# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:07:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<BAGCvdBDKrxns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 18:08:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<1NwdwNBDoLbSATzz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 18:08:50 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:50878: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 18:08:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<4CXuwNBDfseGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cpu0wdBDfrqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-11-17 18:08:19 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:57830: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-17 18:08:32 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:33754: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qRHwv9BDTqmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 18:08:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<Z7ZzwNBDPJcIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-17 18:09:45 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:36675: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 18:09:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<puE4xNBDir2nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 18:10:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<wOM0xdBDjOYXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 18:09:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<CVfcwtBD6M9SnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lzl8w9BDKMaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-17 18:09:42 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:63722: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-11-17 18:10:01 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:50578: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 18:09:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64903: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-17 18:10:10 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43084: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ILQVx9BDDOexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 18:10:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<RC1Nx9BDgqPSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 18:10:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<spegx9BDiqg7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.181
country_id: 2186224
description:
2025-11-17 18:11:20 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:50046: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xlOjytBDWJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-17 18:11:38 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:60860: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.132.94
country_id: 2017370
description:
2025-11-17 18:11:51 dovecot_login authenticator failed for ([62.182.132.94]) [62.182.132.94]:50284: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2025-11-17 18:11:54 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:44338: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O+BzzNBDxqKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-17 18:12:17 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:61798: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.152.105.37
country_id: 1210997
description:
[2025-11-17 18:12:21 -0300] info [cpaneld] 103.152.105.37 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8P8/ztBD3q6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-11-17 18:12:46 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:53909: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-17 18:13:17 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:55982: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5vDI0dBD4MyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-17 18:13:41 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:51536: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.189.195
country_id: 1643084
description:
2025-11-17 18:13:50 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:65174: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.36
country_id: 1814991
description:
2025-11-17 18:15:04 dovecot_login authenticator failed for ([111.26.167.37]) [111.26.167.36]:44634: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:14:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<kJ5z1NBDIORns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-17 18:14:24 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:58502: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s8Bo1dBDLuuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-17 18:14:48 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:43294: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.245.7
country_id: 3469034
description:
2025-11-17 18:14:57 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.245.7]:64677: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7Nos19BDPIaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hVb82NBDUJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.203.56
country_id: 1814991
description:
2025-11-17 18:15:52 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:60453: 535 Incorrect authentication data (set_id=jornalismo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-11-17 18:16:01 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:43757: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 18:15:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<19pa2tBD0dC317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.245.9
country_id: 3469034
description:
2025-11-17 18:15:08 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.245.9]:29956: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2025-11-17 18:15:19 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:51324: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 18:15:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<fe1V2dBD0NJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.254.102.229
country_id: 2017370
description:
2025-11-17 18:15:53 dovecot_login authenticator failed for (dm229.dialup.novoch.ru) [80.254.102.229]:40146: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2025-11-17 18:16:08 dovecot_login authenticator failed for ([111.26.106.115]) [111.26.106.115]:39372: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-17 18:16:19 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:48549: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.66
country_id: 1814991
description:
2025-11-17 18:16:48 dovecot_login authenticator failed for (66.20.167.124.adsl-pool.sx.cn) [124.167.20.66]:41257: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-11-17 18:16:59 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:46312: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2025-11-17 18:16:11 dovecot_login authenticator failed for 111-70-51-5.emome-ip.hinet.net [111.70.51.5]:49305: 535 Incorrect authentication data (set_id=jornalismo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.116.125.239
country_id: 2017370
description:
2025-11-17 18:16:13 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:50590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-11-17 18:16:26 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:39871: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vQmI3NBDSLaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2025-11-17 18:16:35 dovecot_login authenticator failed for ([211.43.107.179]) [211.43.107.179]:46008: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-17 18:17:54 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:45612: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DFfr4dBDxN6xV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uvAY4NBDstOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.8.209.94
country_id: 1814991
description:
2025-11-17 18:17:42 dovecot_login authenticator failed for ([121.8.209.94]) [121.8.209.94]:63849: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:18:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<xYRV4tBDkrBns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2025-11-17 18:18:28 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:34630: 535 Incorrect authentication data (set_id=j.martin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 18:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<vTvC49BD6JUIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-17 18:18:06 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:47750: 535 Incorrect authentication data (set_id=j.martin@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-11-17 18:18:27 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:62745: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RHqw49BDHoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2025-11-17 18:18:45 dovecot_login authenticator failed for ([175.198.180.129]) [175.198.180.129]:49758: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-17 18:18:57 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:38856: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-17 18:19:06 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:48510: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-11-17 18:18:20 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:51804: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-17 18:19:11 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:39813: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-17 18:19:24 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:41966: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BHBC59BD8JuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-17 18:19:35 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:41436: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.185.231
country_id: 290557
description:
2025-11-17 18:19:58 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:51216: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 18:19:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<Tlab6NBDes0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-11-17 18:20:05 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:6730: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.191.196.220
country_id: 2017370
description:
2025-11-17 18:19:09 dovecot_login authenticator failed for ([95.191.196.220]) [95.191.196.220]:51546: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.10.66
country_id: 1269750
description:
2025-11-17 18:19:21 dovecot_login authenticator failed for ([128.185.10.66]) [128.185.10.66]:49791: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-17 18:19:45 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:43688: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-11-17 18:19:55 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:42873: 535 Incorrect authentication data (set_id=vinicius.costa@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-17 18:20:04 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:58975: 535 Incorrect authentication data (set_id=vinicius.costa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-17 18:20:21 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:54244: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.245.120
country_id: 1814991
description:
2025-11-17 18:20:23 dovecot_login authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:45457: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-11-17 18:21:03 dovecot_login authenticator failed for (22.32.117.87.donpac.ru) [87.117.32.22]:59520: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JZmd7NBDMMixV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<j6XR6tBDHLexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-17 18:20:32 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:42545: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 18:20:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<vogU69BDvKxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-17 18:20:45 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:61530: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.50.162.66
country_id: 2017370
description:
2025-11-17 18:20:47 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:57286: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 18:22:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<R9MF8NBDIs957bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-11-17 18:21:21 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:53698: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-17 18:21:25 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:39252: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 18:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<zCDl7dBDuN9A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kvVl7tBDZtSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
country_id: 1668284
description:
2025-11-17 18:21:34 dovecot_login authenticator failed for 110-25-107-43.adsl.fetnet.net [110.25.107.43]:42537: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-17 18:21:39 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:39638: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2025-11-17 18:22:12 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:33976: 535 Incorrect authentication data (set_id=paulosogabe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2025-11-17 18:22:26 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.233.190]:56991: 535 Incorrect authentication data (set_id=paulosogabe)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 18:22:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Op+P8dBDFpyl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QucF8tBDIIGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 18:22:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<nXIF8tBDHLSvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 18:22:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<hrpo89BDBtMkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-17 18:23:01 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:39364: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.220.207
country_id: 2017370
description:
2025-11-17 18:23:43 dovecot_login authenticator failed for ([95.66.220.207]) [95.66.220.207]:24327: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2yON9dBDQpaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-17 18:23:31 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:60712: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 18:23:32 H=(195.3.134.135) [179.0.178.53]:50073 F=<erictremblaysi@hotmail.com> rejected RCPT <estradaafora@ieq.com.br>: Nenhuma pessoa no endereço.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.119
country_id: 1814991
description:
2025-11-17 18:23:57 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:40746: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.77
country_id: 1814991
description:
2025-11-17 18:23:59 dovecot_login authenticator failed for ([111.26.101.76]) [111.26.101.77]:38862: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<En1c99BDLqexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-17 18:23:18 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:38067: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.218.37.145
country_id: 1814991
description:
2025-11-17 18:23:32 dovecot_login authenticator failed for ([111.206.233.34]) [221.218.37.145]:41997: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.149.67.200
country_id: 1814991
description:
2025-11-17 18:23:53 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:57762: 535 Incorrect authentication data (set_id=bianca.user.legal@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-11-17 18:24:38 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:54940: 535 Incorrect authentication data (set_id=paulo.user.legal)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 18:24:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<mpNU+tBDULZSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.132.212
country_id: 357994
description:
2025-11-17 18:24:14 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.132.212]:52098: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-11-17 18:24:26 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:59434: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2025-11-17 18:24:27 dovecot_login authenticator failed for ([218.156.93.206]) [218.156.93.206]:56215: 535 Incorrect authentication data (set_id=bianca.user.legal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 18:24:27 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:54881: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-11-17 18:24:41 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:49070: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-17 18:25:00 dovecot_login authenticator failed for ([27.123.105.41]) [182.95.52.206]:35504: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-11-17 18:24:16 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:54896: 535 Incorrect authentication data (set_id=paulo.user.legal@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-17 18:24:19 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:49520: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.49
country_id: 1668284
description:
2025-11-17 18:24:54 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:42109: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 18:24:56 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:64705: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2025-11-17 18:24:25 dovecot_login authenticator failed for ([222.180.2.62]) [222.180.2.62]:34199: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B4As+dBDpLGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.47.242
country_id: 2017370
description:
2025-11-17 18:24:35 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:50458: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-17 18:24:37 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:48098: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dK60/NBD7syxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aLwcAtFDHIWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-11-17 18:26:13 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:34798: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-17 18:26:38 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:58678: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-11-17 18:26:37 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:48819: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.210.199
country_id: 3017382
description:
2025-11-17 18:26:56 dovecot_login authenticator failed for (ADMIN) [83.136.210.199]:56122: 535 Incorrect authentication data (set_id=financeiro@projetolucas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-17 18:26:57 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:35144: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-17 18:26:23 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:57261: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:26:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QAJVANFDAuqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.226.196
country_id: 1814991
description:
2025-11-17 18:26:52 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:33254: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-17 18:27:07 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:50000: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 18:27:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<79cpAtFD/pGdQi/y>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NOTjA9FDEpSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 18:27:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<EVToBNFDQOhxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.111.4
country_id: 2510769
description:
2025-11-17 18:28:17 dovecot_login authenticator failed for 4.red-79-154-111.dynamicip.rima-tde.net [79.154.111.4]:44476: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 18:28:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<qXCZBtFDvIto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 18:28:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<Tle9BtFDaKyd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.187
country_id: 3175395
description:
Nov 17 18:28:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=185.208.189.187, lip=200.150.196.245, TLS, session=<QvYBCNFDUuy50L27>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 18:28:15 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:60834: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 18:28:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<YuSrB9FDVok+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-17 18:28:50 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:53008: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ze56B9FDELKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:30:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<N13ZDNFDbNuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.155
country_id: 1819730
description:
2025-11-17 18:29:08 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:45182: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2025-11-17 18:29:14 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:43955: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2025-11-17 18:29:26 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:36830: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mRkLC9FDWM+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 18:29:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<n5M1DNFD7LwnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-17 18:29:59 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:35621: 535 Incorrect authentication data (set_id=programador@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-17 18:30:10 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:37790: 535 Incorrect authentication data (set_id=programador)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EWebDtFDjOyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 18:30:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<7Um0DtFDcPtxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.185.88
country_id: 2017370
description:
2025-11-17 18:30:42 dovecot_login authenticator failed for ([178.66.185.88]) [178.66.185.88]:60244: 535 Incorrect authentication data (set_id=comercial.user.legal@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.45
country_id: 6252001
description:
2025-11-17 18:31:00 dovecot_login authenticator failed for ([70.174.168.45]) [70.174.168.45]:59143: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.145.27
