# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2025-11-18 04:50:42 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:39772: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.26
country_id: 1668284
description:
2025-11-18 04:50:16 dovecot_login authenticator failed for 111-70-48-26.emome-ip.hinet.net [111.70.48.26]:43723: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-18 04:50:36 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:8579: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.155.213.175
country_id: 1668284
description:
2025-11-18 04:52:05 dovecot_login authenticator failed for 182-155-213-175.veetime.com [182.155.213.175]:52432: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Wbs4u9lDnLMtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 04:51:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<V2Uku9lDCrhzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2025-11-18 04:51:58 dovecot_login authenticator failed for (hn.kd.ny.adsl) [218.29.231.106]:51122: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 04:52:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<J6ISvdlD5uk7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:51:27 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:63302: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HNJ9u9lDPKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2025-11-18 04:51:41 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:60914: 535 Incorrect authentication data


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ttgRv9lDZsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 04:52:48 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:41190: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<I4jQwNlDFMqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:52:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Pue3vtlD8MctPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.151.242.210
country_id: 2017370
description:
2025-11-18 04:52:50 dovecot_login authenticator failed for ([46.151.242.210]) [46.151.242.210]:51182: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.20.87.113
country_id: 1814991
description:
2025-11-18 04:52:19 dovecot_login authenticator failed for ([58.20.76.243]) [58.20.87.113]:54884: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 04:52:21 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:59439: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-18 04:52:28 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:48679: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-18 04:52:39 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:37946: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-11-18 04:53:06 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:40538: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-18 04:52:13 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:54377: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 04:53:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<uRC5wNlDqsp9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2025-11-18 04:53:04 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:37144: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-18 04:52:24 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:34107: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-11-18 04:54:04 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:48680: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-11-18 04:53:28 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:53560: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MoSiwtlDotuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 04:53:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<pXSBwtlD1sJxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:53:46 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:65184: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.244.44
country_id: 2017370
description:
2025-11-18 04:53:50 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:58786: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 04:53:57 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64468: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 04:54:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<IVRbx9lDBbB3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 04:55:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<fI8JyNlDBO4vT1jH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PbMuxtlDjOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-18 04:54:34 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:35188: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-18 04:54:44 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:34410: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<D1vFydlD5pSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-11-18 04:55:37 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:34848: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-18 04:55:48 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:51196: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KMOQy9lDJJ+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.215.90
country_id: 1269750
description:
2025-11-18 04:56:05 dovecot_login authenticator failed for ([110.227.215.90]) [110.227.215.90]:57213: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.184.202
country_id: 1814991
description:
2025-11-18 04:55:25 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:57961: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 04:55:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<QvLjydlDDIlSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-18 04:55:36 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:60419: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 04:57:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<jdTlztlD3KMrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-18 04:57:01 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:56958: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.208.26
country_id: 6252001
description:
2025-11-18 04:56:12 dovecot_login authenticator failed for (20.127.208.26) [20.127.208.26]:51253: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-18 04:56:13 dovecot_login authenticator failed for ([152.52.234.4]) [152.52.231.202]:55732: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 04:56:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<nFz1zdlDSK6P9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 04:56:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<oWAGztlDQI9SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-11-18 04:56:50 dovecot_login authenticator failed for ([203.252.10.5]) [203.252.10.3]:34030: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 04:56:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<T99LzNlDCshxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3n1dzdlDKq2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 04:56:38 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63919: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-18 04:56:45 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:46658: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 04:56:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<0auXztlDlPKnYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0XP20NlDgsOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 04:57:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<RM1L0dlD9M4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 04:57:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<b3Tuz9lDarinR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:57:23 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51811: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 04:58:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<O7T40tlDoKF9gnHM>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<56GG1NlD8NOxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ODNJ1tlDiuKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-18 04:59:08 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:48136: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-11-18 04:59:46 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:37524: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 04:59:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<RYFU2dlDuIdn9M4G>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 05:00:04 H=(195.3.134.135) [179.0.178.53]:53658 F=<erictremblaysi@hotmail.com> rejected RCPT <analogica@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:53658 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.123.34
country_id: 2017370
description:
2025-11-18 05:00:06 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:51797: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 04:59:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<soWy19lDEohCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8N8R2NlDWOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-11-18 04:59:31 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:55962: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 04:59:56 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:57115: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-18 05:00:11 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:58713: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2025-11-18 05:00:12 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:58522: 535 Incorrect authentication data (set_id=info@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 05:00:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<MnFL2tlDFNiB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 05:00:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<BXiF2tlDysRzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 05:00:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<tlJJ29lD9qCUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 05:00:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<1QOb29lDLIpvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-18 05:00:37 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:55832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 05:00:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<UQH73NlD3LYnaoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aqOq29lD8J6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2025-11-18 05:00:42 dovecot_login authenticator failed for ([218.156.2.230]) [218.156.2.229]:53579: 535 Incorrect authentication data (set_id=info@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:01:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<9QBJ3dlDorNns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-18 05:01:03 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:33414: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<18AK4dlDSsuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.213.111
country_id: 2017370
description:
2025-11-18 05:01:37 dovecot_login authenticator failed for ([78.81.213.111]) [78.81.213.111]:42688: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 05:01:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<TEL439lD6JN2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.31
country_id: 1835841
description:
2025-11-18 05:01:52 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:60654: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-11-18 05:01:53 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:33302: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 05:01:20 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:60420: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.76.204
country_id: 1814991
description:
2025-11-18 05:01:26 dovecot_login authenticator failed for ([58.34.76.204]) [58.34.76.204]:54573: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2Ys939lDrrGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 05:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<tqRL49lDJN1w2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-11-18 05:03:00 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:36654: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 05:02:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<dY5Z4tlDhiSvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-18 05:02:34 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@educacionalevangelico.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.49
country_id: 1668284
description:
2025-11-18 05:02:35 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:42731: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.43.156
country_id: 732800
description:
