentication data (set_id=noreplay.vendas3@singseguros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.162
country_id: 2635167
description:
Nov 17 14:09:28 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.162, lip=200.150.196.245, TLS, session=<IJDtaM1DPcNX7LCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 14:10:10 dovecot_plain authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54403: 535 Incorrect authentication data (set_id=contato@innovationbanking.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-17 14:11:05 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:55722: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 14:11:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<ijcib81DNs0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.191.243.91
country_id: 1814991
description:
2025-11-17 14:10:18 dovecot_login authenticator failed for ([222.191.243.91]) [222.191.243.91]:59715: 535 Incorrect authentication data (set_id=noreplay.vendas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-11-17 14:10:18 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:49985: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-11-17 14:10:48 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:38632: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r4THbM1DUIaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.133.140
country_id: 1562822
description:
2025-11-17 14:10:34 dovecot_login authenticator failed for ([118.69.133.140]) [118.69.133.140]:61488: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-17 14:11:13 dovecot_login authenticator failed for ([177.215.153.215]) [189.56.0.19]:59157: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.219.123.97
country_id: 3469034
description:
2025-11-17 14:10:16 dovecot_login authenticator failed for 200-219-123-97.user3p.v-tal.net.br ([192.168.56.1]) [200.219.123.97]:54403: 535 Incorrect authentication data (set_id=contato@innovationbanking.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-11-17 14:10:57 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:1825: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-11-17 14:11:05 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:59260: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.67.122.230
country_id: 1835841
description:
2025-11-17 14:11:15 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:39907: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NE5gcM1DSNyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-17 14:11:56 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:57722: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wSgecs1DJOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2025-11-17 14:12:15 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:48951: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-17 14:11:19 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:32983: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 14:11:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<iOKob81DrNid5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-17 14:11:29 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:36806: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.212.222
country_id: 6252001
description:
2025-11-17 14:11:37 dovecot_login authenticator failed for ([75.109.212.222]) [75.109.212.222]:56497: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-17 14:11:44 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:53886: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2025-11-17 14:12:58 dovecot_login authenticator failed for ([218.25.233.2]) [218.25.233.22]:55752: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 14:13:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<j7V/dc1DZv+vfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-17 14:13:13 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:59758: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-17 14:12:30 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:50619: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2025-11-17 14:12:43 dovecot_login authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:37796: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-17 14:12:50 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:34032: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2025-11-17 14:13:02 dovecot_login authenticator failed for 188-197-29-85.dyn.estpak.ee [85.29.197.188]:49316: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<P2vsc81DlouxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.200.173
country_id: 6252001
description:
2025-11-17 14:13:39 dovecot_plain authenticator failed for ([2.58.200.173]) [2.58.200.173]:57372: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-17 14:13:45 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:41486: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2025-11-17 14:13:47 dovecot_login authenticator failed for ([36.135.107.56]) [36.135.107.57]:40508: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 14:13:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<Y4FAeM1D7NZ9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.96
country_id: 1814991
description:
2025-11-17 14:13:30 dovecot_login authenticator failed for ([222.71.159.58]) [222.68.153.96]:53446: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2px9d81Dpq6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-17 14:13:34 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:32873: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 14:14:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<XiQyec1DQIVSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
country_id: 2017370
description:
2025-11-17 14:14:08 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:34262: 535 Incorrect authentication data (set_id=andre.nascimento.admin@calcautomacao.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OowTe81DTNOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 14:14:37 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:60978: 535 Incorrect authentication data (set_id=info.user.admin@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 14:14:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<lNF/e81D2sZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-17 14:14:53 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:33852: 535 Incorrect authentication data (set_id=andre.nascimento.admin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vJLYfM1DIuGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-17 14:15:05 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:45004: 535 Incorrect authentication data (set_id=info.user.admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 14:15:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<TR5Jfc1DcIdxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8TGqfs1DmoaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 14:15:47 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:54230: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 14:16:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<PXS1gc1D7L+Gx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JEU2gs1D6KixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-11-17 14:17:02 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:46441: 535 Incorrect authentication data (set_id=vendas.dilson@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.222.149
country_id: 2661886
description:
2025-11-17 14:17:35 dovecot_login authenticator failed for h95-155-222-149.cust.bredband2.com [95.155.222.149]:41839: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-11-17 14:17:45 dovecot_login authenticator failed for ([116.114.84.246]) [116.114.84.246]:41352: 535 Incorrect authentication data (set_id=leandro.cesar@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 14:18:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<X6pTh81DNu5xoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
country_id: 1835841
description:
2025-11-17 14:18:01 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:46156: 535 Incorrect authentication data (set_id=leandro.cesar)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HLeVh81DNtuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-17 14:18:11 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:60826: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-11-17 14:17:22 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:60953: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 124.67.121.58
country_id: 1814991
description:
Nov 17 14:17:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=124.67.121.58, lip=200.150.196.245, TLS, session=<9fmGhM1Dwux8Q3k6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-17 14:17:43 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:49767: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.79.144.75
country_id: 2017370
description:
2025-11-17 14:17:21 dovecot_login authenticator failed for (pool-5-79-144-75.is74.ru) [5.79.144.75]:58192: 535 Incorrect authentication data (set_id=vendas.dilson)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rjXOhc1D0MyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 14:19:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<7LWEi81DxrF9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2025-11-17 14:19:16 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:44669: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-17 14:18:23 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:49894: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jDZpic1DAIaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.132.212
country_id: 357994
description:
2025-11-17 14:18:35 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.132.212]:47292: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 14:18:57 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59511: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-17 14:19:00 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:38079: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-17 14:19:19 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:60782: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 14:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<jzs0jM1DBNBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 14:19:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<FVBJjc1D9HenYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2025-11-17 14:19:45 dovecot_login authenticator failed for ([193.228.164.236]) [193.228.164.236]:52156: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.25.127.206
country_id: 2017370
description:
2025-11-17 14:19:18 dovecot_login authenticator failed for ([78.25.127.206]) [78.25.127.206]:48722: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 14:19:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<8ka1jM1DqpKl0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hnL8jM1DAquxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.193.187
country_id: 1814991
description:
2025-11-17 14:19:35 dovecot_login authenticator failed for ([59.46.193.187]) [59.46.193.187]:39747: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CL2NkM1D8M6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2025-11-17 14:20:34 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:41718: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:20:50 dovecot_login authenticator failed for (liIKnuLet) [141.98.11.48]:58577: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.240
country_id: 1814991
description:
2025-11-17 14:20:50 dovecot_login authenticator failed for ([111.26.167.240]) [111.26.167.240]:41346: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Zh1Tks1Dku2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 14:22:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<9IuAls1DnIFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 14:21:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<uwphk81DLswXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.103.168.32
country_id: 1814991
description:
Nov 17 14:22:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<shuf@brinquelocacoes.com.br>, method=PLAIN, rip=14.103.168.32, lip=200.150.196.245, session=<Sx6Jls1DEMsOZ6gg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:21:21 dovecot_login authenticator failed for (fz2NrvVbZr) [141.98.11.48]:53202: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PS8glM1DtpKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.147.32
country_id: 2017370
description:
2025-11-17 14:22:25 dovecot_login authenticator failed for ([78.111.147.32]) [78.111.147.32]:60554: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-17 14:22:28 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:55134: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-17 14:22:28 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:50732: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.51.202
country_id: 3017382
description:
2025-11-17 14:23:00 dovecot_login authenticator failed for ([188.231.51.202]) [188.231.51.202]:60341: 535 Incorrect authentication data (set_id=pharmacyusa-bestdeals)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-17 14:22:17 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:52815: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:22:22 dovecot_login authenticator failed for (4ARngn) [141.98.11.48]:54258: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MK6ul81DaLaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.140.230
country_id: 1814991
description:
2025-11-17 14:22:41 dovecot_login authenticator failed for ([218.56.121.58]) [221.2.140.230]:38934: 535 Incorrect authentication data (set_id=pharmacyusa-bestdeals@inovasiteweb.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-17 14:23:54 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:52169: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 14:24:09 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:46048: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-17 14:24:09 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:59680: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lmBAm81DmNKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 14:23:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<DyYsnM1DoKhns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-17 14:23:54 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:53030: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JzgJnc1DDOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 14:23:40 dovecot_login authenticator failed for (User) [177.74.174.120]:61589: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:23:51 dovecot_login authenticator failed for (DNdJSS) [141.98.11.48]:61824: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E3DXns1DRoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:24:34 dovecot_login authenticator failed for (4r9Y71) [141.98.11.48]:61617: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.214.202.161
country_id: 1210997
description:
2025-11-17 14:24:51 dovecot_login authenticator failed for ([103.174.193.42]) [103.214.202.161]:47940: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:25:35 dovecot_login authenticator failed for (gLXuVC6) [141.98.11.48]:56590: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:25:44 dovecot_login authenticator failed for (WnEd9Tqrg) [141.98.11.48]:56646: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-17 14:25:55 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:28837: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.83.90