country_id: 298795
description:
2025-11-17 18:30:24 dovecot_login authenticator failed for ([188.59.145.27]) [188.59.145.27]:38008: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-17 18:30:53 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:42330: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 18:30:58 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:54038: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2025-11-17 18:31:00 dovecot_login authenticator failed for ([111.26.69.160]) [111.26.69.160]:44824: 535 Incorrect authentication data (set_id=comercial.user.legal)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<caEoEtFDgpmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-17 18:31:33 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:58130: 535 Incorrect authentication data (set_id=rsimoesdiretoria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 18:31:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<iX9PEtFDzAdo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 18:31:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<v09yENFDTopA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.74.74.44
country_id: 1814991
description:
2025-11-17 18:31:17 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:46480: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2025-11-17 18:31:23 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:34722: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 18:31:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<bJC+EtFDhOGGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 18:31:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<pOWPE9FDSJQnaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bt+9FdFDpLexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:32:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<aWptFtFDfshns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EsiFF9FD4MOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 18:33:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<QYUUGNFDDqul0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dshYGdFDINexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 18:33:59 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:45882: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gNnkHNFDjJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.142.251.122
country_id: 1814991
description:
2025-11-17 18:35:03 dovecot_login authenticator failed for (122.251.142.219.broad.bj.bj.dynamic.163data.com.cn) [219.142.251.122]:41078: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.182.238
country_id: 2017370
description:
2025-11-17 18:35:18 dovecot_login authenticator failed for ([95.165.182.238]) [95.165.182.238]:60084: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6l+BINFDlrOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.3.179.215
country_id: 2017370
description:
2025-11-17 18:35:32 dovecot_login authenticator failed for (5x3x179x215.dynamic.spb.ertelecom.ru) [5.3.179.215]:56648: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-17 18:35:35 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:38586: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GK1AItFDXsSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 18:36:35 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:53579: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-17 18:36:42 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:33770: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.150
country_id: 3469034
description:
Nov 17 18:36:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=177.44.71.150, lip=200.150.196.245, TLS, session=<H44mJNFD8M+xLEeW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-11-17 18:36:56 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:34967: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 18:36:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<TVVqI9FD/rZ9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UrcPJNFDNtGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 18:37:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<6AgxJtFDYt6d5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gwinJ9FDSO2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.22.130
country_id: 1562822
description:
2025-11-17 18:38:55 dovecot_login authenticator failed for ([124.197.22.130]) [124.197.22.130]:48710: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 18:38:57 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55401: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.64.146
country_id: 3469034
description:
2025-11-17 18:38:27 dovecot_login authenticator failed for 138-97-64-146.westlink.net.br [138.97.64.146]:51076: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:38:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<D14/K9FDlpKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-11-17 18:38:43 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:35606: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-17 18:38:49 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:39504: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6/kDLdFDHKOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.141.61.63
country_id: 1814991
description:
2025-11-17 18:38:23 dovecot_login authenticator failed for ([211.141.61.62]) [211.141.61.63]:38716: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 18:38:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<Ct5ZK9FD6PqvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-11-17 18:38:38 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:51640: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.199.168
country_id: 1562822
description:
2025-11-17 18:39:07 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:50739: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 18:39:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55652: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E6/MLtFDFK6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-17 18:39:07 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:41216: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.50.123
country_id: 2017370
description:
2025-11-17 18:39:09 dovecot_login authenticator failed for ([151.0.50.123]) [151.0.50.123]:38340: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 18:39:24 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:56198: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 18:39:28 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:53286: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-17 18:39:57 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:43228: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-17 18:40:55 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:34582: 535 Incorrect authentication data (set_id=coordenacao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-17 18:40:55 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:60990: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.249.76
country_id: 2017370
description:
2025-11-17 18:40:31 dovecot_login authenticator failed for ([78.111.249.76]) [78.111.249.76]:53719: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lARbMtFDYMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 18:40:39 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:33444: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-11-17 18:40:52 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:39428: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.87
country_id: 1814991
description:
2025-11-17 18:40:11 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:60356: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-17 18:40:46 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:49660: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2025-11-17 18:41:12 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:50274: 535 Incorrect authentication data (set_id=coordenacao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-17 18:41:21 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:4800: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eqTxNdFDVuixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-17 18:41:39 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:54468: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 18:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<4h8ON9FDxrk+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 18:41:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<3whTN9FD6JN9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aTLBN9FDEIWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-17 18:42:30 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:42252: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ju+HOdFDYpGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-11-17 18:42:35 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:54200: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-17 18:42:43 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:50740: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-17 18:42:54 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:44774: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-11-17 18:42:16 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:42594: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5McWPdFDNLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-11-17 18:43:34 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:55012: 535 Incorrect authentication data (set_id=andre.nascimento.legal@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-17 18:43:49 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:46110: 535 Incorrect authentication data (set_id=andre.nascimento.legal)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4lemQNFDzM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-11-17 18:44:36 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:35264: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 18:44:38 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:44354: 535 Incorrect authentication data (set_id=info.user.legal)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7LpyQtFDENuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-17 18:44:15 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:58372: 535 Incorrect authentication data (set_id=info.user.legal@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.152
country_id: 6252001
description:
2025-11-17 18:44:18 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:35079: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uIY/RNFDquyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-17 18:45:56 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:37882: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.138.16.231
country_id: 798544
description:
Nov 17 18:45:18 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=45.138.16.231, lip=200.150.196.245, TLS: Connection closed, session=<iAl8QtFDNFotihDn>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.40.71.182
country_id: 3469034
description:
[2025-11-17 18:45:24 -0300] info [webmaild] 189.40.71.182 - liana@projetocircense.com.br "GET /cpsess6022075013/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.62
country_id: 1269750
description:
2025-11-17 18:46:18 dovecot_login authenticator failed for ([182.95.2.153]) [125.20.224.62]:45426: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2025-11-17 18:46:22 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:46224: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 18:46:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<EoV+R9FDUtgkMrBu>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.245.13.114
country_id: 6252001
description:
[2025-11-17 18:46:15 -0300] info [webmaild] 172.245.13.114 - gerson@89fmjoinville.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2025-11-17 18:46:20 -0300] info [webmaild] 143.244.33.80 - gerson@89fmjoinville.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5N/SR9FDfpixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
country_id: 1814991
description:
2025-11-17 18:46:37 dovecot_login authenticator failed for ([61.189.61.162]) [61.189.61.162]:44684: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.244.171.134
country_id: 1562822
description:
2025-11-17 18:46:40 dovecot_login authenticator failed for ([14.244.171.134]) [14.244.171.134]:46107: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-17 18:47:03 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:51150: 535 Incorrect authentication data (set_id=vendas3)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.27
country_id: 2264397
description:
Nov 17 18:48:05 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.197.27, lip=186.233.225.118, session=<hStYTdFDtca54sUb>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GiFhS9FDRLexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 18:47:36 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:53989: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-11-17 18:47:51 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:47760: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-17 18:47:52 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:59885: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-11-17 18:47:59 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:32810: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-11-17 18:47:32 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:53624: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 18:47:46 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:59930: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r0IuTdFD7MGxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U9f/TtFDJNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.180.201
country_id: 1835841
description:
2025-11-17 18:48:58 dovecot_login authenticator failed for ([14.49.180.201]) [14.49.180.201]:38990: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.3.64.66
country_id: 2017370
description:
2025-11-17 18:48:07 dovecot_login authenticator failed for (5x3x64x66.dynamic.ulsk.ertelecom.ru) [5.3.64.66]:46813: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-11-17 18:48:19 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:35647: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 18:48:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<vtTfTtFDpq+l0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-11-17 18:48:07 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:42714: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.149.67.200
country_id: 1814991
description:
2025-11-17 18:48:40 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:46290: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 18:48:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<2Up4UNFDHqyl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.58.156.82
country_id: 1668284
description:
2025-11-17 18:50:00 dovecot_login authenticator failed for (82-156-58-61.tinp.net.tw) [61.58.156.82]:38786: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 18:49:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<UqQjUdFDwKHSATzz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-11-17 18:49:13 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:50094: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZcKIUtFDBOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 18:49:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<Ui9DU9FD+OFSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:50:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<ZBlqVNFDYulns7yS>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xyAhVtFD7pexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.61.137
country_id: 1562822
description:
2025-11-17 18:50:37 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:19286: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6KfxV9FDoKexV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hvq5WdFDlLWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2025-11-17 18:51:51 dovecot_login authenticator failed for (18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:59656: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 18:52:05 H=(195.3.134.135) [179.0.178.53]:58110 F=<erictremblaysi@hotmail.com> rejected RCPT <hideseek@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:58110 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-17 18:51:23 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:51656: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-11-17 18:51:30 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:49140: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 18:51:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<qM6UWdFD7ImGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gCJGXdFDCtOxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Nl7XYNFDROixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-11-17 18:53:34 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:47788: 535 Incorrect authentication data (set_id=derly@educacionalevangelico.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-17 18:53:45 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:55530: 535 Incorrect authentication data (set_id=derly)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-17 18:53:54 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:45278: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1lajYtFDKIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.238.101.209
country_id: 3932488
description:
2025-11-17 18:53:10 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:48264: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2025-11-17 18:54:54 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:59474: 535 Incorrect authentication data (set_id=thiagorodrigo@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 18:55:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<YlQ3ZtFDAtFn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nDV0ZNFDzpexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 18:55:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57804: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-17 18:55:56 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:52501: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-17 18:55:07 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:48826: 535 Incorrect authentication data (set_id=thiagorodrigo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uf7/Z9FDALaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-11-17 18:55:39 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:33446: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-17 18:55:41 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:2327: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.181
country_id: 2186224
description:
2025-11-17 18:55:52 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:51566: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.65.108
country_id: 2077456
description:
2025-11-17 18:55:20 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:52434: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-17 18:55:33 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:56252: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-17 18:56:06 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:42863: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-11-17 18:56:05 dovecot_login authenticator failed for ([188.59.6.176]) [188.59.6.176]:57521: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-17 18:56:20 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:37084: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-11-17 18:56:21 dovecot_login authenticator failed for ([2.55.68.141]) [2.55.68.141]:58458: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sxaTa9FD1tGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.137.232
country_id: 2017370
description:
2025-11-17 18:56:46 dovecot_login authenticator failed for ([176.125.137.232]) [176.125.137.232]:56652: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 18:57:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<NxlHbdFDfqE7GIXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:56:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<moOzatFDQpNns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.244
country_id: 1814991
description:
2025-11-17 18:56:20 dovecot_login authenticator failed for ([111.26.61.243]) [111.26.61.244]:37422: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-17 18:56:40 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:33996: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-17 18:56:44 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:59607: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.26.133.168
country_id: 1562822
description:
2025-11-17 18:56:52 dovecot_plain authenticator failed for (tbo6ttnb746j5fplscguz6kjn9dhxjr) [123.26.133.168]:2157: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LChjbdFD/N6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-17 18:57:32 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:43105: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HH8vb9FDguuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-17 18:57:40 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:34093: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.91.119
country_id: 2017370
description:
2025-11-17 18:57:52 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:59716: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.226.83
country_id: 2017370
description:
2025-11-17 18:57:08 dovecot_login authenticator failed for ([62.192.226.83]) [62.192.226.83]:40488: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2025-11-17 18:57:15 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:50720: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 18:58:17 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:61309: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-17 18:58:21 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:57461: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-17 18:58:47 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:59102: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-17 18:58:55 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50286: 535 Incorrect authentication data (set_id=mecati)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<R5C+ctFDPKOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-17 18:58:53 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:45298: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.7.209
country_id: 1835841
description:
2025-11-17 18:58:54 dovecot_login authenticator failed for ([222.116.7.209]) [222.116.7.209]:41197: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-17 18:59:00 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:39133: 535 Incorrect authentication data (set_id=design)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-17 18:59:39 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:36020: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 19:00:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<epobeNFDOsRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 18:59:18 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:32958: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.246
country_id: 1668284
description:
2025-11-17 18:59:29 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:59669: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Iy5UdtFDvsGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-11-17 18:59:57 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:47040: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2025-11-17 19:00:02 dovecot_login authenticator failed for ([58.34.174.90]) [58.34.174.90]:40953: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xB8VeNFDGM2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 18:59:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<rh8qd9FDTMpns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-11-17 18:59:50 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:49908: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 18:59:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<NvtJd9FDYJYXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.107.36.18
country_id: 1269750
description:
Nov 17 19:00:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=103.107.36.18, lip=200.150.196.245, TLS, session=<SNpNetFDOL9nayQS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.203.38
country_id: 1835841
description:
2025-11-17 19:00:32 dovecot_login authenticator failed for ([59.6.203.38]) [59.6.203.38]:47788: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qMreedFD3OCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.227.199
country_id: 1269750
description:
Nov 17 19:00:37 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@lixadoracuritiba.com.br>, method=PLAIN, rip=122.187.227.199, lip=200.150.196.245, TLS, session=<1efleNFDtIx6u+PH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-11-17 19:00:52 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:33670: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:01:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+iyAfdFDIomxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
country_id: 1814991
description:
2025-11-17 19:01:41 dovecot_login authenticator failed for ([218.94.104.181]) [218.94.104.180]:54207: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 19:01:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<MuqhftFDoea317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.79.21
country_id: 1814991
description:
2025-11-17 19:02:04 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:45464: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 19:01:22 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:38842: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SwsSgdFDYqmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2025-11-17 19:02:59 dovecot_login authenticator failed for (213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:49567: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:03:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hTfegtFDXLexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.252
country_id: 1814991
description:
2025-11-17 19:03:03 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:33865: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 19:02:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<a7J4f9FDgs0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.83.124.138
country_id: 1814991
description:
2025-11-17 19:02:20 dovecot_login authenticator failed for ([1.83.124.138]) [1.83.124.138]:3281: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 19:03:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Fczug9FD6IOl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rdKZhNFDjMixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 19:03:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<hYbOhNFDOLxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-11-17 19:03:55 dovecot_login authenticator failed for ([122.224.164.194]) [122.224.164.194]:36727: 535 Incorrect authentication data (set_id=secretaria@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.12.215.34
country_id: 1814991
description:
2025-11-17 19:03:14 dovecot_login authenticator failed for ([60.12.215.34]) [60.12.215.34]:65510: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-17 19:03:17 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3681: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-11-17 19:04:57 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:46492: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
country_id: 1562822
description:
2025-11-17 19:04:13 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:20762: 535 Incorrect authentication data (set_id=secretaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 19:04:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<FUNlh9FDVtwkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 19:04:26 dovecot_login authenticator failed for (User) [177.74.174.120]:56876: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZtcviNFDyOSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-11-17 19:04:41 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:47129: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zsnJi9FDWI2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 19:05:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<Fr7KjNFDGtVSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 19:05:58 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:60577: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IxSLjdFDYp+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 19:05:16 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56305: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OCFdj9FDyqmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-17 19:06:37 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:44986: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.124
country_id: 3996063
description:
2025-11-17 19:06:50 dovecot_login authenticator failed for ([177.236.145.124]) [177.236.145.124]:55424: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 19:06:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<cLpSkNFDQO1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 19:06:06 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:53487: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 19:06:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<Z9KujdFDCJOd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-17 19:07:55 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:50617: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2025-11-17 19:08:02 dovecot_login authenticator failed for ([218.17.217.141]) [218.17.217.141]:40293: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 19:07:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<bV2GktFDDKWvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 19:07:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<nt7/ktFDwNk+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.143.34
country_id: 1814991
description:
2025-11-17 19:07:40 dovecot_login authenticator failed for ([218.108.143.34]) [218.108.143.34]:59944: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-11-17 19:07:45 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:57598: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-11-17 19:07:52 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:49932: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MTnzktFDvsaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.239
country_id: 1668284
description:
2025-11-17 19:08:27 dovecot_login authenticator failed for 111-70-23-239.emome-ip.hinet.net [111.70.23.239]:45347: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fYmEltFDbuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-17 19:08:39 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:42868: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-11-17 19:08:53 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:48056: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-11-17 19:08:54 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:35512: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vkVRmNFDLO6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-17 19:08:06 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:55051: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.75.86
country_id: 1814991
description:
2025-11-17 19:08:14 dovecot_login authenticator failed for ([223.167.75.86]) [223.167.75.86]:46166: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-11-17 19:08:27 dovecot_login authenticator failed for ([65.181.79.60]) [65.181.79.60]:58291: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 19:08:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<IpFpltFDVos+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
country_id: 1814991
description:
2025-11-17 19:08:53 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:43792: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.200.9.182
country_id: 1814991
description:
2025-11-17 19:09:07 dovecot_login authenticator failed for ([218.200.9.182]) [218.200.9.182]:34701: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.227.51
country_id: 1835841
description:
2025-11-17 19:09:20 dovecot_login authenticator failed for ([61.79.227.51]) [61.79.227.51]:42894: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0a4TmtFDTIuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 19:09:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<QDv3mdFDpLtxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 19:09:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<vwYom9FD5NZo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-17 19:10:48 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:57664: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 19:10:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<UIwkn9FDhOwnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 19:10:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<H89SmdFDiNV57bKF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f/CnndFDXLOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2025-11-17 19:10:40 dovecot_login authenticator failed for ([168.126.53.11]) [168.126.53.11]:43219: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hJE/odFDutKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qjD/otFDNN6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 19:11:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<P4MPoNFD0OidQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 19:12:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<fwuTo9FDSPRxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<od7QpNFDEOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 19:12:58 dovecot_login authenticator failed for (89fmjoinville.com) [112.122.54.54]:20303: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.184.202
country_id: 1814991
description:
2025-11-17 19:13:57 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:47999: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 19:13:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<XCnwptFDFIgnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 19:13:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<UneOp9FDWrBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 19:13:23 dovecot_login authenticator failed for (89fmjoinville.com) [112.122.54.54]:7944: 535 Incorrect authentication data (set_id=postmaster@89fmjoinville.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<S/pcqNFDkpqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-17 19:13:35 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:59486: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2025-11-17 19:13:35 dovecot_login authenticator failed for 111-70-23-252.emome-ip.hinet.net [111.70.23.252]:34962: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-17 19:13:48 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:47710: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 19:14:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<fNgCqtFDvuBns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.221.68
country_id: 1835841
description:
2025-11-17 19:14:39 dovecot_login authenticator failed for ([220.80.221.68]) [220.80.221.68]:38473: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 19:14:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<TKqIrNFDVok+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<13vArdFD8MqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 19:15:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<OPLJrdFDQqqd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 19:14:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<EaVPqtFDzKaGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-11-17 19:14:21 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:42138: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O+zvq9FD5LexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-17 19:16:04 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:43656: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oJaQr9FDOOSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-17 19:16:47 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:60136: 535 Incorrect authentication data (set_id=paulo.user.marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2025-11-17 19:17:01 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:53542: 535 Incorrect authentication data (set_id=bianca.user.marketing@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-11-17 19:16:26 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:38941: 535 Incorrect authentication data (set_id=paulo.user.marketing@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 19:16:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<GHUMs9FDJoml0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DBEjs9FDcoyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.204
country_id: 1835841
description:
2025-11-17 19:16:42 dovecot_login authenticator failed for ([211.198.128.204]) [211.198.128.204]:49911: 535 Incorrect authentication data (set_id=bianca.user.marketing@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-17 19:17:48 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:51767: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2025-11-17 19:17:57 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:47764: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JVl0uNFDTLaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-17 19:17:16 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:49402: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0Vq3ttFD+qmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-17 19:17:44 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:56122: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-11-17 19:17:20 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:41248: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.87
country_id: 3469034
description:
Nov 17 19:17:23 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=190.89.137.87, lip=200.150.196.245, TLS, session=<gB4ctdFDHYe+WYlX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-17 19:17:36 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:59064: 535 Incorrect authentication data (set_id=ti)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.143.104
country_id: 2077456
description:
2025-11-17 19:19:01 dovecot_login authenticator failed for ([120.157.143.104]) [120.157.143.104]:39006: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2025-11-17 19:18:25 dovecot_login authenticator failed for 176-170-1-244.abo.bbox.fr [176.170.1.244]:56885: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qFZCutFDhsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-17 19:19:01 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:56163: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2025-11-17 19:19:26 dovecot_login authenticator failed for ([1.30.20.238]) [1.30.20.238]:56032: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-17 19:19:31 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:34372: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.58.73.238
country_id: 1814991
description:
2025-11-17 19:19:42 dovecot_login authenticator failed for ([218.58.73.238]) [218.58.73.238]:37316: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2025-11-17 19:19:47 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:43802: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-11-17 19:19:50 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:40055: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:19:57 dovecot_login authenticator failed for (vysOIEvT) [141.98.11.11]:58569: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.115.177.212
country_id: 6251999
description:
2025-11-17 19:19:27 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:35704: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-11-17 19:19:29 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:42874: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.111.183.30
country_id: 1814991
description:
2025-11-17 19:19:33 dovecot_login authenticator failed for ([202.111.183.30]) [202.111.183.30]:50660: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pnrfvdFD5OOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.119
country_id: 1814991
description:
2025-11-17 19:19:50 dovecot_login authenticator failed for ([123.129.196.119]) [123.129.196.119]:33109: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-17 19:20:05 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:53556: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RAA2w9FD6qGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:20:21 dovecot_login authenticator failed for (Pl7V0y) [141.98.11.11]:60894: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</WZywdFDgI+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.218
country_id: 798544
description:
Nov 17 19:20:35 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=109.125.247.218, lip=200.150.196.245, TLS, session=<7uNWwNFD8r5tfffa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.125.122.173
country_id: 3865483
description:
2025-11-17 19:20:41 dovecot_login authenticator failed for host173.186-125-122.telecom.net.ar [186.125.122.173]:60998: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 19:20:41 dovecot_login authenticator failed for (globalmedica.com.br) [61.50.119.110]:26388: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.156
country_id: 3175395
description:
Nov 17 19:20:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=185.15.171.156, lip=200.150.196.245, TLS, session=<5OO+wdFDUt+5D6uc>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.52.204.70
country_id: 2802361
description:
Nov 17 19:21:51 hosting pure-ftpd: (?@34.52.204.70) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:21:06 dovecot_login authenticator failed for (XvYxbH) [141.98.11.11]:52436: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-17 19:21:18 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:45062: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tU4DxdFDIK6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2025-11-17 19:21:54 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:57405: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 19:21:24 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:51185: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 19:21:32 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:55591: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.116.125.239
country_id: 2017370
description:
2025-11-17 19:21:06 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:48138: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 19:21:06 dovecot_login authenticator failed for (globalmedica.com.br) [61.50.119.110]:31020: 535 Incorrect authentication data (set_id=test@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 19:21:06 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63939: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-17 19:22:04 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:56176: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 19:21:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<v6xFw9FD0oN9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.34.226
country_id: 2017370
description:
2025-11-17 19:21:15 dovecot_login authenticator failed for ([46.149.34.226]) [46.149.34.226]:59704: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-17 19:22:17 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:58130: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-17 19:22:24 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:54372: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hlicyNFDfsuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-17 19:22:37 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:32951: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.115.29.39
country_id: 1835841
description:
2025-11-17 19:22:46 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:21844: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-17 19:22:47 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:60216: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.20
country_id: 1643084
description:
2025-11-17 19:22:09 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:53654: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-11-17 19:22:10 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:48912: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.96.228.60
country_id: 1814991
description:
2025-11-17 19:22:17 dovecot_login authenticator failed for ([150.129.138.198]) [112.96.228.60]:37718: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-11-17 19:22:50 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:46986: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:22:10 dovecot_login authenticator failed for (98AAwk) [141.98.11.11]:60703: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-17 19:23:07 dovecot_login authenticator failed for ([36.135.100.48]) [36.135.100.48]:50716: 535 Incorrect authentication data (set_id=comercial.user.marketing@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-17 19:23:14 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:37388: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 19:23:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<lMjSy9FDRuqvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2025-11-17 19:24:00 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:29445: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hfXzzdFDoIaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:23:07 dovecot_login authenticator failed for (iD1CVcIG) [141.98.11.11]:62728: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-11-17 19:23:22 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:52628: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-17 19:23:24 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.227]:41412: 535 Incorrect authentication data (set_id=comercial.user.marketing)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ffMozNFDZOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.186.183.88
country_id: 2017370
description:
2025-11-17 19:23:36 dovecot_login authenticator failed for (188x186x183x88.dynamic.tmn.ertelecom.ru) [188.186.183.88]:44292: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.158.244
country_id: 1835841
description:
2025-11-17 19:24:45 dovecot_login authenticator failed for ([183.99.158.244]) [183.99.158.244]:50102: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:24:56 dovecot_login authenticator failed for (rk6DS3) [141.98.11.11]:52749: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 19:24:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<lQI7ztFDkIEXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-17 19:24:25 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:54121: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0uqzz9FDBpGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-11-17 19:24:31 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:56796: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:25:17 dovecot_login authenticator failed for (fHXwBQEtd) [141.98.11.11]:60043: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cedK09FDNK+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.150.58
country_id: 2017370
description:
2025-11-17 19:25:32 dovecot_login authenticator failed for ([178.35.150.58]) [178.35.150.58]:53574: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-17 19:26:57 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:39552: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8eKk2NFD4NqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.184.18
country_id: 1814991
description:
2025-11-17 19:26:20 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:36412: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-17 19:26:21 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:42605: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:26:24 dovecot_login authenticator failed for (zBERpA8bd5) [141.98.11.11]:53604: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:26:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eXno1tFDZNCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 19:26:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<98VO19FDLs99gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-11-17 19:27:17 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:48120: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-17 19:27:28 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:47590: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:27:29 dovecot_login authenticator failed for (g6rG67) [141.98.11.11]:65214: 535 Incorrect authentication data (set_id=louvoreterno)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jC112tFDmuexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 19:27:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<rpGF29FD+tJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-11-17 19:28:18 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:59342: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-17 19:28:21 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:38384: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<njQD3tFD3pKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.39.180
country_id: 2017370
description:
2025-11-17 19:28:27 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:58036: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-17 19:28:30 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:51562: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 19:28:34 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:51496: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 19:28:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<jT1Y3tFDuOEkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.83
country_id: 798544
description:
2025-11-17 19:28:43 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:53320: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 19:28:44 dovecot_login authenticator failed for ([200.149.213.242]) [200.149.213.242]:59340: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 19:29:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<03Zj4tFD9Lel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 19:30:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<U7pD49FDEo3SATzz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<b2ph49FDpruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-17 19:29:39 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:57232: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2025-11-17 19:29:47 dovecot_login authenticator failed for ([119.198.191.180]) [119.198.191.180]:32774: 535 Incorrect authentication data (set_id=hcpontagrossa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-17 19:29:32 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:49934: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-17 19:29:23 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:34885: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-17 19:29:31 dovecot_login authenticator failed for (nsg-corporate-150.144.185.122.airtel.in) [122.185.144.150]:38140: 535 Incorrect authentication data (set_id=hcpontagrossa@hipercesta.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fY6X4dFDoK+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 19:29:53 dovecot_login authenticator failed for (User) [177.74.174.120]:54611: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.83
country_id: 798544
description:
2025-11-17 19:29:07 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:54329: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 19:29:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<332N4NFDnpnSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-17 19:29:52 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:51560: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0bQr5dFDys6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2025-11-17 19:30:36 dovecot_login authenticator failed for (eiazX4) [141.98.11.11]:62129: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-11-17 19:30:42 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:36192: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 19:30:54 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64004: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 19:30:09 dovecot_login authenticator failed for (User) [177.74.174.120]:54611: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 19:30:21 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51047: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-17 19:30:10 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:42809: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 19:30:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<R0pS5tFDso9ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-17 19:31:31 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:60804: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<q0XH6NFDHuaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-17 19:31:45 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:57048: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 19:32:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<hH9g6tFDtNBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-17 19:32:01 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:51602: 535 Incorrect authentication data (set_id=atendimento@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 19:31:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<a4bb59FDXr1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-11-17 19:31:47 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:37394: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 19:31:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<6Xww6tFDtJml0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-11-17 19:31:59 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:44880: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MhRX7NFDZJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.100.124.153
country_id: 2017370
description:
2025-11-17 19:32:46 dovecot_login authenticator failed for ([176.100.124.153]) [176.100.124.153]:55174: 535 Incorrect authentication data (set_id=isabella)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.243.93.89
country_id: 1562822
description:
2025-11-17 19:32:45 dovecot_login authenticator failed for (dynamic-adsl.viettel.vn) [171.243.93.89]:45406: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J8Ag7tFD9qOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.142.242
country_id: 1814991
description:
2025-11-17 19:32:22 dovecot_login authenticator failed for ([222.85.202.86]) [59.51.142.242]:47274: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.234.114
country_id: 2017370
description:
2025-11-17 19:32:31 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:59145: 535 Incorrect authentication data (set_id=isabella@eloempresas.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-17 19:32:32 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:40296: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-17 19:33:50 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:38366: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 19:34:04 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:51242: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 19:33:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<ThFP7tFDSs+Gx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E3Xn79FDALyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 19:33:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<lH8z8NFDXOjSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Urp+89FDStixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-17 19:34:57 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:57743: 535 Incorrect authentication data (set_id=andre.nascimento.marketing@calcautomacao.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<z9QU99FDwoCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-17 19:36:06 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:44451: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2025-11-17 19:35:13 dovecot_login authenticator failed for 110-25-110-136.adsl.fetnet.net [110.25.110.136]:55773: 535 Incorrect authentication data (set_id=andre.nascimento.marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-11-17 19:35:15 dovecot_login authenticator failed for ([122.224.164.194]) [122.224.164.194]:55519: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-17 19:35:27 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:36154: 535 Incorrect authentication data (set_id=jotadeschamps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-11-17 19:35:33 dovecot_login authenticator failed for ([49.207.15.25]) [49.207.15.25]:54439: 535 Incorrect authentication data (set_id=info.user.marketing@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 19:35:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<bIVR99FDnpdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-17 19:36:03 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:35774: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2025-11-17 19:35:16 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:53502: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
country_id: 1562822
description:
2025-11-17 19:35:28 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:42200: 535 Incorrect authentication data (set_id=sociais)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<egbV+NFDrJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2025-11-17 19:35:20 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:13158: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2025-11-17 19:35:24 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:37302: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-17 19:35:44 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:41730: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-11-17 19:36:06 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:41771: 535 Incorrect authentication data (set_id=info.user.marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-17 19:36:22 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:62301: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E9il+tFD1p2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-17 19:36:34 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:36244: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-17 19:36:57 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:50248: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 19:37:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<RAga/dFDhrVns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-17 19:37:27 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:49080: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aoMx/tFDgruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-17 19:37:42 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:57738: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-17 19:37:48 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:42778: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-17 19:37:12 dovecot_login authenticator failed for ([122.185.145.54]) [122.185.145.54]:54552: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 49.207.15.25
country_id: 1269750
description:
Nov 17 19:37:20 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@louvoreterno.com.br>, method=PLAIN, rip=49.207.15.25, lip=200.150.196.245, TLS, session=<Ewcs/NFDq+Mxzw8Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-17 19:37:26 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:51268: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.250.63
country_id: 99237
description:
Nov 17 19:37:39 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=65.20.250.63, lip=200.150.196.245, TLS, session=<UqSS/dFDbZ5BFPo/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-11-17 19:38:00 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:46984: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pmmSA9JDWuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.85.222.240
country_id: 6252001
description:
2025-11-17 19:38:08 dovecot_login authenticator failed for 64.85.222.240.reverse.socket.net [64.85.222.240]:46858: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-11-17 19:38:19 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:60507: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.159.43.35
country_id: 1814991
description:
2025-11-17 19:38:21 dovecot_login authenticator failed for ([180.159.43.35]) [180.159.43.35]:56466: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PBjPAdJDjNaxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 201.131.26.6
country_id: 3469034
description:
2025-11-17 19:38:42 H=(localhost) [201.131.26.6]:52553 F=<hello@localhost> rejected RCPT <b7LLaYMQwYoGq91@fottolegal.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.84.78.69
country_id: 630336
description:
2025-11-17 19:38:55 dovecot_login authenticator failed for (static20.byfly.gomel.by) [93.84.78.69]:51427: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.239.222
country_id: 3374766
description:
2025-11-17 19:39:09 dovecot_login authenticator failed for ([154.203.239.222]) [154.203.239.222]:60979: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2025-11-17 19:39:12 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:56884: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
country_id: 6252001
description:
2025-11-17 19:39:23 dovecot_login authenticator failed for 47-206-95-195.static.bhpk.fl.ip.frontiernet.net [47.206.95.195]:45158: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dHRgBdJDZoGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2025-11-17 19:40:00 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:51279: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-11-17 19:40:19 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47772: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 19:40:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<Hjg0CdJDMNZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-11-17 19:40:09 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:35852: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
country_id: 1835841
description:
2025-11-17 19:40:13 dovecot_login authenticator failed for ([222.236.155.146]) [222.236.155.146]:52610: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.35.62
country_id: 1643084
description:
[2025-11-17 19:40:39 -0300] info [webmaild] 182.9.35.62 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 19:40:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<ONBhCdJDPu1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2025-11-17 19:40:17 dovecot_login authenticator failed for broadband-109-173-39-103.ip.moscow.rt.ru [109.173.39.103]:42802: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tgntCNJDrp6xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 200.138.15.198
country_id: 3469034
description:
Nov 17 19:41:20 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=200.138.15.198, lip=200.150.207.122, TLS, session=<HRTRC9JDaqvIig/G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.143
country_id: 2186224
description:
2025-11-17 19:41:21 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:40032: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dl+ADNJDjMGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.234.114
country_id: 2017370
description:
2025-11-17 19:41:34 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:40505: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 19:41:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<2SDwDdJDhM0zTY0d>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:42:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QpdXDtJDxs2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 19:41:10 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60565: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 19:42:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<OEAcEdJDVqA7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-17 19:42:52 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:60294: 535 Incorrect authentication data (set_id=magda)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-11-17 19:42:12 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:60642: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 19:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<wNSzD9JDTkxo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s9IXENJDgNyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-11-17 19:42:46 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:59242: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.181
country_id: 2186224
description:
2025-11-17 19:42:59 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:45644: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-17 19:43:01 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:35558: 535 Incorrect authentication data (set_id=magda)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2025-11-17 19:42:24 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:35860: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-17 19:42:27 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=magda@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2025-11-17 19:43:21 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:29744: 535 Incorrect authentication data (set_id=janaina@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-17 19:43:37 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:39262: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-11-17 19:43:48 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:34362: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-17 19:43:30 dovecot_login authenticator failed for ([128.185.224.14]) [122.186.244.34]:51284: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-17 19:43:33 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:38406: 535 Incorrect authentication data (set_id=janaina)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:43:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PQm1E9JDeo+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 19:43:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<nz4+FNJDRJad5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.54.197.10
country_id: 1814991
description:
2025-11-17 19:43:46 dovecot_login authenticator failed for (10.197.54.123.broad.zm.ha.dynamic.163data.com.cn) [123.54.197.10]:35336: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fx8PGdJDnr2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
country_id: 1814991
description:
2025-11-17 19:44:21 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:43248: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-11-17 19:44:36 dovecot_login authenticator failed for ([41.59.228.160]) [41.59.228.160]:52236: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 123.58.213.20
country_id: 1819730
description:
Nov 17 19:44:40 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=123.58.213.20, lip=186.233.225.118, TLS, session=<Y6C6F9JDgq57OtUU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-17 19:44:43 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:52518: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 19:45:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<67TQGNJD/sql0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.225.32.239
country_id: 1562822
description:
2025-11-17 19:44:27 dovecot_login authenticator failed for ([14.225.32.239]) [14.225.32.239]:54780: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qI0/F9JD6LGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 19:45:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<BX2cGtJDShpo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kDDSGtJDUtGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 19:45:31 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:46310: 535 Incorrect authentication data (set_id=marcos@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 19:45:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<KvfzG9JDXqVA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 19:45:57 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:65472: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 19:46:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<0AKjHdJDzuUkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HYhhHtJDUOmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-17 19:46:58 dovecot_login authenticator failed for ([178.232.51.135]) [178.232.51.135]:53497: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 19:47:03 dovecot_login authenticator failed for (Y9wmJS) [91.92.243.111]:63735: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2025-11-17 19:47:20 dovecot_login authenticator failed for 93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:45840: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 19:47:29 dovecot_login authenticator failed for (hUhJAgY) [91.92.243.111]:49518: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 19:47:40 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51190: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iBD5IdJDRKKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.140.7.210
country_id: 2017370
description:
2025-11-17 19:47:51 dovecot_login authenticator failed for n7-c210.client.tomica.ru [78.140.7.210]:55316: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 19:47:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<PPY/I9JDFrNSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 19:48:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<WK1/I9JDTI4+PIOJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eAy/I9JD4rCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.244
country_id: 1814991
description:
2025-11-17 19:48:02 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:42118: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TSyIJdJDGsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-17 19:48:49 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:40503: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-17 19:49:03 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:48753: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-17 19:49:05 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:41318: 535 Incorrect authentication data (set_id=contato@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-11-17 19:48:16 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:57634: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.99
country_id: 6252001
description:
2025-11-17 19:48:16 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:44148: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 19:48:19 dovecot_login authenticator failed for (K5sF26) [91.92.243.111]:60354: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 19:48:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=</V7rJNJDpby317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.235.187.158
country_id: 1814991
description:
2025-11-17 19:48:31 dovecot_login authenticator failed for ([123.235.187.158]) [123.235.187.158]:45918: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.122
country_id: 3624060
description:
2025-11-17 19:48:35 dovecot_login authenticator failed for ([186.177.88.122]) [186.177.88.122]:53563: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-17 19:48:54 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:58256: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-17 19:49:21 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:54714: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-17 19:49:22 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39814: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 19:49:27 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:40098: 535 Incorrect authentication data (set_id=derly@educacionalevangelico.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.181.191.152
country_id: 2017370
description:
2025-11-17 19:49:30 dovecot_login authenticator failed for (94x181x191x152.static-business.penza.ertelecom.ru) [94.181.191.152]:45748: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KHchKdJD2uOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 19:49:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<9z1zKdJDtJkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.243.111
country_id: 6252001
description:
2025-11-17 19:49:09 dovecot_login authenticator failed for (ltPbA1f3jU) [91.92.243.111]:62494: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:50:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MN+8LNJDYI+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.23.53.80
country_id: 6252001
description:
2025-11-17 19:50:38 dovecot_login authenticator failed for (static.38.23.53.80.macminivault.com) [38.23.53.80]:54439: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x4iALtJDIKSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2025-11-17 19:50:18 dovecot_login authenticator failed for ([125.138.166.217]) [125.138.166.217]:49392: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 19:51:22 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60943: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xnRMMNJDYq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 19:51:38 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:47654: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.32.14
country_id: 1562822
description:
2025-11-17 19:52:30 dovecot_login authenticator failed for (static.vnpt.vn) [113.161.32.14]:59083: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 19:52:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<qcqzM9JDBM2d5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-17 19:52:51 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:60840: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-11-17 19:53:01 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:37042: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 19:53:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<T+bCNdJDvLcnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 19:52:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<06w4MtJDQJOvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.234.68.221
country_id: 1814991
description:
2025-11-17 19:53:00 dovecot_login authenticator failed for ([116.234.68.221]) [116.234.68.221]:63152: 535 Incorrect authentication data (set_id=administrativo2@cleservicosindustriais.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<v03iM9JD7M6xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UyQ3OdJD5IqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 19:54:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<ypNLOdJDhOKdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2025-11-17 19:53:13 dovecot_login authenticator failed for ([14.48.112.8]) [14.48.112.8]:4778: 535 Incorrect authentication data (set_id=administrativo2)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xSR3N9JD1uuxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RqUDO9JDQJaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 19:54:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<daFUPNJDiJRns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 19:55:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<wD1EPdJD7riGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 19:55:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<i16DPdJDaJknaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-17 19:55:31 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:54944: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 19:55:33 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:39410: 535 Incorrect authentication data (set_id=louvoreterno@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mjiRPtJD/LWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 19:55:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=</gTmPtJD1pBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-11-17 19:55:11 dovecot_login authenticator failed for ([49.207.9.39]) [49.207.9.39]:55365: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FlEuQtJDxNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 19:56:38 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:43502: 535 Incorrect authentication data (set_id=administrativo@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xyb6Q9JDIN+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.224.249
country_id: 290557
description:
2025-11-17 19:58:05 dovecot_login authenticator failed for ([5.30.224.249]) [5.30.224.249]:52903: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 19:57:07 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:42528: 535 Incorrect authentication data (set_id=herbert.oliveira@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 19:57:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<VJKQRNJDIMF57bKF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xzzCRdJDUO2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 19:57:39 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56415: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 88.119.213.7
country_id: 597427
description:
Nov 17 19:57:54 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=88.119.213.7, lip=200.150.196.245, TLS, session=<oMIARtJDzJ5Yd9UH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2025-11-17 19:58:19 dovecot_login authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:60126: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.23.53.80
country_id: 6252001
description:
2025-11-17 19:58:19 dovecot_login authenticator failed for (static.38.23.53.80.macminivault.com) [38.23.53.80]:51378: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.53
country_id: 6252001
description:
2025-11-17 19:58:33 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:52838: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.6.35.60
country_id: 3469034
description:
[2025-11-17 19:58:43 -0300] info [webmaild] 189.6.35.60 - diretoria@holdingsantahelena.agr.br "GET /cpsess2699940485/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.80
country_id: 798544
description:
2025-11-17 19:59:05 dovecot_plain authenticator failed for ([185.241.208.80]) [185.241.208.80]:50310: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2025-11-17 19:58:25 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:39823: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2025-11-17 19:58:32 dovecot_login authenticator failed for ([175.203.199.118]) [175.203.199.118]:22108: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7ldRSdJDQpqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-17 19:59:04 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:42650: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-17 19:59:54 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:44772: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eJ+xTtJDoMexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-11-17 19:59:21 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:54494: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-17 19:59:37 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:59900: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.241.208.80
country_id: 798544
description:
[2025-11-17 19:59:33 -0300] info [cpaneld] 185.241.208.80 - lixadoracuritiba "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadoracuritiba (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 19:59:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<KoZvTdJDRuql0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-17 19:59:48 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:39834: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-11-17 19:59:18 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:47214: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 19:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aD3iTNJDArqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.51.50
country_id: 953987
description:
2025-11-17 20:00:48 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:56566: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.66.12.197
country_id: 1269750
description:
2025-11-17 20:00:49 dovecot_login authenticator failed for ([103.66.12.197]) [103.66.12.197]:55015: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-17 20:00:09 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:45532: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-11-17 20:00:28 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:34320: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:00:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vst/UNJDvNyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-17 20:00:38 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:56564: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.28
country_id: 1269750
description:
Nov 17 20:00:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida>, method=PLAIN, rip=103.104.127.28, lip=200.150.196.245, TLS, session=<HMEnUNJDTcxnaH8c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2025-11-17 20:01:07 dovecot_login authenticator failed for ([1.30.20.238]) [1.30.20.238]:55294: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QHIHVNJDaIaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-11-17 20:01:41 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:51583: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 20:02:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<n+/DVdJDpuKkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:01:18 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:48334: 535 Incorrect authentication data (set_id=elton.alves@institutoeduc.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 20:01:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<vMeeU9JDBuwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 20:01:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@oabsjp.org.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=</pwLVNJDlthn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 17 20:01:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<RT3UVNJD7OMkMrGr>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.6.35.60
country_id: 3469034
description:
[2025-11-17 20:01:59 -0300] info [webmaild] 189.6.35.60 - diretoria@holdingsantahelena.agr.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.182.187
country_id: 1814991
description:
2025-11-17 20:02:24 dovecot_login authenticator failed for ([111.23.182.187]) [111.23.182.187]:48315: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-17 20:02:29 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:48814: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-17 20:02:44 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:38845: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.252.146
country_id: 1269750
description:
2025-11-17 20:02:47 dovecot_login authenticator failed for ([106.222.252.146]) [106.222.252.146]:49305: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8uRvWdJD4rSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-17 20:03:02 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:56110: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.44.92
country_id: 1562822
description:
2025-11-17 20:02:23 dovecot_login authenticator failed for ([14.161.44.92]) [14.161.44.92]:52840: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:02:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p4unV9JDmKSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 17 20:02:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<HsSDV9JDKsAO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-11-17 20:02:38 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:43550: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.133.98
country_id: 1814991
description:
2025-11-17 20:02:38 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:59350: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.167.85
country_id: 6252001
description:
2025-11-17 20:03:00 dovecot_login authenticator failed for 24.115.167.85.res-cmts.mlf.ptd.net [24.115.167.85]:43877: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-11-17 20:03:46 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:38122: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 20:03:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<h8pPXNJDwoKUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-17 20:04:05 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:59694: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-17 20:03:09 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:37595: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-17 20:03:30 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:41708: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<90Y7W9JD2MOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.38
country_id: 1668284
description:
2025-11-17 20:03:26 dovecot_login authenticator failed for 221-120-4-38.emome-ip.hinet.net [221.120.4.38]:37249: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.106.59.245
country_id: 1835841
description:
2025-11-17 20:03:46 dovecot_login authenticator failed for ([183.106.59.245]) [183.106.59.245]:44919: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.109.208
country_id: 1819730
description:
2025-11-17 20:04:50 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:10948: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 20:05:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<cAlwYNJDytR2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.205.184.169
country_id: 146669
description:
2025-11-17 20:04:18 dovecot_login authenticator failed for ([185.205.184.169]) [185.205.184.169]:59286: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.98.76
country_id: 1880251
description:
2025-11-17 20:04:24 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:49274: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 20:04:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<gl2OXtJDwso+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.83.68.49
country_id: 2921044
description:
2025-11-17 20:04:30 dovecot_login authenticator failed for ([37.83.68.49]) [37.83.68.49]:59030: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-17 20:04:41 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:52100: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 20:04:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<2G+AXtJDhNIv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2JnAXtJDMuKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 20:04:32 dovecot_login authenticator failed for (inovasite.com) [111.122.211.212]:9360: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:05:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FABiYtJDOIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 20:05:35 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51515: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 20:05:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@f5assessoria.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<J1nFYtJDnNln76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:05:58 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:50294: 535 Incorrect authentication data (set_id=adriana@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.220.207
country_id: 2017370
description:
2025-11-17 20:05:26 dovecot_login authenticator failed for ([95.66.220.207]) [95.66.220.207]:5039: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 20:05:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<n3z7YdJDeLx9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-11-17 20:05:41 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:55240: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WUUeZNJDjJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-17 20:05:16 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:58450: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-11-17 20:06:24 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:57744: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2WftZdJDEKexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 20:06:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<mz77ZdJD+qmYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 20:06:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<lylKZtJDgKLBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.173.227
country_id: 2017370
description:
2025-11-17 20:06:45 dovecot_login authenticator failed for ([109.202.173.227]) [109.202.173.227]:37760: 535 Incorrect authentication data (set_id=bianca.user.sales@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-17 20:06:13 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:33481: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:06:13 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:35972: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2025-11-17 20:07:08 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:58832: 535 Incorrect authentication data (set_id=paulo.user.sales@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-11-17 20:07:10 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:50696: 535 Incorrect authentication data (set_id=bianca.user.sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 20:07:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<Jpu0aNJDeMyiAOAm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VQ17adJD7saxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:07:32 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:50682: 535 Incorrect authentication data (set_id=andre@tiajo.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.223
country_id: 1668284
description:
2025-11-17 20:07:42 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:53381: 535 Incorrect authentication data (set_id=paulo.user.sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 20:07:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<GoRWatJD8NSP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 20:07:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<6x3pZ9JDHK1zR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-17 20:07:20 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:50206: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.91.215.100