2025-11-18 05:02:49 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:36232: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-11-18 05:02:52 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:55495: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 05:02:54 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:58106: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-18 05:02:56 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:59532: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-18 05:02:09 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:46675: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:02:25 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51909: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XeTK4tlDmNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-18 05:02:40 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:56776: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-11-18 05:02:09 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:51392: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-11-18 05:02:13 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:60297: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2025-11-18 05:02:28 dovecot_login authenticator failed for ([218.156.93.206]) [218.156.93.206]:51804: 535 Incorrect authentication data (set_id=postmaster@hosting.inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-18 05:03:27 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:36286: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2025-11-18 05:03:27 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:35758: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-11-18 05:03:28 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:49317: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.68
country_id: 1814991
description:
2025-11-18 05:03:47 dovecot_login authenticator failed for ([27.39.128.68]) [27.39.128.68]:37652: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:03:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0bSh5NlD+t+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.79.146
country_id: 1835841
description:
2025-11-18 05:03:35 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:45932: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-18 05:03:37 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:65123: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-18 05:04:00 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:38127: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 05:03:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<foGv5NlDRLQnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-11-18 05:03:36 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:36311: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2025-11-18 05:03:55 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:64250: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-11-18 05:03:59 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:33077: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.81.184.164
country_id: 1831722
description:
[2025-11-18 05:04:03 -0300] info [cpaneld] 183.81.184.164 - mecanicodeelite "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mecanicodeelite (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-18 05:03:16 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:48562: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-18 05:03:56 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:54951: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 05:03:59 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:45834: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.89.135.30
country_id: 2017370
description:
2025-11-18 05:04:07 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:39316: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 05:04:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<c/0I6dlDiIOGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 05:04:38 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:49036: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-11-18 05:04:12 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:42784: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2025-11-18 05:04:13 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:35890: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 05:04:15 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:37892: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-11-18 05:04:27 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:51315: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-18 05:04:33 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:57136: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-11-18 05:04:58 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:42160: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-11-18 05:04:13 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:36276: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Qg/06dlDaJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.80.238.162
country_id: 1814991
description:
2025-11-18 05:04:45 dovecot_login authenticator failed for ([218.80.238.162]) [218.80.238.162]:49044: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2025-11-18 05:04:48 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:47642: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7vzH69lDrKaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-11-18 05:04:13 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:57200: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.135.217
country_id: 2510769
description:
2025-11-18 05:04:17 dovecot_login authenticator failed for (217.pool90-160-135.dynamic.orange.es) [90.160.135.217]:45606: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 05:04:19 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:44013: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.117.108
country_id: 1814991
description:
2025-11-18 05:05:14 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:58325: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 05:05:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55068: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ax2R7dlDyq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:05:30 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52042: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2025-11-18 05:05:30 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:46540: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.250
country_id: 2186224
description:
2025-11-18 05:05:44 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:38882: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 05:05:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<yXaT7tlDgqZvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 05:05:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<mwIJ7NlDyIQkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-11-18 05:05:13 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:38454: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-11-18 05:05:17 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:52522: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.93.196
country_id: 2017370
description:
2025-11-18 05:05:28 dovecot_login authenticator failed for (l5-128-93-196.novotelecom.ru) [5.128.93.196]:33014: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 05:06:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<hEkm79lDVgUkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-18 05:06:30 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:38546: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Xowj8dlD2MexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:06:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<4gaS8tlDbNlns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.196
country_id: 2186224
description:
2025-11-18 05:07:04 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:48952: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 05:07:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<BzEF89lDhoeP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 05:06:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<k8k+8NlDrN2YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.163.5
country_id: 2017370
description:
2025-11-18 05:06:42 dovecot_login authenticator failed for (pool-176-226-163-5.is74.ru) [176.226.163.5]:54378: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.133.126
country_id: 3595528
description:
2025-11-18 05:06:53 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:42725: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 05:07:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<shmx8tlDgqZrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-18 05:07:11 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:42048: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-18 05:07:20 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:53841: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zras9NlDiuCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 05:07:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<JLsz9dlDlNkv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 05:07:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<51tR9dlDhKJSczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7C179tlDPOmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-18 05:07:18 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:63075: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-11-18 05:07:29 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:47946: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 05:07:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<uUsa9dlDPtJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.55.3.238
country_id: 2017370
description:
2025-11-18 05:07:46 dovecot_login authenticator failed for ([92.55.3.238]) [92.55.3.238]:49860: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 05:07:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<DkSq9dlD8MqElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 05:07:50 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:60704: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 05:08:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<k80399lDJpgXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XiRJ+NlDjoixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 05:08:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<Nm5z+dlD3oRCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:09:03 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51818: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-18 05:08:12 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:39151: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 05:08:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<wK4299lDgqx3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 05:09:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomation.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<hAHz+tlDIpLBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 05:09:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<2xeE+9lD/oKl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:09:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DzHh+9lDUpyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 05:09:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<WlG//NlDxpwI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-11-18 05:09:57 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:37424: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 05:09:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<dMBW/dlDOuGl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-18 05:10:03 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:56948: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 05:09:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<OXRJ+tlDBLpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-11-18 05:10:07 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:46413: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YU9x/9lD0rOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
country_id: 1269750
description:
2025-11-18 05:10:41 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:47352: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-18 05:10:42 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:39947: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-18 05:10:52 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:31739: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:10:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<MX7F/tlDcqRns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.204
country_id: 1814991
description:
2025-11-18 05:10:22 dovecot_login authenticator failed for ([220.179.87.204]) [220.179.87.204]:32927: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.159.174.17
country_id: 1835841
description:
2025-11-18 05:10:31 dovecot_login authenticator failed for ([221.159.174.17]) [221.159.174.17]:34714: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 05:10:30 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:61538: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2025-11-18 05:10:48 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:46932: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ePYvAdpDNruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.153.105
country_id: 1835841
description:
2025-11-18 05:10:18 dovecot_login authenticator failed for ([220.119.153.105]) [220.119.153.105]:47654: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 05:11:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<P7UMAtpDgaJ3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iIIAA9pDbMuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 05:11:51 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:52117: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-18 05:12:00 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:48776: 535 Incorrect authentication data (set_id=sociais)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 05:11:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<lf7wAtpD5Nl2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.113.109
country_id: 2017370
description:
2025-11-18 05:11:50 dovecot_login authenticator failed for (95.105.113.109.dynamic.o56.ru) [95.105.113.109]:57142: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 05:11:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<l3FEBNpDzKOd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2025-11-18 05:12:01 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:59072: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 05:12:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<A8LQBNpDDpCiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 05:12:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<kEHiBtpDEOotPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:12:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51969: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 05:12:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<BgUiB9pDoqNn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.221.15.76
country_id: 2017370
description:
2025-11-18 05:13:00 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:55532: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-18 05:12:09 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:43533: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
country_id: 1814991
description:
2025-11-18 05:12:11 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:57276: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.179.106
country_id: 1814991
description:
2025-11-18 05:12:21 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:37050: 535 Incorrect authentication data (set_id=jotadeschamps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-18 05:12:41 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:60129: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-18 05:12:16 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:36042: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-11-18 05:12:18 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:55268: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<16iNBtpDWt2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.65.108
country_id: 2077456
description:
2025-11-18 05:12:40 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:51220: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 05:13:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<8RAjCNpDeNMIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-18 05:12:58 dovecot_login authenticator failed for ([197.219.210.86]) [197.219.210.86]:39086: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YZDqC9pDVJCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 05:14:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:49350: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-18 05:13:19 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:37609: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2025-11-18 05:13:34 dovecot_login authenticator failed for ([36.135.107.56]) [36.135.107.57]:56006: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 05:13:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<pT9CC9pD6Osv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 05:13:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<0IutCdpDiu1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-18 05:13:09 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:56650: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 05:13:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<mKj/CNpD0tsrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-18 05:13:23 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:40804: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.60
country_id: 2017370
description:
2025-11-18 05:14:00 dovecot_login authenticator failed for ([178.178.222.60]) [178.178.222.60]:39432: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fv8tCtpDBISxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.153.168.211
country_id: 1814991
description:
2025-11-18 05:13:44 dovecot_login authenticator failed for ([39.153.168.211]) [39.153.168.211]:38240: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.119
country_id: 3996063
description:
2025-11-18 05:13:50 dovecot_login authenticator failed for (201.173.97.119-clientes-izzi.mx) [201.173.97.119]:38653: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.7.22
country_id: 1880251
description:
2025-11-18 05:14:50 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:30748: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 05:15:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<YDKtD9pDHN9bejg7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+0a6DdpDyJmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-18 05:14:32 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:55621: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 05:14:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<SDMhD9pDqN1rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.212.198.51
country_id: 1814991
description:
2025-11-18 05:14:18 dovecot_login authenticator failed for ([14.212.198.51]) [14.212.198.51]:51188: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.78.131
country_id: 2077456
description:
2025-11-18 05:14:20 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:41416: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.117.108
country_id: 1814991
description:
2025-11-18 05:14:36 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:44281: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.61.137
country_id: 1562822
description:
2025-11-18 05:14:59 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:19820: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 05:15:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<bl5LD9pDLI1CYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-11-18 05:15:05 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:44286: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-11-18 05:14:16 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:49104: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 05:15:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<32+kD9pDiNQO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:15:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51899: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-18 05:15:28 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:56978: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:15:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+n1WEdpDurCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-11-18 05:16:05 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:40297: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-18 05:15:12 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:59562: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-18 05:15:22 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:53410: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 05:15:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<RzvPENpDtIdAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-18 05:15:43 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:49163: 535 Incorrect authentication data (set_id=info@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.47.242
country_id: 2017370
description:
2025-11-18 05:15:47 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:51034: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.64.209.11
country_id: 1814991
description:
2025-11-18 05:15:47 dovecot_login authenticator failed for (11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:43211: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-18 05:15:29 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:42017: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-18 05:16:01 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:62474: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-18 05:16:05 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:58308: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.205
country_id: 2750405
description:
2025-11-18 05:16:33 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:58555: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 05:16:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<IVKLFdpD7OJo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-18 05:16:47 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:39076: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 05:16:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<437YFdpDJtfSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.120.26
country_id: 1814991
description:
2025-11-18 05:16:52 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:34821: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.183.135.88
country_id: 2017370
description:
2025-11-18 05:16:58 dovecot_login authenticator failed for host.46-183-135-88.broadband.redcom.ru [46.183.135.88]:34364: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.253
country_id: 1814991
description:
2025-11-18 05:16:19 dovecot_login authenticator failed for ([112.102.48.253]) [112.102.48.253]:50647: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.48.22.251
country_id: 2017370
description:
2025-11-18 05:16:22 dovecot_login authenticator failed for (46.48.22.251-FTTB.planeta.tc) [46.48.22.251]:43184: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l1mwFtpDiM+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 05:17:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<DIK9FtpDXZm317Oa>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rFnnFNpDkr+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.212.101
country_id: 2017370
description:
2025-11-18 05:16:37 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:49920: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 05:17:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61163: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.170.146.177
country_id: 1814991
description:
2025-11-18 05:17:22 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:43416: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-18 05:17:23 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:51928: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:17:40 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52240: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.141.225
country_id: 2077456
description:
2025-11-18 05:17:51 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:44235: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-18 05:18:01 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:42847: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.20.87.113
country_id: 1814991
description:
2025-11-18 05:17:30 dovecot_login authenticator failed for ([58.20.76.243]) [58.20.87.113]:58097: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:17:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Wp8GNpDftexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-18 05:17:34 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:37960: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-11-18 05:17:49 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:53833: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c4EDHNpDCoCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-11-18 05:18:52 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:33798: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 05:19:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<5p6XHdpDtukv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-18 05:19:05 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:43177: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2025-11-18 05:18:10 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:42254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.137.31.134
