# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.10.38.108
country_id: 1814991
description:
2025-11-18 12:10:36 dovecot_login authenticator failed for ([175.10.38.108]) [175.10.38.108]:55046: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2025-11-18 12:12:12 dovecot_login authenticator failed for ([182.135.63.175]) [182.135.63.175]:49858: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2025-11-18 12:11:27 dovecot_login authenticator failed for 149.51.222.87.dynamic.jazztel.es [87.222.51.149]:44570: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Xd8H4d9DuquxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.254.102.229
country_id: 2017370
description:
2025-11-18 12:11:38 dovecot_login authenticator failed for (dm229.dialup.novoch.ru) [80.254.102.229]:43212: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-11-18 12:11:55 dovecot_login authenticator failed for ([91.102.231.190]) [91.102.231.190]:41186: 535 Incorrect authentication data (set_id=careers@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-18 12:11:48 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:57780: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1iTN4t9DJLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-18 12:12:03 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:59270: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-18 12:12:25 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:58646: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-18 12:12:47 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:37873: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-18 12:12:47 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:39975: 535 Incorrect authentication data (set_id=info@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-18 12:13:17 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:50980: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 12:13:05 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:45303: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-11-18 12:13:13 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:61407: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-11-18 12:12:31 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:51640: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2025-11-18 12:12:32 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:55833: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-18 12:12:39 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:47034: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.232.110
country_id: 2017370
description:
2025-11-18 12:12:59 dovecot_login authenticator failed for ([178.70.232.110]) [178.70.232.110]:49686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-18 12:13:01 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:38961: 535 Incorrect authentication data (set_id=billing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.43.103
country_id: 2077456
description:
2025-11-18 12:12:23 dovecot_login authenticator failed for 194-223-43-103.tpgi.com.au [194.223.43.103]:55750: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6CGX5N9DSsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2025-11-18 12:12:40 dovecot_login authenticator failed for ([59.23.3.146]) [59.23.3.146]:52332: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-11-18 12:12:40 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:53889: 535 Incorrect authentication data (set_id=billing@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.56.129
country_id: 1835841
description:
2025-11-18 12:14:17 dovecot_login authenticator failed for ([59.10.56.129]) [59.10.56.129]:56656: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tj816N9DquSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 12:13:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18763: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-18 12:13:53 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:43633: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.85
country_id: 1814991
description:
2025-11-18 12:13:55 dovecot_login authenticator failed for ([183.220.247.85]) [183.220.247.85]:44530: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.4.153.7
country_id: 1814991
description:
2025-11-18 12:14:11 dovecot_login authenticator failed for ([221.4.153.7]) [221.4.153.7]:55896: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-18 12:14:28 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:55673: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2025-11-18 12:14:47 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:33166: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tp6Q7d9D3qOxV3kv>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.149.89
country_id: 6252001
description:
Nov 18 12:14:20 hosting sshd[25173]: Did not receive identification string from 162.216.149.89 port 63966


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 12:14:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<ELwv699DaIEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 12:14:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<alJl699DRN13xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.73.130
country_id: 1814991
description:
2025-11-18 12:14:30 dovecot_login authenticator failed for ([111.50.73.130]) [111.50.73.130]:42169: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xPTF699DkJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-11-18 12:15:18 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:34356: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 12:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<OLYt799DwtAtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.238
country_id: 1835841
description:
2025-11-18 12:15:33 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.238]:27022: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 12:15:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<giR8799DfpV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 12:15:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<nb2Z799DToNSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-11-18 12:15:56 dovecot_login authenticator failed for 41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:47396: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-18 12:15:30 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:41038: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mY1X799DHrWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 12:16:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<Bxt9899DsLRzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-18 12:16:48 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:38021: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-11-18 12:16:56 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:41091: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-11-18 12:17:14 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:60943: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-18 12:17:15 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:38416: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DJTt8t9DTNOxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vUR79t9DAIexV3kv>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.150.17
country_id: 6252001
description:
Nov 18 12:18:03 hosting sshd[28359]: Did not receive identification string from 162.216.150.17 port 64132


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FfVJ+N9D7pKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 12:18:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<KgOY+N9DvL2l0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 12:17:27 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:64608: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 12:18:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<RnJ++d9D9rJSczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cW8R+t9DxKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-18 12:18:47 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:60292: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.205.104