country_id: 1814991
description:
2025-11-17 20:07:34 dovecot_login authenticator failed for ([106.91.215.100]) [106.91.215.100]:52757: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-11-17 20:07:37 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:49236: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 20:07:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<YN62adJDVN5rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:08:15 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:34570: 535 Incorrect authentication data (set_id=engenharia3@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 20:08:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<NxJabNJDDumB4kCN>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HfEZbdJDNOqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 20:08:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<OQD7bNJDwNln9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FRfZbtJD4ouxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 20:08:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<gZKXa9JDCtevfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2025-11-17 20:09:36 dovecot_login authenticator failed for ([125.138.166.217]) [125.138.166.217]:48372: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 20:09:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<GL/zcNJDxodCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:09:12 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:59274: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.152
country_id: 6252001
description:
2025-11-17 20:09:12 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:49561: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.160.125.236
country_id: 2921044
description:
[2025-11-17 20:09:31 -0300] info [cpaneld] 217.160.125.236 - cartoriopinheirinhocombr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cartoriopinheirinhocombr (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QAapcNJDJJyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-17 20:09:35 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:44064: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.80.238.162
country_id: 1814991
description:
2025-11-17 20:09:29 dovecot_login authenticator failed for ([218.80.238.162]) [218.80.238.162]:39247: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 20:09:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<pHz1cdJDxKMtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-17 20:10:00 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:49010: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-11-17 20:09:59 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:43550: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 20:10:12 dovecot_login authenticator failed for (User) [177.74.174.120]:55419: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 20:10:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<96EKc9JDguZ3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 20:10:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<qfcdc9JDKOskMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.250
country_id: 2186224
description:
2025-11-17 20:10:32 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:42484: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7Xg2dNJDqruxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 20:10:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<zbJ+dNJDToUv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 20:10:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<wtoAddJDUObSATzz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 20:10:33 dovecot_login authenticator failed for (numesolucoes.com.br) [112.122.54.54]:7983: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 20:10:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<BwdodNJDqpV9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.80
country_id: 798544
description:
2025-11-17 20:10:43 dovecot_plain authenticator failed for ([185.241.208.80]) [185.241.208.80]:51757: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:10:57 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:33218: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-17 20:11:12 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:35908: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 20:11:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<6Vp/dtJDEIXSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:11:22 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:37650: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</FXSd9JDSNyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 20:11:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<zmgqedJDsrNns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bK2dedJDCuexV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.241.208.80
country_id: 798544
description:
[2025-11-17 20:11:06 -0300] info [cpaneld] 185.241.208.80 - louvoreterno "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user louvoreterno (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 20:12:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<yl+qedJDUrGl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-17 20:11:25 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:36157: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 20:12:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<AD4HetJDZqeiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.166.134.9
country_id: 1814991
description:
2025-11-17 20:12:24 dovecot_login authenticator failed for (9.134.166.220.broad.dy.sc.dynamic.163data.com.cn) [220.166.134.9]:44308: 535 Incorrect authentication data (set_id=abuse@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:12:31 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:46586: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 17 20:12:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<0RUketJDIugI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.252.119
country_id: 2017370
description:
2025-11-17 20:12:21 dovecot_login authenticator failed for ([62.140.252.119]) [62.140.252.119]:59278: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.101.36.206
country_id: 1814991
description:
Nov 17 20:12:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<1QPOetJDvv8vZSTO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yGxge9JDaoaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.246
country_id: 1668284
description:
2025-11-17 20:12:46 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:54626: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-11-17 20:13:00 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:60634: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:13:32 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:45332: 535 Incorrect authentication data (set_id=jonasvargas@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:13:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fbn9ftJDSKSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 20:13:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<xq9YgNJD5I+B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-17 20:13:19 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:43014: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-17 20:13:20 dovecot_login authenticator failed for ([23.30.11.253]) [23.30.11.253]:50764: 535 Incorrect authentication data (set_id=comercial.user.sales@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.59.238
country_id: 2017370
description:
2025-11-17 20:13:20 dovecot_login authenticator failed for (5.189.59.238-FTTB.planeta.tc) [5.189.59.238]:55042: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 20:13:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<pLrwf9JDbMYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.59.206.224
country_id: 1814991
description:
2025-11-17 20:13:57 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:60908: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.104.184
country_id: 3469034
description:
Nov 17 20:14:15 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida@1075fm.com.br>, method=PLAIN, rip=191.240.104.184, lip=200.150.196.245, TLS, session=<Px9xgNJDUYa/8Gi4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 20:14:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<dj9rgtJDfsBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-17 20:14:34 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:39608: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.31.61
country_id: 6252001
description:
2025-11-17 20:14:27 dovecot_login authenticator failed for ([72.250.31.61]) [72.250.31.61]:42546: 535 Incorrect authentication data (set_id=comercial.user.sales)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6jiIgtJDqMKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 20:14:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<w6FegtJDMocrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 20:14:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<tmhMg9JDWsfBl4nP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:15:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dv5ahNJDWM2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 20:14:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<wCdYgdJDVutSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-17 20:14:15 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:39872: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2025-11-17 20:14:19 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:38444: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-17 20:16:04 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:33342: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 20:15:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<TVv8hNJDvMxAF/Qn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5OoZhtJD6N+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 20:15:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<OeQ8htJDxNPSchJs>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 20:15:37 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.8.98.242
country_id: 6252001
description:
2025-11-17 20:15:42 dovecot_login authenticator failed for ([127.0.0.1]) [99.8.98.242]:54752: 535 Incorrect authentication data (set_id=info@siaoimoveis.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 20:15:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<dVH1htJD4KCB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-11-17 20:15:28 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:46262: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-11-17 20:15:44 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:57965: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 20:15:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<m2nKhtJDsr2kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-11-17 20:16:02 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:53874: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:16:02 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:40376: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 20:16:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<HG+jiNJDktwvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.174.216
country_id: 2017370
description:
2025-11-17 20:16:18 dovecot_login authenticator failed for ([46.163.174.216]) [46.163.174.216]:57926: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-11-17 20:16:21 dovecot_login authenticator failed for ([175.156.80.166]) [175.156.80.166]:43374: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 20:16:29 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63549: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 20:16:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<Jn4biNJDpKVrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2025-11-17 20:16:32 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:58388: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 20:16:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<OQbWidJDMupn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-17 20:16:43 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:40645: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-17 20:17:00 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:59502: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 20:16:21 dovecot_login authenticator failed for (User) [177.74.174.120]:57971: 535 Incorrect authentication data (set_id=souza@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</navidJDCIixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2025-11-17 20:16:33 dovecot_login authenticator failed for ([58.34.174.90]) [58.34.174.90]:55117: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 20:16:38 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess9146545787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 17 20:16:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<tVOHidJDPLkv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 20:16:31 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51780: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 20:17:06 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:57946: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.83
country_id: 2750405
description:
2025-11-17 20:17:42 dovecot_login authenticator failed for (ADMIN) [84.54.33.83]:50184: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yHMSj9JDArSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 20:18:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<0p4ej9JDaNpns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-17 20:17:18 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:32992: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xRNAjdJDGKaxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 20:17:38 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess9146545787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.118
country_id: 1814991
description:
2025-11-17 20:18:12 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:51814: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:18:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T5HhkNJD3sKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.99
country_id: 1814991
description:
2025-11-17 20:18:40 dovecot_login authenticator failed for ([111.26.100.98]) [111.26.100.99]:54304: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 20:19:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<fmXAktJD6NRo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-11-17 20:18:26 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:34622: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 20:18:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<A2+9kNJDTL8tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.74.74.44
country_id: 1814991
description:
2025-11-17 20:18:55 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:44902: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.50.23.72
country_id: 1831722
description:
[2025-11-17 20:18:26 -0300] info [cpaneld] 154.50.23.72 - deproico "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-17 20:18:40 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:59931: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 20:18:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<yMQTkNJDTNaElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.240.222.64
country_id: 1814991
description:
2025-11-17 20:18:32 dovecot_login authenticator failed for ([43.240.222.64]) [43.240.222.64]:56579: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 20:18:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<A8gCktJD1sqkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 20:18:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<2I9CktJDNMjBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.141.56.185
country_id: 1814991
description:
2025-11-17 20:19:48 dovecot_login authenticator failed for ([211.141.56.184]) [211.141.56.185]:56204: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 20:20:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<oHUPltJDsIyYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2025-11-17 20:19:14 dovecot_login authenticator failed for ([123.163.52.74]) [123.163.52.74]:42266: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4mlvlNJDdN+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 20:19:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<z9M4lNJDCIF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 20:19:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<q7gKk9JDBp1CYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-17 20:19:30 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:34876: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 20:19:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51482: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-11-17 20:20:01 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:57815: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.40.231
country_id: 2017370
description:
2025-11-17 20:19:07 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:41009: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.101.36.206
country_id: 1814991
description:
Nov 17 20:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<Peydk9JDwhIvZSTO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-17 20:20:00 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:39302: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.171
country_id: 1814991
description:
2025-11-17 20:20:00 dovecot_login authenticator failed for ([111.57.17.171]) [111.57.17.171]:53462: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MMIFmNJDSomxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.15
country_id: 2186224
description:
2025-11-17 20:20:53 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:41152: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.62
country_id: 3469034
description:
2025-11-17 20:20:56 dovecot_login authenticator failed for (177-172-15-62.user.vivozap.com.br) [177.172.15.62]:24714: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-11-17 20:20:58 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:52910: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.74.67
country_id: 1835841
description:
2025-11-17 20:20:18 dovecot_login authenticator failed for ([121.147.74.67]) [121.147.74.67]:33110: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-17 20:20:38 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12006: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 20:20:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<XZmwmNJDvpKkXLll>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:21:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2Q7RmdJD6puxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.41.213
country_id: 2017370
description:
2025-11-17 20:21:24 dovecot_login authenticator failed for ([78.36.41.213]) [78.36.41.213]:49094: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 20:21:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<sSiNm9JDWM2d5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 20:21:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<D0G3nNJDuqV3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.230.10.63
country_id: 2017370
description:
2025-11-17 20:22:05 dovecot_login authenticator failed for ([91.230.10.63]) [91.230.10.63]:51966: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2025-11-17 20:21:09 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:51562: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 20:21:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<0C17nNJDbMgvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 20:21:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<ViiFnNJDhN9n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-17 20:21:09 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:37521: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 20:21:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<amqum9JDXKVns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+wyOm9JDsKmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 20:21:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<wbu5m9JDaCyKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-17 20:21:47 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:38493: 535 Incorrect authentication data (set_id=contato@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 17 20:21:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<f67enNJDWrwI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 20:22:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<UVFVntJDCLmYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 20:22:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<iZSTntJDlM0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 20:22:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<IyKsntJDgBRo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+dQln9JDQMixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 20:22:45 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:56986: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7N2BpNJD4IGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-17 20:23:19 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:42637: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:23:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6KHCotJDMuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.38
country_id: 1668284
description:
2025-11-17 20:23:41 dovecot_login authenticator failed for 221-120-4-38.emome-ip.hinet.net [221.120.4.38]:38617: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 20:23:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<AJIbo9JDhMqUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ez9RptJDXIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2025-11-17 20:24:49 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:39263: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.90.151
country_id: 3865483
description:
2025-11-17 20:25:00 dovecot_plain authenticator failed for (ectmymkbh2qzgeuiam620) [190.173.90.151]:55864: 535 Incorrect authentication data (set_id=webmaillogout.cgiassessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.0.144
country_id: 2077456
description:
2025-11-17 20:24:19 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:36292: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2025-11-17 20:24:23 dovecot_login authenticator failed for ([36.135.107.57]) [36.135.107.57]:33492: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 20:24:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<sImIptJDqNFAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2025-11-17 20:24:47 dovecot_login authenticator failed for ([78.197.6.173]) [78.197.6.173]:54069: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 20:25:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<1hsJqNJDzKRw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-17 20:24:08 dovecot_login authenticator failed for ([90.164.107.3]) [90.164.107.3]:40220: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 17 20:25:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<9wXeqNJDWOuqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 20:25:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<qY9BqdJDHqtCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vLDhqdJDjKmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-11-17 20:25:36 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:58925: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 20:25:13 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59637: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-17 20:25:52 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:53188: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-17 20:25:57 dovecot_login authenticator failed for ([61.95.192.158]) [61.95.192.158]:44454: 535 Incorrect authentication data (set_id=andre.nascimento.sales@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-17 20:26:05 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:46436: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 20:25:11 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:51675: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 20:26:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<cjP8q9JD8pk7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-11-17 20:26:23 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:51831: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-17 20:26:49 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:42025: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d+U9r9JDwtGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-17 20:26:11 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:33169: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.14.58
country_id: 1814991
description:
2025-11-17 20:26:15 dovecot_login authenticator failed for ([210.12.14.58]) [210.12.14.58]:56154: 535 Incorrect authentication data (set_id=andre.nascimento.sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-17 20:26:16 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:40808: 535 Incorrect authentication data (set_id=info.user.sales@lixadoracuritiba.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H9pxrdJDWsexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-17 20:27:01 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:46729: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 20:26:21 H=(195.3.134.135) [179.0.178.53]:55663 F=<erictremblaysi@hotmail.com> rejected RCPT <leticia@globalmedica.com.br>: Nenhuma pessoa no endereço.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 20:26:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<IljnrNJD6LZSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-11-17 20:26:48 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:46462: 535 Incorrect authentication data (set_id=info.user.sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 20:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<YjQXr9JDjPCKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3gANsdJDHt2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 20:27:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<3rANsdJD5NE+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-17 20:27:43 dovecot_login authenticator failed for ([187.11.252.160]) [187.11.252.160]:54442: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-17 20:28:00 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:52897: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 20:27:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<ap5xr9JDzsql0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-17 20:27:09 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:48068: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 17 20:27:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<maTHr9JDPNAIiXsk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.107
country_id: 6252001
description:
[2025-11-17 20:28:40 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2025-11-17 20:28:54 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:35095: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 20:28:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<5ioSttJD+oAkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 20:29:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<X7Q/ttJDvtctPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2025-11-17 20:28:30 dovecot_login authenticator failed for ([111.38.136.211]) [111.38.136.211]:48763: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tHWctNJDsI+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 20:28:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<Sy5DtNJDeOKUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-11-17 20:28:31 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:41234: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 20:28:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=</iLatNJDbNFA44h6>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 20:28:42 H=(195.3.134.135) [179.0.178.53]:57334 F=<erictremblaysi@hotmail.com> rejected RCPT <paulo@globalmedica.com.br>: Nenhuma pessoa no endereço.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-11-17 20:28:10 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:60417: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-11-17 20:28:22 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:44588: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 17 20:29:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<V2Pnt9JDft2WXx+e>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<y3gpuNJDcK+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 20:29:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<sHP6uNJDQo52wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x4b8udJDfruxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 20:30:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<QlwputJDELUtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 17 20:29:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<L1C8ttJDPNovT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 20:29:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<QYf0t9JDqJc+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OhPAu9JD3s2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2025-11-17 20:30:33 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:45062: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-11-17 20:30:39 dovecot_login authenticator failed for ([197.231.202.201]) [197.231.202.201]:47541: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-17 20:30:47 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:58416: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 20:30:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<PXrYu9JD7Lmd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.101.73
country_id: 1835841
description:
2025-11-17 20:30:38 dovecot_login authenticator failed for ([121.162.101.73]) [121.162.101.73]:35224: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-17 20:30:41 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:43498: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2025-11-17 20:30:52 dovecot_login authenticator failed for 91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:47529: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 20:30:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<R9DOutJDhI1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 20:31:01 dovecot_login authenticator failed for (esquadriasalupar.com.br) [61.50.119.110]:54844: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 20:30:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@primiciapersianas.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<hjhCutJDLN9n76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-11-17 20:30:56 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:59055: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-17 20:31:01 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:41308: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-17 20:31:13 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:36110: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 20:31:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<W8U/vtJDPJArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 20:31:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<NfROvtJDLOIrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-17 20:31:26 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:56722: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.234.114
country_id: 2017370
description:
2025-11-17 20:31:24 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:60767: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-17 20:31:26 dovecot_login authenticator failed for (esquadriasalupar.com.br) [61.50.119.110]:59580: 535 Incorrect authentication data (set_id=test@esquadriasalupar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 20:31:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<5XfwvtJDbJWnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.133
country_id: 1835841
description:
2025-11-17 20:31:44 dovecot_login authenticator failed for ([121.131.220.133]) [121.131.220.133]:38548: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.10.38.108
country_id: 1814991
description:
2025-11-17 20:31:32 dovecot_login authenticator failed for ([175.10.38.108]) [175.10.38.108]:42564: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2025-11-17 20:31:42 dovecot_login authenticator failed for ([222.99.52.202]) [222.99.52.202]:37589: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-17 20:31:10 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:53555: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-17 20:31:19 dovecot_login authenticator failed for ([182.78.79.134]) [182.78.79.134]:47692: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9xxVv9JD7uSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-17 20:32:21 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:35614: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-17 20:32:32 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:55299: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9UftwtJDapaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 20:32:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=</ngrw9JDZKxxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oBO1xNJD2qGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
country_id: 1562822
description:
2025-11-17 20:32:13 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:15331: 535 Incorrect authentication data (set_id=michael@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-17 20:32:20 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48088: 535 Incorrect authentication data (set_id=michael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-17 20:33:07 dovecot_login authenticator failed for ([36.135.100.48]) [36.135.100.48]:43522: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 17 20:33:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<7sCCxdJDvqVbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.144.149.177
country_id: 1835841
description:
2025-11-17 20:33:31 dovecot_login authenticator failed for ([218.144.149.177]) [218.144.149.177]:60184: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<W8p2xtJDnLSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.96
country_id: 1814991
description:
2025-11-17 20:33:44 dovecot_login authenticator failed for ([222.68.153.96]) [222.68.153.96]:34769: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 20:33:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<zhEpx9JDoL5vAEul>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.160.125.236
country_id: 2921044
description:
[2025-11-17 20:34:26 -0300] info [cpaneld] 217.160.125.236 - inovasite "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inovasite (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KsoVytJDkM2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-17 20:35:14 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:37730: 535 Incorrect authentication data (set_id=financeiro@kglsolucoes.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 20:36:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<LkZnz9JD8L9ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 20:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<XUpBzdJD/I+317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-17 20:35:35 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:41338: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Odpz9JDcpCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 20:35:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<uDfezNJD0vVxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 17 20:35:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<cMQezdJDPuSkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 20:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<MnY9zdJDMaN3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-11-17 20:35:31 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:42006: 535 Incorrect authentication data (set_id=kgl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-17 20:35:15 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:40818: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 20:35:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<7CGdzNJDcOgnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 20:35:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<8oDTzNJD+OA+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-11-17 20:35:20 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:53270: 535 Incorrect authentication data (set_id=kgl@kglsolucoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-11-17 20:35:28 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:37835: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</jKlzdJDdOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-17 20:36:18 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:58290: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 20:36:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<3yDC0NJDBNSdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.48.22.251
country_id: 2017370
description:
2025-11-17 20:36:30 dovecot_login authenticator failed for (46.48.22.251-FTTB.planeta.tc) [46.48.22.251]:45406: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OZwy0dJDYJ6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 20:36:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<vuOm0dJDksyB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
country_id: 1814991
description:
2025-11-17 20:37:23 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:36408: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-17 20:37:24 -0300] info [cpaneld] 119.28.107.251 - vidaenge "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-17 20:37:31 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:50138: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 20:37:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fernandotonet.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<PUPD1dJD1OBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 20:37:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<N0Q209JDaHuvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 20:37:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<Nbh71NJDzr8naoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-17 20:37:29 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:3417: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:37:34 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lITo1NJDiL2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-17 20:37:39 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:50668: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-17 20:37:40 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:58442: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 20:37:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<oK+71dJDgtiGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 20:37:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<cNfD1dJDJp2kXF7M>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TUNi2NJDvNexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 20:39:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<Syrw2dJDSo2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 20:38:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<wtJM2NJDOZl3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 20:38:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<lX6w2NJDgopA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-11-17 20:38:44 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:59874: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 20:38:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<eX0G2dJDCs5SczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:39:04 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NeVC2tJDeOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-11-17 20:38:06 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:44338: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 17 20:38:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<XSjg1tJD7I56kIMZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 17 20:39:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0zY/29JDpuhvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 20:39:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<s55Z29JDiIoXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<V4/y29JD4IixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-17 20:40:24 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:59310: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bU+C39JDuN6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2025-11-17 20:40:50 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:63620: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-17 20:41:04 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:36571: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2025-11-17 20:41:41 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:58820: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.79.146
country_id: 1835841
description:
2025-11-17 20:41:53 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:57056: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Bsbh5NJD4pyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 20:41:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<qxgP4tJDzqGP9IUv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:41:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i8Ah49JDno2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 20:42:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52152: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 17 20:42:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<n8mK5dJDFpp57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 20:42:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<4McN5tJDOJel0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YD2x5tJD7qixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 20:42:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<D6z45tJD6IkrZDwA>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dihB6tJDDMmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-17 20:43:59 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:60241: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.245.87
country_id: 2510769
description:
2025-11-17 20:43:59 dovecot_login authenticator failed for (h-91-126-245-87.wholesale.adamo.es) [91.126.245.87]:44952: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.181
country_id: 2186224
description:
2025-11-17 20:44:01 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:44182: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-11-17 20:43:10 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:37270: 535 Incorrect authentication data (set_id=contato@compensadosparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.79.146
country_id: 1835841
description:
2025-11-17 20:43:12 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:47051: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-17 20:43:24 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:53838: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-17 20:43:33 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:55959: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.243.95
country_id: 1835841
description:
2025-11-17 20:43:51 dovecot_login authenticator failed for ([175.207.243.95]) [175.207.243.95]:39453: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 17 20:44:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<pk7469JD/tGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 17 20:44:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<+lfv7NJD/jQkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-17 20:44:27 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:54535: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 20:44:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<GSxw7tJD6qaUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E5ek79JDmIaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 20:44:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<6gJW7NJDEIMv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-17 20:44:16 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:43988: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 20:44:28 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51187: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<83rZ7dJDKumxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 20:45:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<tWmo8NJDuo6YNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uLJh8dJDhJOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-11-17 20:45:59 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:54409: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-17 20:46:12 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:56905: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.186.93
country_id: 1562822
description:
2025-11-17 20:46:29 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.186.93]:10975: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DL749NJDPLOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.213.111