country_id: 1814991
description:
2025-11-18 05:18:19 dovecot_login authenticator failed for ([113.137.31.134]) [113.137.31.134]:40621: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 05:19:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<zq1WHtpD3osv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 05:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<eUvJHtpDtoyB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 05:19:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1fNiH9pDfJTBl4nP>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hGKkH9pDIpexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2025-11-18 05:19:53 dovecot_login authenticator failed for ([123.163.52.74]) [123.163.52.74]:49375: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 05:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<ykl1IdpDfPBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 05:19:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<DWuPHtpDNtQ+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 05:19:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<emN/INpDOI2dQi/y>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Xm5nIdpDpp6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 05:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<nhBdIdpDcqSYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 05:20:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<FbYRItpDmsiUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RM8pI9pD1KaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-18 05:20:35 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:49739: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-18 05:21:04 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:48086: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 05:20:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<YFptItpD/tA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 05:20:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<TmjyItpD/LEtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 05:20:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<6LVRI9pD3IynR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.112.81
country_id: 1814991
description:
2025-11-18 05:21:00 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:39934: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-18 05:20:10 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:63246: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.80.71.87
country_id: 1861060
description:
2025-11-18 05:20:19 dovecot_login authenticator failed for 58x80x71x87.ap58.ftth.ucom.ne.jp [58.80.71.87]:50010: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.232.110
country_id: 2017370
description:
2025-11-18 05:20:21 dovecot_login authenticator failed for ([178.70.232.110]) [178.70.232.110]:49968: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.212.198.226
country_id: 1814991
description:
2025-11-18 05:20:44 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:58058: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 05:20:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<YMYqJNpDbs+d5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-11-18 05:21:41 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:35522: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 05:21:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<37aCJ9pDutqKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 05:21:53 dovecot_login authenticator failed for (User) [177.74.174.120]:62446: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.118.17.101
country_id: 2017370
description:
2025-11-18 05:21:58 dovecot_login authenticator failed for ([176.118.17.101]) [176.118.17.101]:46794: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.21.213
country_id: 1269750
description:
Nov 18 05:21:06 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<comercial@inovasite.com>, method=PLAIN, rip=103.211.21.213, lip=200.150.196.245, TLS, session=<002rI9pDWd5n0xXV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.89
country_id: 1814991
description:
2025-11-18 05:21:09 dovecot_login authenticator failed for ([111.26.63.89]) [111.26.63.89]:36552: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 05:21:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<JFixJdpDQrfSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:21:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZI7LJtpDor2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 05:21:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<JlwbJ9pD/tikXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-11-18 05:21:42 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:50192: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-18 05:21:56 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:60336: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.103.53.44
country_id: 1269750
description:
Nov 18 05:21:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<comercial>, method=PLAIN, rip=103.103.53.44, lip=200.150.196.245, TLS, session=<sj5TJdpDirRnZzUs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.11.231.177
country_id: 1814991
description:
2025-11-18 05:21:36 dovecot_login authenticator failed for ([1.15.123.146]) [175.11.231.177]:58952: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
country_id: 1835841
description:
2025-11-18 05:21:43 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:55319: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2025-11-18 05:22:00 dovecot_login authenticator failed for ([111.38.136.211]) [111.38.136.211]:49369: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-18 05:22:18 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:53720: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lfZeKtpDeNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 05:22:38 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53426: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-18 05:22:56 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:47391: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 05:22:09 dovecot_login authenticator failed for (User) [177.74.174.120]:62446: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 05:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<0b9jKdpDqJmkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-18 05:22:29 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:47404: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 05:23:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<f+LWK9pD5raB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-11-18 05:23:03 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:57891: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.91.119
country_id: 2017370
description:
2025-11-18 05:22:10 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:52266: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 05:22:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Jyy2KdpDQOSYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 05:22:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<MEA4KtpDouZA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.211.39.86
country_id: 1814991
description:
2025-11-18 05:22:46 dovecot_login authenticator failed for ([58.211.39.86]) [58.211.39.86]:55955: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.133.140
country_id: 1562822
description:
2025-11-18 05:22:50 dovecot_login authenticator failed for ([118.69.133.140]) [118.69.133.140]:50264: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J10gLNpDRtyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-11-18 05:22:35 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:40078: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.94.220.9
country_id: 1814991
description:
2025-11-18 05:22:55 dovecot_login authenticator failed for ([183.94.220.9]) [183.94.220.9]:58694: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.127.231.74
country_id: 1814991
description:
2025-11-18 05:23:29 dovecot_login authenticator failed for ([123.127.231.74]) [123.127.231.74]:54643: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.161
country_id: 1668284
description:
2025-11-18 05:23:30 dovecot_login authenticator failed for 110-25-105-161.adsl.fetnet.net [110.25.105.161]:55822: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.40.20
country_id: 2017370
description:
2025-11-18 05:23:31 dovecot_login authenticator failed for broadband-37-110-40-20.ip.moscow.rt.ru [37.110.40.20]:58520: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-18 05:23:49 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:55082: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-18 05:23:07 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:55736: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.150.58
country_id: 2017370
description:
2025-11-18 05:23:27 dovecot_login authenticator failed for ([178.35.150.58]) [178.35.150.58]:53956: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RkDxLdpDQuuxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.104
country_id: 3469034
description:
2025-11-18 05:23:35 H=(localhost) [179.0.178.104]:60329 F=<postmaster@mail.com> rejected RCPT <ieqcampocomprido@ieq.com.br>: "JunkMail rejected - (localhost) [179.0.178.104]:60329 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.104"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-11-18 05:23:17 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:46974: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 05:24:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<+Ln/L9pDGu2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:24:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<chsKMtpDXsZns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 05:25:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<7BxaM9pDjppAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-11-18 05:24:24 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:56919: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cOp3MdpDvo2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-18 05:24:39 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:38434: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 05:24:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<V8B6MtpD6MGkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 05:24:51 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59935: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 05:25:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<LQIrM9pDBNaUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-11-18 05:26:02 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:34555: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1tTfNtpDeLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.144.115.150
country_id: 1835841
description:
2025-11-18 05:26:04 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:46581: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 05:25:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<e/RmM9pDHKml0iHB>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qI4LNdpD0qexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-11-18 05:26:37 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:59056: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2025-11-18 05:26:07 dovecot_login authenticator failed for ([83.239.0.202]) [83.239.0.202]:55720: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 05:26:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<BHN9ONpDKJOGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dK+mONpDcMGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-18 05:27:02 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:36416: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-18 05:26:16 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:43239: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 05:26:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<E1kAONpDXhinYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 05:26:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<5Rg6OdpD5oikXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 05:27:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<sFw2OtpDrMSB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.14.218.26
country_id: 1814991