country_id: 1814991
description:
2025-11-17 14:26:10 dovecot_login authenticator failed for ([116.233.83.90]) [116.233.83.90]:35582: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.97
country_id: 1814991
description:
2025-11-17 14:25:18 dovecot_login authenticator failed for ([36.135.62.96]) [36.135.62.97]:45788: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WRpmos1DfqqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 14:25:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<Bs1zos1DpIcnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-17 14:26:56 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:31291: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QMTCp81D7NyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:26:28 dovecot_login authenticator failed for (Ujg6a5E) [141.98.11.48]:50071: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 14:26:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<+YnMpc1Dhqc7GIXF>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4ZsDps1D3suxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 14:26:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<qCl1ps1DxqKl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-17 14:27:19 dovecot_login authenticator failed for (yeSXtGDy3) [141.98.11.48]:54011: 535 Incorrect authentication data (set_id=contabilidade)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<phiUqc1DQOyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 14:27:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<neBKqs1Dfp0naoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-17 14:27:46 dovecot_login authenticator failed for (calcautomation.com) [60.2.243.174]:36834: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-17 14:28:03 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:53630: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-17 14:28:16 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:37467: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-17 14:28:54 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:56304: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-17 14:29:11 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:33962: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2dMfrc1D4qCxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bQy/sM1DUM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.166.2
country_id: 1814991
description:
2025-11-17 14:30:02 dovecot_login authenticator failed for ([183.237.166.2]) [183.237.166.2]:47370: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OtJ+ss1DVtyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.167.58
country_id: 1668284
description:
2025-11-17 14:29:59 dovecot_login authenticator failed for (49-158-167-58.dynamic.elinx.com.tw) [49.158.167.58]:48544: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.166
country_id: 1814991
description:
2025-11-17 14:29:33 dovecot_login authenticator failed for ([111.26.167.166]) [111.26.167.166]:36138: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-17 14:29:42 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:43816: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-17 14:29:53 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:39317: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-17 14:30:51 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:51825: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-11-17 14:30:52 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:45068: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.141.225
country_id: 2077456
description:
2025-11-17 14:31:09 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:58268: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-17 14:30:36 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:45332: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-11-17 14:30:34 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:60046: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-17 14:30:54 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:50684: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-17 14:30:21 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:53284: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rixQtM1D9uuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2025-11-17 14:30:34 dovecot_login authenticator failed for ([119.198.191.180]) [119.198.191.180]:39998: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 14:30:51 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:43039: 535 Incorrect authentication data (set_id=jose.comercial@sulindustrial.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 14:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<ptZis81DLaO317Oa>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 14:31:59 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "GET /cpsess6743383222/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-11-17 14:32:04 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:41400: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-11-17 14:32:09 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:60152: 535 Incorrect authentication data (set_id=jose.comercial)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qQTbt81DqKCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-17 14:31:37 dovecot_login authenticator failed for ([103.251.31.154]) [103.251.31.154]:47260: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-11-17 14:32:45 dovecot_login authenticator failed for 40.ip-217-182-65.eu [217.182.65.40]:59202: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eU1Dvc1DHNuxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cQJ5u81DmsaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-17 14:32:56 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:59874: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.129.250.48
country_id: 1814991
description:
2025-11-17 14:33:01 H=(200.150.196.245) [116.129.250.48]:64996 F=<whcxssf@outlook.com> rejected RCPT <mariacecilia@adlondrina.com.br>: "JunkMail rejected - (200.150.196.245) [116.129.250.48]:64996 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/116.129.250.48"


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5gsKv81D1oOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.226.122
country_id: 1562822
description:
2025-11-17 14:33:41 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:56605: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 14:34:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<UuAvwc1DfJ8kMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-11-17 14:33:58 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:63896: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-17 14:33:31 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:32970: 535 Incorrect authentication data (set_id=compras.ricardo@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-17 14:33:45 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:46438: 535 Incorrect authentication data (set_id=compras.ricardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-11-17 14:34:25 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:33934: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ghOews1DFKSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-17 14:35:06 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:40555: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 14:35:13 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:58133: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.64.38