country_id: 2017370
description:
2025-11-18 12:18:58 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:54544: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-11-18 12:19:03 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:51551: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.115.201.37
country_id: 2017370
description:
2025-11-18 12:19:05 dovecot_login authenticator failed for ([176.115.201.37]) [176.115.201.37]:59248: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-18 12:19:17 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:53345: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2025-11-18 12:18:38 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:23774: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2025-11-18 12:18:47 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:43378: 535 Incorrect authentication data (set_id=memaagostinho)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 12:18:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<E4kS+99DwOzSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-18 12:18:55 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:61403: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-18 12:19:23 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:33412: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GAGm/d9Dos+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-18 12:19:43 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:50210: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
country_id: 1814991
description:
2025-11-18 12:19:46 dovecot_login authenticator failed for ([222.189.211.114]) [222.189.211.114]:35634: 535 Incorrect authentication data (set_id=feedback@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.22.241.32
country_id: 1668284
description:
2025-11-18 12:20:04 dovecot_login authenticator failed for 223-22-241-32.mobile.dynamic.aptg.com.tw [223.22.241.32]:46883: 535 Incorrect authentication data (set_id=feedback)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.12.132.157
country_id: 1269750
description:
2025-11-18 12:20:10 dovecot_login authenticator failed for (rev.perfectinternet.in) [103.12.132.157]:44827: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2025-11-18 12:19:22 dovecot_login authenticator failed for (18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:60897: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 115.231.78.11
country_id: 1814991
description:
Nov 18 12:20:13 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=115.231.78.11, lip=186.233.225.118, TLS, session=<NmQeAOBDMHVz504L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-18 12:19:54 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:38299: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.144.149.177
country_id: 1835841
description:
2025-11-18 12:21:16 dovecot_login authenticator failed for ([218.144.149.177]) [218.144.149.177]:44976: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8R4/AeBD1IGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 12:20:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<sow+AeBDjKpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.89.135.30
country_id: 2017370
description:
2025-11-18 12:20:38 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:36460: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-11-18 12:20:51 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:53986: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-18 12:21:02 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br [201.61.40.117]:51580: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hVUFA+BD9JqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dOLMBOBDzq6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-11-18 12:21:32 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:34865: 535 Incorrect authentication data (set_id=tech@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-18 12:21:51 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:46353: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-11-18 12:22:03 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:58730: 535 Incorrect authentication data (set_id=contato@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 12:22:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<pNktB+BD8rp2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.26.205.154
country_id: 1814991
description:
2025-11-18 12:23:11 dovecot_login authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:47619: 535 Incorrect authentication data (set_id=accounting@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 12:23:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<UxnuCuBD7szSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2025-11-18 12:23:09 dovecot_login authenticator failed for ([112.45.66.28]) [117.172.106.105]:39706: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-18 12:22:35 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:37475: 535 Incorrect authentication data (set_id=tech@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-11-18 12:22:52 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:53626: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.1.71
country_id: 1814991
description:
2025-11-18 12:22:56 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:54039: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.50.250.189
country_id: 3686110
description:
2025-11-18 12:23:11 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:55540: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-18 12:22:21 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:40514: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JVdaCOBD7MyxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Gw+5DeBD7omxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.221.133.81
country_id: 1814991
description:
2025-11-18 12:24:14 dovecot_login authenticator failed for ([120.221.133.81]) [120.221.133.81]:44651: 535 Incorrect authentication data (set_id=help)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 12:24:17 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:54352: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-11-18 12:23:25 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:63836: 535 Incorrect authentication data (set_id=accounting)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.191.219
country_id: 1821275
description:
2025-11-18 12:23:47 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:44744: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:23:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</uL8C+BDUuaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 12:23:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<WjD9C+BDNOItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-18 12:23:37 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:49218: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-18 12:23:55 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:56216: 535 Incorrect authentication data (set_id=help@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.221.15.76
country_id: 2017370
description:
2025-11-18 12:23:22 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:56750: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2025-11-18 12:23:29 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:41619: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-18 12:24:52 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:52298: 535 Incorrect authentication data (set_id=news)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 12:25:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53091: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 12:25:12 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:10398: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f06ED+BDtJWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.199.161.79
country_id: 597427
description:
2025-11-18 12:24:39 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:54274: 535 Incorrect authentication data (set_id=news@deproi.com.br)