description:
2025-11-18 05:27:02 dovecot_login authenticator failed for ([111.14.218.26]) [111.14.218.26]:57983: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 05:26:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49739: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 05:26:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<R3QNOdpD9OWqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-11-18 05:26:48 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:36746: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.63.237.243
country_id: 2017370
description:
2025-11-18 05:26:21 dovecot_login authenticator failed for ([109.63.237.243]) [109.63.237.243]:52628: 535 Incorrect authentication data (set_id=rsimoesdiretoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.6.238
country_id: 1814991
description:
2025-11-18 05:27:44 dovecot_login authenticator failed for ([116.230.66.81]) [116.233.6.238]:60064: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-18 05:27:58 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:41950: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-18 05:28:04 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:55730: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 05:27:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<XaqXO9pDjo13xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 05:27:22 dovecot_login authenticator failed for (conut.org.br) [112.122.54.54]:34045: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cvkzPNpD1taxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.199.171.246
country_id: 1269750
description:
2025-11-18 05:27:33 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:56507: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 05:27:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<7oSHPNpDgrmElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.75.34.103
country_id: 2750405
description:
2025-11-18 05:28:06 dovecot_plain authenticator failed for (4g4wp07bjofvn1w93bukitsp6v2rd5n) [147.75.34.103]:45567: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 05:27:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<mpT3OtpDvpiKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 05:28:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<QEtCQNpDoqgI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 05:28:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<WnNCQNpDOrrBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-11-18 05:28:48 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:55786: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.155
country_id: 1643084
description:
[2025-11-18 05:28:55 -0300] info [cpaneld] 185.213.83.155 - adportobelo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adportobelo (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:29:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LHmdQdpDsIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 05:28:08 dovecot_login authenticator failed for (89fmjoinville.com) [111.122.211.212]:19756: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JSbRP9pDmumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-18 05:28:46 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:39586: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 05:28:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<6e4nPtpD+s0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 05:28:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<1PjdPtpDwrKkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-18 05:29:12 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:49658: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2025-11-18 05:29:23 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:49826: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<g2ljQ9pDepKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-18 05:29:31 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:39724: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 05:30:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<NLL7RNpDtMgtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.188.123.61
country_id: 2017370
description:
2025-11-18 05:30:51 dovecot_login authenticator failed for ([89.188.123.61]) [89.188.123.61]:49606: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:30:55 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51522: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-11-18 05:31:02 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:54384: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 05:31:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Ju54SNpDNrstPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-18 05:30:27 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:49010: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 05:30:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<8FnRRtpDKookMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jdH1RtpDdKmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.51.202
country_id: 3017382
description:
2025-11-18 05:30:31 dovecot_login authenticator failed for ([188.231.51.202]) [188.231.51.202]:33102: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 05:32:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<TScyTNpDLMeWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-11-18 05:31:08 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:59910: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2025-11-18 05:31:17 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:52220: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TENPTNpDtsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-18 05:31:29 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:47438: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fcmJStpDHryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-11-18 05:31:34 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:46993: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2025-11-18 05:31:07 dovecot_login authenticator failed for ([219.248.4.146]) [219.248.4.146]:53874: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 05:31:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<txeXSdpDPruvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-11-18 05:31:23 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:48108: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.75.156.89
country_id: 1814991
description:
2025-11-18 05:31:23 dovecot_login authenticator failed for ([223.75.156.89]) [223.75.156.89]:31386: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.71
country_id: 1819730
description:
2025-11-18 05:33:06 dovecot_login authenticator failed for ([182.239.80.71]) [182.239.80.71]:40574: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 05:32:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<BcShTdpDIr5A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iqgfTtpDStGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-18 05:32:33 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:51688: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-18 05:32:51 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:38083: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-11-18 05:32:56 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:40950: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 05:33:10 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:56219: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-18 05:33:16 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:51445: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-18 05:33:18 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:37839: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 05:33:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<5Sp/UdpDYtY7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2025-11-18 05:33:56 dovecot_login authenticator failed for ([222.99.52.202]) [222.99.52.202]:47624: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 05:33:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<sISjUNpDftHBl4nP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tqKoUdpDsOmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.253.47
country_id: 1819730
description:
2025-11-18 05:33:34 dovecot_login authenticator failed for ([161.81.253.47]) [161.81.253.47]:56148: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 05:33:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<vL3EUtpDfpUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.10.211
country_id: 1814991
description:
2025-11-18 05:34:01 dovecot_login authenticator failed for ([221.234.10.211]) [221.234.10.211]:39590: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 05:34:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<0fuIU9pDFuF9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.98.76
country_id: 1880251
description:
2025-11-18 05:34:14 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:34060: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tbJHVdpDyJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-11-18 05:34:39 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:25309: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-11-18 05:35:01 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:41414: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TMoHV9pD3pmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2025-11-18 05:35:03 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:29613: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-11-18 05:34:11 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:9219: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 05:35:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<jd5TV9pDYrdSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.241
country_id: 1668284
description:
2025-11-18 05:35:24 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:57601: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PAjWWNpD5qOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.105.153.3
country_id: 2017370
description:
2025-11-18 05:35:51 dovecot_login authenticator failed for (3.inet153.multi-net.ru) [89.105.153.3]:35346: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 05:35:59 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62111: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 05:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<BbOfWtpDWNlxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 05:35:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<ZohcV9pDyBSnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-11-18 05:36:56 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:36327: 535 Incorrect authentication data (set_id=info@ilumix.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 05:37:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<7uwwXtpDDqN2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.113.109
country_id: 2017370
description:
2025-11-18 05:36:22 dovecot_login authenticator failed for (95.105.113.109.dynamic.o56.ru) [95.105.113.109]:48988: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-18 05:36:29 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:52586: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZAxuXNpDPLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.162.240.149
country_id: 1269750
description:
2025-11-18 05:36:40 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:42135: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-11-18 05:37:24 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:39392: 535 Incorrect authentication data (set_id=sbfin@radiolouvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-18 05:37:31 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:50328: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<seb6X9pDlNqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 05:37:40 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:56106: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.61.177.188
country_id: 1814991
description:
Nov 18 05:37:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=111.61.177.188, lip=200.150.196.245, TLS, session=<YZFfX9pDiNxvPbG8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 05:37:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<MTk8X9pDuIVw2eny>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 05:37:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<0Te1X9pDvpEvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 05:37:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<ZUzMX9pDoNcrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 05:37:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<MIALYNpDVMcv7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0wDHYdpDBuKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 05:38:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49653: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.61.175.118