country_id: 2017370
description:
2025-11-17 20:46:45 dovecot_login authenticator failed for ([78.81.213.111]) [78.81.213.111]:34388: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 20:46:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<Nmor9tJDnNp9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2025-11-17 20:47:12 dovecot_login authenticator failed for ([178.178.222.58]) [178.178.222.58]:40778: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.40.247
country_id: 6252001
description:
2025-11-17 20:47:28 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:35172: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hg6K+NJDPNKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-17 20:47:46 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:35125: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-17 20:48:03 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:52896: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 20:47:11 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62862: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-17 20:47:39 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:38905: 535 Incorrect authentication data (set_id=rsimoesdiretoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-17 20:47:50 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:34590: 535 Incorrect authentication data (set_id=daniela@acmesolar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.168.70
country_id: 6252001
description:
2025-11-17 20:47:56 dovecot_login authenticator failed for c-73-21-168-70.hsd1.fl.comcast.net [73.21.168.70]:57312: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rBVa+tJDyN6xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:48:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VJ4p/NJD7oOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 20:48:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<Dd4C/dJDhIGiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-11-17 20:48:15 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:50667: 535 Incorrect authentication data (set_id=daniela)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 17 20:48:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<+o3g+9JDrLAO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-17 20:49:58 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:64656: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-17 20:49:14 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:58315: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-17 20:49:16 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:55690: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-17 20:49:23 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:53065: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-17 20:49:26 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:19917: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.115.87.186
country_id: 2017370
description:
2025-11-17 20:49:47 dovecot_login authenticator failed for ([217.115.87.186]) [217.115.87.186]:62031: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.248.6
country_id: 3469034
description:
Nov 17 20:49:48 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse>, method=PLAIN, rip=191.53.248.6, lip=200.150.196.245, TLS, session=<7Zek/9JDE8a/NfgG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 20:49:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<XCDlANNDGrlCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-11-17 20:49:09 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:34451: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XES6/9JDgJyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.55.3.238
country_id: 2017370
description:
2025-11-17 20:50:08 dovecot_login authenticator failed for ([92.55.3.238]) [92.55.3.238]:26934: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 20:50:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<6egSBNND+oSB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 20:50:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<eNSFAtNDusRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-17 20:50:47 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:49224: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-17 20:51:04 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:32914: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2025-11-17 20:50:11 dovecot_login authenticator failed for ([87.229.254.207]) [87.229.254.207]:49242: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-11-17 20:50:12 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:54812: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 17 20:50:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<MvREAtNDBuFzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 20:50:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<D54iAtND3Jcv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2025-11-17 20:50:23 dovecot_login authenticator failed for ([178.178.194.151]) [178.178.194.151]:35586: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 20:51:02 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:62619: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<n88YBdND3smxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2025-11-17 20:51:03 dovecot_login authenticator failed for ([183.56.179.201]) [183.56.179.201]:24430: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-17 20:50:13 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:2000: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kZxCA9NDDrqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-11-17 20:50:43 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:49392: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 20:51:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<NcD8BdNDoLZrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-11-17 20:51:22 dovecot_login authenticator failed for ([87.117.32.22]) [87.117.32.22]:59394: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9k7fBtND8tuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-17 20:51:54 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:58265: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-11-17 20:51:59 dovecot_login authenticator failed for (static.90.254.104.190.cps.com.ar) [190.104.254.91]:33827: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 20:51:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<RxEABtNDnN2nR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.75.197.174
country_id: 1269750
description:
Nov 17 20:51:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@cartoriopinheirinho.com.br>, method=PLAIN, rip=182.75.197.174, lip=200.150.196.245, TLS, session=<3jscB9NDfIO2S8Wu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 20:52:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<FyuFCNNDmLN9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-17 20:52:07 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:42348: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 17 20:52:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<ZafWCNNDUtSP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 20:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<iOq9CtNDANHSATzz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 20:52:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<jN/dCdNDPrktPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-11-17 20:52:29 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39474: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.18.49.14
country_id: 1814991
description:
Nov 17 20:52:42 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=121.18.49.14, lip=200.150.196.245, TLS, session=<6cghCtND7Et5EjEO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.212.198.51
country_id: 1814991
description:
2025-11-17 20:52:56 dovecot_login authenticator failed for ([14.212.198.51]) [14.212.198.51]:39030: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-17 20:52:13 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:47170: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 20:52:13 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61944: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.24.210.58
country_id: 6252001
description:
2025-11-17 20:52:26 dovecot_login authenticator failed for 72-24-210-58.cpe.sparklight.net [72.24.210.58]:40343: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Od5sCtNDsoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.164.126.21
country_id: 1269750
description:
2025-11-17 20:52:57 dovecot_login authenticator failed for (abts-tn-dynamic-021.126.164.122.airtelbroadband.in) [122.164.126.21]:60837: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 20:52:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<0upgCdNDxI/Bl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-11-17 20:52:22 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:55894: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.101.73
country_id: 1835841
description:
2025-11-17 20:52:41 dovecot_login authenticator failed for ([121.162.101.73]) [121.162.101.73]:57848: 535 Incorrect authentication data (set_id=comercial@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 20:53:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<DGIPDdNDDN7SchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 20:53:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<weUGDdNDar6vfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 20:53:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<cJkVDtNDtrGiAOAm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wXHID9NDHLOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 20:53:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<AaGSDtNDRIYkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 20:53:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<xEoTD9NDTrSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 20:54:01 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54198: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 20:53:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<ZhqIDNNDLuJns7yS>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5SMPDtNDaKCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 20:53:33 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64248: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 17 20:53:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<euR8DtNDVr5AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.225.134.13
country_id: 1835841
description:
2025-11-17 20:53:42 dovecot_login authenticator failed for ([182.225.134.13]) [182.225.134.13]:53942: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-11-17 20:54:55 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:48861: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.116.125.239
country_id: 2017370
description:
2025-11-17 20:54:30 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:51555: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PQmZEdNDqL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.203.56
country_id: 1814991
description:
2025-11-17 20:54:39 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:43116: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 20:54:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<FKO3EtNDXoR3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 17 20:54:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<ygMOENNDrowI1et7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 17 20:54:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<F0sCEtNDRtOB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.221.15.76
country_id: 2017370
description:
2025-11-17 20:54:44 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:55338: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.131
country_id: 2186224
description:
2025-11-17 20:55:28 dovecot_login authenticator failed for ([121.73.167.131]) [121.73.167.131]:37670: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ApMuFdND2t+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-17 20:55:45 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:60203: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 20:56:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<kI3iFtNDkosrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.233.210.188
country_id: 6252001
description:
2025-11-17 20:56:06 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:50302: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-17 20:55:24 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:43053: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.101.36.206
country_id: 1814991
description:
Nov 17 20:55:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<tmYZFdNDiugvZSTO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.196.185
country_id: 2017370
description:
2025-11-17 20:55:37 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:53948: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 20:55:49 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:55088: 535 Incorrect authentication data (set_id=rubens@singseguros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-11-17 20:56:07 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:48012: 535 Incorrect authentication data (set_id=rubens)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 20:56:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<IX9cGdNDJrEvWfaQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QIaLGtNDPpuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-17 20:56:21 dovecot_login authenticator failed for ([46.44.24.40]) [46.44.24.40]:51008: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.123.34
country_id: 2017370
description:
2025-11-17 20:56:36 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:34483: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-17 20:56:40 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:34074: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 20:56:37 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52345: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-11-17 20:56:41 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:54806: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-11-17 20:56:09 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:60112: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-17 20:56:25 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:52838: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OBi7GNND4IqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.223
country_id: 1668284
description:
2025-11-17 20:57:50 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:60901: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 20:57:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<4F47G9NDkLZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 17 20:57:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<oaH1G9NDXrIv7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<I5xLHNNDgKWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 20:57:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<wVhQHdNDCNmGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 20:58:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<v3cfHtNDjhlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 20:57:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<Dh6NG9NDbshSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 20:57:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<HZbEG9NDMtil0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.84.78.69
country_id: 630336
description:
2025-11-17 20:57:34 dovecot_login authenticator failed for (static20.byfly.gomel.by) [93.84.78.69]:53909: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 20:57:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<nRCgHNNDXtNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 20:57:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<hcjvHNNDMr7SchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 20:58:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<m63lHtND6q2B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 17 20:58:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@alcantaraemonteiro.com.br>, method=PLAIN, rip=103.239.165.114, lip=200.150.196.245, session=<fggnH9NDSuVn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 20:58:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<Evg5H9NDcp9n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-17 20:58:31 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:45072: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</BXgH9NDuMKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2025-11-17 20:58:32 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:51552: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.8.246
country_id: 1668284
description:
2025-11-17 20:59:06 dovecot_login authenticator failed for ([101.13.8.246]) [101.13.8.246]:58326: 535 Incorrect authentication data (set_id=paulo.user.support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-17 20:58:11 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:54306: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-17 20:58:21 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:35492: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
country_id: 1814991
description:
2025-11-17 20:58:25 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:50262: 535 Incorrect authentication data (set_id=bianca.user.support@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.243.251
country_id: 1814991
description:
2025-11-17 20:58:48 dovecot_login authenticator failed for ([111.75.243.251]) [111.75.243.251]:38272: 535 Incorrect authentication data (set_id=bianca.user.support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 20:58:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<mMUaIdNDdN2YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.3.64.66
country_id: 2017370
description:
2025-11-17 20:58:45 dovecot_login authenticator failed for ([5.3.64.66]) [5.3.64.66]:46531: 535 Incorrect authentication data (set_id=paulo.user.support@louvoreterno.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.6.35.60
country_id: 3469034
description:
[2025-11-17 20:58:32 -0300] info [webmaild] 189.6.35.60 - diretoria@holdingsantahelena.agr.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 20:59:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<iN0oItNDqJtns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 20:59:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<bW9FI9NDvMNCYSpH>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 20:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ozx4I9ND5uCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 20:59:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<N0afJNNDGstrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 20:59:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<oxbAJNND9sqd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2025-11-17 21:00:01 dovecot_login authenticator failed for ([14.40.114.86]) [14.40.114.86]:44974: 535 Incorrect authentication data (set_id=dayanelima@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<65xHJdNDmuyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 17 21:00:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<a/RSKNNDMKUI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 21:01:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<HvMIKdNDjNMtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.252.146
country_id: 1269750
description:
2025-11-17 21:00:22 dovecot_login authenticator failed for ([106.222.252.146]) [106.222.252.146]:59163: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 21:00:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<YaNWJtND4pCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-17 21:00:53 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:54786: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TP8QJ9NDYJOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 21:00:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<3hl3KNNDMLSElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 21:00:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<R+IgJtNDhMzBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 21:00:19 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:34260: 535 Incorrect authentication data (set_id=dayanelima)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.100.173.233
country_id: 732800
description:
Nov 17 21:00:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=79.100.173.233, lip=200.150.196.245, TLS, session=<CoqxJdNDwKVPZK3p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2025-11-17 21:02:05 dovecot_login authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:51140: 535 Incorrect authentication data (set_id=supports@opsconsorcios.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 21:01:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<49ZqKdNDsL+YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 21:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<f/cHKtND4Hdo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K7SeKtNDjK6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 21:01:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<lmblK9NDjOZw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 21:02:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51854: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-17 21:02:52 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:49027: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-11-17 21:02:57 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:53280: 535 Incorrect authentication data (set_id=supports)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.101.36.206
country_id: 1814991
description:
Nov 17 21:02:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=47.101.36.206, lip=200.150.196.245, session=<0SsfLdNDiuYvZSTO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Nov 17 21:02:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@portaldascontempladas.com.br>, method=PLAIN, rip=47.89.246.144, lip=200.150.196.245, session=<wbhjLdND6uovWfaQ>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 21:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zhUzLtND+NCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.58.19
country_id: 1643084
description:
2025-11-17 21:02:40 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:53254: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 21:02:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<wBDpLtNDutVns7yS>