country_id: 2017370
description:
2025-11-17 14:35:50 dovecot_login authenticator failed for ([176.111.64.38]) [176.111.64.38]:40070: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SgX2x81DpNmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 14:36:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<vIoRyM1DfpSGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-11-17 14:36:13 dovecot_login authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:56790: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.173.225.128
country_id: 1814991
description:
2025-11-17 14:35:26 dovecot_login authenticator failed for ([219.140.170.34]) [59.173.225.128]:4278: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OOQyxs1DdMexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-17 14:36:26 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:49123: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eKfFyc1DrIixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-17 14:36:38 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:60762: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-17 14:37:30 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:56606: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GXRRzc1DHrOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.34.91
country_id: 1835841
description:
2025-11-17 14:37:47 dovecot_login authenticator failed for ([121.129.34.91]) [121.129.34.91]:59924: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:38:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d5Pw0M1DsNaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-17 14:38:42 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:55549: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-17 14:38:59 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:60666: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PmKy0s1DtOyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 14:39:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<y2Hu0s1DFI1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.6
country_id: 1668284
description:
2025-11-17 14:39:24 dovecot_login authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:52645: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-17 14:39:43 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:40720: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NAx81M1DoIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 14:40:12 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:50181: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zmkT2M1Doq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2025-11-17 14:40:42 dovecot_login authenticator failed for ([101.13.1.75]) [101.13.1.75]:43278: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-11-17 14:41:03 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:33424: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.201.202.209
country_id: 3469034
description:
[2025-11-17 14:40:23 -0300] info [webmaild] 177.201.202.209 - regiane@singseguros.com.br "GET /cpsess1468261695/webmail/jupiter/?login=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-17 14:41:05 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:50040: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.182.187
country_id: 1814991
description:
2025-11-17 14:41:07 dovecot_login authenticator failed for ([111.23.182.187]) [111.23.182.187]:54000: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-17 14:40:20 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:55300: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 14:41:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<A1Sd2s1DAE6vfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 14:41:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<mmCT281Dvred5hjP>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RSSe281DPsmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.201
country_id: 3469034
description:
2025-11-17 14:41:40 dovecot_login authenticator failed for (ofluminense.static.gvt.net.br) [189.97.236.201]:55648: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1npv3c1Dut2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.236.154
country_id: 2017370
description:
2025-11-17 14:41:16 dovecot_login authenticator failed for ([79.135.236.154]) [79.135.236.154]:38798: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-17 14:42:01 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:38320: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-17 14:42:12 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:45426: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 14:42:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<c+0S3s1DPIGl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 14:42:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<qeBC3s1DWMJns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Bx03381Dku2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 14:42:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<Mg52381DCoVnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-11-17 14:43:04 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:58992: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-17 14:43:17 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:53705: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-17 14:43:16 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:49610: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<txbO4s1DbqSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 14:43:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<ULmv481DiK4IjQ01>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s3Vd5s1D5MWxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.221.113.209
country_id: 2629691
description:
[2025-11-17 14:44:34 -0300] info [webmaild] 82.221.113.209 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zMIt6M1DiNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-11-17 14:45:34 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:33870: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2025-11-17 14:45:40 dovecot_login authenticator failed for ([220.118.190.204]) [220.118.190.204]:33281: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-17 14:45:40 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:39272: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-11-17 14:45:54 dovecot_login authenticator failed for ([38.226.107.72]) [38.226.107.70]:48629: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-11-17 14:45:21 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:40086: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fovy6c1DLuGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 14:47:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<qkTb781DDKKdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
country_id: 1835841
description:
2025-11-17 14:46:30 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:43689: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FJWG7c1D1JaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.214.141.53
country_id: 1814991
description:
2025-11-17 14:46:41 dovecot_login authenticator failed for ([27.214.141.53]) [27.214.141.53]:17820: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-17 14:46:53 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:45414: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-17 14:46:52 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:37956: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-11-17 14:46:21 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:34430: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-11-17 14:46:31 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:42100: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 14:47:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<kAWP8s1DArHSATzz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YkXm8s1DGsmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 14:48:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<gNZu881DWuRns7yS>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JzwU8c1DprqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 14:47:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<6Czw8c1DTLgIjQ01>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 14:48:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<yvKe881Detal0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PbCm9M1DiNexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2025-11-17 14:49:16 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:41532: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 14:48:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<LEHQ881DduUXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 14:49:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<i8nV981DpsWnYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5RZC+M1D2oexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2025-11-17 14:49:35 dovecot_login authenticator failed for ([121.185.89.74]) [121.185.89.74]:52494: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 14:50:09 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:54115: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<W4Sg/c1D2rexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-17 14:50:21 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:57008: 535 Incorrect authentication data (set_id=bianca.user.ceo@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.122
country_id: 1814991
description:
2025-11-17 14:50:59 dovecot_login authenticator failed for ([111.26.101.122]) [111.26.101.122]:36220: 535 Incorrect authentication data (set_id=paulo.user.ceo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2025-11-17 14:50:44 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:47999: 535 Incorrect authentication data (set_id=bianca.user.ceo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 14:50:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<DdGe/M1DULmd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-17 14:50:58 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:51931: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aLHQ+81DrKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-11-17 14:50:35 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:51316: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.58.204
country_id: 1835841
description:
2025-11-17 14:51:27 dovecot_login authenticator failed for ([211.216.58.204]) [211.216.58.204]:47319: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.48.15.162
country_id: 1814991
description:
2025-11-17 14:51:18 dovecot_login authenticator failed for (162.15.48.59.broad.dt.sx.dynamic.163data.com.cn) [59.48.15.162]:34775: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 14:51:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<LueT/s1DdI1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-11-17 14:51:31 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:58300: 535 Incorrect authentication data (set_id=paulo.user.ceo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bO1o/81DzsuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 14:51:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<neOk/81D6Kxns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.191.196.220
country_id: 2017370
description:
2025-11-17 14:51:39 dovecot_login authenticator failed for ([95.191.196.220]) [95.191.196.220]:36411: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 14:51:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<Yc4PAM5DPs0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-17 14:51:17 dovecot_login authenticator failed for ([201.173.92.100]) [201.173.92.100]:42834: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 14:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<JpEb/81DoONn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c/P2As5DlOWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-17 14:52:40 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:56335: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-17 14:53:08 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:54438: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-17 14:53:09 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:57090: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p7GMBs5DhJqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.65.138
country_id: 1269750
description:
2025-11-17 14:53:33 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:53008: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.126
country_id: 1814991
description:
2025-11-17 14:53:35 dovecot_login authenticator failed for ([111.26.95.126]) [111.26.95.126]:43446: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-11-17 14:53:42 dovecot_login authenticator failed for ([183.236.13.2]) [183.236.13.2]:54036: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 14:53:53 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:52190: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-17 14:53:57 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:51130: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O3lcCM5DwqixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.121.3.202
country_id: 3686110
description:
2025-11-17 14:54:30 dovecot_plain authenticator failed for ([192.168.1.44]) [186.121.3.202]:54412: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-17 14:54:30 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:55608: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:54:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WDApCs5D7LyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.94.5.43
country_id: 1814991
description:
2025-11-17 14:54:40 dovecot_login authenticator failed for ([112.94.5.43]) [112.94.5.43]:54374: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-17 14:55:14 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:42289: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-17 14:54:26 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:42150: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-11-17 14:55:19 dovecot_login authenticator failed for ([82.193.122.91]) [82.193.122.91]:59519: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-11-17 14:55:34 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:19535: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 14:55:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<8V72Dc5DmKMkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2025-11-17 14:55:45 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:52763: 535 Incorrect authentication data (set_id=jose.almiro@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 14:55:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<PNdHDc5DkJhSnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3we5Dc5DYtmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.119
country_id: 1814991
description:
2025-11-17 14:55:35 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:34428: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
country_id: 1814991
description:
2025-11-17 14:56:00 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:11355: 535 Incorrect authentication data (set_id=jose.almiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.183
country_id: 2017370
description:
2025-11-17 14:56:41 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:58326: 535 Incorrect authentication data (set_id=contato)