country_id: 1814991
description:
Nov 18 05:37:19 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@1075fm.com.br>, method=PLAIN, rip=111.61.175.118, lip=200.150.196.245, TLS, session=<5XDhXdpDXktvPa92>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2025-11-18 05:37:20 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:40288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:37:21 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51708: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.118
country_id: 1814991
description:
2025-11-18 05:37:36 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:35951: 535 Incorrect authentication data (set_id=sbfin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.150.58
country_id: 2017370
description:
2025-11-18 05:37:52 dovecot_login authenticator failed for ([178.35.150.58]) [178.35.150.58]:52072: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 05:38:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<gUKjY9pDNKeP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-18 05:38:40 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:55142: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 05:38:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<38q9ZNpDALt3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-18 05:38:25 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:54764: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.39.216.210
country_id: 3017382
description:
2025-11-18 05:38:13 dovecot_plain authenticator failed for ([10.181.195.229]) [170.39.216.210]:52024: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-18 05:38:30 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:44536: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<a+uTY9pDXoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 05:38:36 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:53676: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 05:38:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<6I93ZNpDdPJxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-11-18 05:38:49 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:58130: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-11-18 05:39:00 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:39872: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-18 05:38:13 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:51077: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2025-11-18 05:39:09 dovecot_login authenticator failed for ([124.114.149.106]) [124.114.149.106]:55285: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 05:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<S3y/ZdpDPp9CYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-18 05:39:17 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:9256: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<R/UpZ9pDIpWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.30.253
country_id: 1814991
description:
2025-11-18 05:39:32 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:58903: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 05:39:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<NCxwaNpDMNVSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 05:39:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<GPrwZdpD/Ll9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-11-18 05:39:21 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:42721: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-11-18 05:39:31 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:44191: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 05:40:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9E3TadpDpuxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-11-18 05:40:23 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:59594: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-11-18 05:40:42 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:59673: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:40:50 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52127: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-18 05:40:11 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12145: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JO22atpDYq2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.148
country_id: 1835841
description:
2025-11-18 05:40:34 dovecot_login authenticator failed for ([218.149.228.148]) [218.149.228.148]:54420: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 05:40:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<A3CTa9pDgMlzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 05:41:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<kdmDbNpDSrmnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-11-18 05:40:15 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:51272: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 05:40:57 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:51628: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 05:40:58 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:47766: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 05:40:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<a4InbNpDyrGB4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BK2GbNpD+rixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
country_id: 1814991
description:
2025-11-18 05:41:05 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:56022: 535 Incorrect authentication data (set_id=info@ilumix.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 05:41:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<u89jbtpD7tCkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:41:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<T+iwbtpDZoFns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 05:42:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<DKTJb9pDfJtvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-18 05:41:13 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:35568: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2025-11-18 05:41:17 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:51546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 05:41:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<3DmSbdpD6saUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4bhEbtpDhMWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-11-18 05:42:36 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:41206: 535 Incorrect authentication data (set_id=info@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.138.214
country_id: 290557
description:
2025-11-18 05:42:45 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:46624: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 05:42:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<IB6QctpDEsEnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-11-18 05:42:52 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:42664: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-11-18 05:42:56 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:50576: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-18 05:42:57 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:54026: 535 Incorrect authentication data (set_id=info@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QDvgcdpDxtqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-18 05:43:28 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:33494: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aXdwddpD3uuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-18 05:43:55 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:33076: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:44:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AkZCd9pDioyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.14.75
country_id: 1835841
description:
2025-11-18 05:43:08 dovecot_login authenticator failed for ([211.185.14.75]) [211.185.14.75]:36774: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-18 05:43:11 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:47898: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-11-18 05:43:20 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:55385: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.140.134
country_id: 1562822
description:
2025-11-18 05:44:22 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:11317: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</84IedpDrpSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-11-18 05:44:35 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:46115: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.119.87
country_id: 1814991
description:
2025-11-18 05:44:44 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:30997: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-11-18 05:45:02 dovecot_login authenticator failed for ([218.22.187.69]) [218.22.187.66]:51594: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-18 05:44:09 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:46628: 535 Incorrect authentication data (set_id=rene)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-18 05:44:09 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:51074: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 05:44:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<V4pBetpDMsEnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-11-18 05:45:23 dovecot_login authenticator failed for ([41.59.200.166]) [41.59.200.166]:43783: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 05:45:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<U2dkfNpDSOI+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2025-11-18 05:45:40 dovecot_login authenticator failed for ([36.135.107.57]) [36.135.107.57]:39126: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-18 05:45:45 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:34822: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-11-18 05:46:04 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:44506: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-11-18 05:45:23 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:40043: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-11-18 05:45:43 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:46979: 535 Incorrect authentication data (set_id=toro@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-18 05:46:01 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:47858: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 05:45:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<LWaCfNpDENSGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7oCZfNpD3quxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 05:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=</g4lfdpDtqCYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-11-18 05:45:58 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:35590: 535 Incorrect authentication data (set_id=toro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.120.169
country_id: 1814991
description:
2025-11-18 05:46:07 dovecot_login authenticator failed for ([58.35.120.169]) [58.35.120.169]:64961: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-11-18 05:45:14 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:50452: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.204
country_id: 1835841
description:
2025-11-18 05:45:53 dovecot_login authenticator failed for ([211.198.128.204]) [211.198.128.204]:52791: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 05:46:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<Sdq5f9pD3Np57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.249.154
country_id: 1814991
description:
2025-11-18 05:46:58 dovecot_login authenticator failed for ([223.84.249.154]) [223.84.249.154]:1127: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 05:46:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<qUa6ftpDWNd2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 05:46:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<z5QAf9pDpPOvfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ozclgNpDJsmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.131.9.114
country_id: 2921044
description:
2025-11-18 05:46:38 dovecot_plain authenticator failed for (ccc0g6f5lrz92see88) [43.131.9.114]:44410: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-18 05:46:39 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:45016: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-18 05:47:00 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:40006: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-11-18 05:46:16 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:50222: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2025-11-18 05:46:24 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:55728: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FZn2gdpDwNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 05:47:06 dovecot_login authenticator failed for (User) [177.74.174.120]:60177: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 05:46:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<W9vVftpD8KaElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 05:47:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=</m3lgtpDnoUv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Z265g9pDJNyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.238.101.209
country_id: 3932488
description:
2025-11-18 05:47:42 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:45520: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-11-18 05:47:45 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:45100: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2025-11-18 05:48:01 dovecot_login authenticator failed for ([188.247.43.42]) [188.247.43.42]:58076: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-18 05:47:09 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:52907: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 05:47:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<TPMkg9pDmoFSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:47:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<qZDwg9pDXKpns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 05:47:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0nt+gtpDXt9vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 05:47:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64697: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-11-18 05:47:22 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:45176: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-11-18 05:47:53 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:42703: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 05:48:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<WwN8hdpDhsxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 05:48:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<h8SdhdpDoLEkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 05:47:12 dovecot_login authenticator failed for (User) [177.74.174.120]:60177: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 05:47:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<+Mung9pDrKVrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2025-11-18 05:47:57 dovecot_login authenticator failed for ([85.236.186.137]) [85.236.186.137]:33924: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.139.245.137
country_id: 1814991
description:
2025-11-18 05:48:42 dovecot_login authenticator failed for (hn.kd.ny.adsl) [222.139.245.137]:34462: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.5.66
country_id: 2017370
description:
2025-11-18 05:48:43 dovecot_login authenticator failed for ([213.234.5.66]) [213.234.5.66]:36500: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.0.185
country_id: 2017370
description:
2025-11-18 05:48:58 dovecot_login authenticator failed for ([46.44.0.185]) [46.44.0.185]:56664: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 05:49:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<MMffiNpD+sKP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.148.100.210
country_id: 2017370
description:
2025-11-18 05:49:08 dovecot_login authenticator failed for ([46.148.100.210]) [46.148.100.210]:50426: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T4RZh9pDvISxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 05:48:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<BbN4h9pDjrhCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 05:49:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<FZYbjNpDeMmd5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YiKxjNpDUKSxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jw3pitpD9JuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 05:49:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<vXwWi9pDUo4kMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.87.9
country_id: 1814991
description:
2025-11-18 05:50:52 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:42586: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 05:51:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Xj4pkNpDpORns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 05:50:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<dSXnjNpDbsml0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:50:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SK6BjtpD9LCxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<35IHktpDUM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
country_id: 1814991
description:
2025-11-18 05:51:53 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:40516: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 05:52:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<TAHgk9pDUM1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 05:51:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Jd+zkNpD0KItPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 05:51:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<vNxNkdpDMso+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 05:51:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<MaVMktpDeLkI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-18 05:52:01 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:58308: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2025-11-18 05:51:15 dovecot_login authenticator failed for ([178.178.222.53]) [178.178.222.53]:41672: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 05:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<tiYmldpDLqGl0iHB>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J8umldpD+uixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.221.118
country_id: 1814991
description:
2025-11-18 05:52:48 dovecot_login authenticator failed for ([60.191.221.118]) [60.191.221.118]:48207: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 05:53:01 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61521: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.114.30
country_id: 1814991
description:
2025-11-18 05:52:24 dovecot_login authenticator failed for ([58.16.114.30]) [58.16.114.30]:33117: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 05:52:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<feulltpD2uV2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<arZll9pD8oKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 05:53:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<P2+Hl9pDfpJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 05:53:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<3E7+mNpDiJ8v+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<og43mdpD9pSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-18 05:53:40 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:59200: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 05:53:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<LLGWmdpDnKwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 05:54:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<LaEvntpDMKtAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 05:54:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<AfI4ntpDGqhbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 05:55:03 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51289: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QFbKnNpDxqWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 05:54:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<sQlyndpDJqBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 05:55:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<X8fOntpDQa53xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-11-18 05:55:18 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:51476: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 05:55:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51767: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IPYhotpD/MmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-11-18 05:55:35 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:49848: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 05:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<oMfVoNpDhrdo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-11-18 05:55:44 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:56004: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 05:55:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<io06n9pDqrlzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.80.56
country_id: 2017370
description:
2025-11-18 05:55:26 dovecot_login authenticator failed for (adsl-5-141-80-56.salekhard.ru) [5.141.80.56]:38662: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 05:55:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<G3cjoNpDPIxrhr+5>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zRhdoNpD1r2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-18 05:56:55 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:44206: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 05:56:10 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:33810: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 05:56:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<noASo9pDwrRSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.53
country_id: 6252001
description:
2025-11-18 05:56:25 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:57449: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8yrto9pDpNaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 05:56:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<fSTjo9pDItcO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.166
country_id: 1814991
description:
2025-11-18 05:57:26 dovecot_login authenticator failed for ([111.26.167.166]) [111.26.167.166]:53416: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-18 05:57:35 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:61907: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 05:57:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<p2+TptpDJrgIiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 05:57:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<MpJYptpDhK8v+wDY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tNiJp9pDyO2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.121.102.227
country_id: 719819
description:
2025-11-18 05:57:39 dovecot_login authenticator failed for (host-79-121-102-227.juropnet.hu) [79.121.102.227]:54690: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 05:57:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<M5HjqNpDHpQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-11-18 05:57:09 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:44831: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 05:59:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<+uagrNpDtMLSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 05:59:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<iR24rNpDXNotPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KfvZrNpDep+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 05:59:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=</CvTrNpDZGpo7MS0>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DsQZq9pDEpCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-18 05:58:52 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:62736: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 05:58:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<GaBrrNpDzsKd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 05:59:23 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49764: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.77.157
country_id: 1814991
description:
2025-11-18 05:59:24 dovecot_login authenticator failed for ([223.210.0.110]) [111.48.77.157]:49117: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 05:59:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<DQFJrtpDFruYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
country_id: 1814991
description:
2025-11-18 05:59:44 dovecot_login authenticator failed for ([113.200.216.246]) [113.200.216.246]:42842: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.184.202
country_id: 1814991
description:
2025-11-18 05:59:57 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:47228: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-18 05:59:07 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:47692: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-18 05:59:19 dovecot_login authenticator failed for ([118.121.234.5]) [118.121.234.5]:39982: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.144
country_id: 1835841
description:
2025-11-18 05:59:20 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:41228: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 05:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ENaprtpD1KixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-18 05:59:42 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:58388: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.50
country_id: 2017370
description:
2025-11-18 06:00:22 dovecot_login authenticator failed for ([89.175.253.50]) [89.175.253.50]:48534: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.222.60
country_id: 357994
description:
2025-11-18 06:00:36 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.222.60]:49052: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-11-18 06:00:07 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:56674: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-18 06:00:31 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:59213: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-11-18 06:01:01 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:36160: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.228.180.199
country_id: 1562822
description:
2025-11-18 06:00:14 dovecot_login authenticator failed for (static.vnpt.vn) [14.228.180.199]:63106: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 06:00:47 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:46778: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-11-18 06:00:51 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:39274: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 06:01:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<je/Ds9pDGsKKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lXI5stpDqsKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 06:00:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<6g3TstpDXuo+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.186.172.37
country_id: 1814991
description:
2025-11-18 06:01:03 dovecot_login authenticator failed for ([60.186.172.37]) [60.186.172.37]:59860: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.83.90
country_id: 1814991
description:
2025-11-18 06:01:04 dovecot_login authenticator failed for ([116.233.83.90]) [116.233.83.90]:35060: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MWbKtdpDFtSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-18 06:01:52 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:49541: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-11-18 06:01:56 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47634: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 06:01:56 dovecot_login authenticator failed for (mail.jimsmithcenters.com) [38.87.177.252]:49920: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 06:01:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<8oWVtNpD3ISUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-18 06:01:24 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:51608: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 06:01:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<r2m0ttpDVI6YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.159.86
country_id: 1814991
description:
2025-11-18 06:01:50 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:40219: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Fsidt9pDEuSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-18 06:02:07 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:52214: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 06:02:10 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:58900: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2025-11-18 06:02:16 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:33419: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-18 06:02:39 dovecot_login authenticator failed for ([122.186.219.150]) [122.186.219.150]:48064: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 06:02:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<BXMbutpDJoiB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.22.173.13
country_id: 1562822
description:
2025-11-18 06:02:09 dovecot_login authenticator failed for ([123.22.173.13]) [123.22.173.13]:55931: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AglfudpDDO2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 06:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<wI6judpDSDq317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 06:02:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<7r0WutpD+JmkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.122.170
country_id: 2661886
description:
2025-11-18 06:03:01 dovecot_login authenticator failed for h-155-4-122-170.a259.priv.bahnhof.se [155.4.122.170]:54684: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 18 06:03:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<wdEOu9pDXJx6kIMZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 06:03:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3o4XvdpDKomB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 06:03:50 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:56909: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 06:04:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<UwPMvtpDkqSdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2025-11-18 06:03:11 dovecot_login authenticator failed for ([118.220.149.121]) [118.220.149.121]:45560: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 06:03:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<ZyVxvNpD+qLSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pkb/vNpDWpixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:03:32 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52085: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0AaGwNpDVrCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 06:04:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<MsKHwNpDtuCnR+bm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DvVUwtpDmLuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 06:04:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<0VJ3wdpD1AenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 06:04:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<2NLFv9pDdLBzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-18 06:04:26 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:40258: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 06:04:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<1r6wwNpD7otAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-11-18 06:04:43 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:39960: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 06:04:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<ne9YwdpDtsWl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.36
country_id: 2464461
description:
2025-11-18 06:05:57 dovecot_login authenticator failed for ([102.110.11.36]) [102.110.11.36]:2236: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 06:06:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<y926xdpD1JWElIx5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 06:05:27 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<z5rYw9pDFc6xm8ew>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YmojxNpDEs+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 06:05:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Dzqow9pDjoZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 06:06:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<kOqnxdpDWqCUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.208.26
country_id: 6252001
description:
2025-11-18 06:06:00 dovecot_plain authenticator failed for (parin-test.kpz0ku3kfnqubkkeppdkbtt1th.bx.internal.cloudapp.net) [20.127.208.26]:64167: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2025-11-18 06:05:09 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:38281: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 06:05:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<MZS8wtpDcpBns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-18 06:06:20 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:47758: 535 Incorrect authentication data (set_id=info@inovasite.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-18 06:06:20 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:36154: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-18 06:06:40 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:60880: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.171.42.206
country_id: 1814991
description:
2025-11-18 06:06:23 dovecot_login authenticator failed for ([39.171.42.206]) [39.171.42.206]:36026: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 06:06:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<+0s2x9pDen2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-18 06:06:58 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:49836: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.250
country_id: 1814991
description:
2025-11-18 06:07:01 dovecot_login authenticator failed for ([219.128.55.250]) [219.128.55.250]:40438: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.208.26
country_id: 6252001
description:
2025-11-18 06:06:12 dovecot_plain authenticator failed for (parin-test.kpz0ku3kfnqubkkeppdkbtt1th.bx.internal.cloudapp.net) [20.127.208.26]:64579: 535 Incorrect authentication data (set_id=sociais@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.211.194.58
country_id: 1814991
description:
2025-11-18 06:06:19 dovecot_login authenticator failed for ([60.211.194.58]) [60.211.194.58]:9381: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-18 06:06:23 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:39472: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2025-11-18 06:06:37 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:43870: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-18 06:06:40 dovecot_login authenticator failed for ([152.52.234.232]) [103.251.31.34]:47552: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 06:06:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<ZmY3yNpDfKp2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.195.94.243
country_id: 2017370
description:
2025-11-18 06:06:50 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:54146: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<V0mzx9pDQumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.111.3.59
country_id: 2017370
description:
2025-11-18 06:06:33 dovecot_login authenticator failed for (noname.vdonsk.ru) [193.111.3.59]:42332: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 06:07:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<TXCFzNpDItjBl4nP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:08:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DngXzdpDiKqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 06:07:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<U/fKydpDcsWGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 06:07:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<nQQaytpDCM4zTY0d>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UFRIy9pDGqGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 06:07:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<Z+9Ny9pDzKel0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-18 06:07:48 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:52173: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.151.242.210
country_id: 2017370
description:
2025-11-18 06:07:18 dovecot_login authenticator failed for ([46.151.242.210]) [46.151.242.210]:58832: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:07:38 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52296: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2025-11-18 06:07:39 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60464: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 06:08:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<B1X7zNpDMoMI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.49
country_id: 1668284
description:
2025-11-18 06:08:08 dovecot_login authenticator failed for 221-120-4-49.emome-ip.hinet.net [221.120.4.49]:59588: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.131.243.102
country_id: 1814991
description:
2025-11-18 06:08:16 dovecot_login authenticator failed for ([183.131.243.102]) [183.131.243.102]:60662: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 06:08:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<ZOKhztpDGrYtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VqnbztpD1rWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-18 06:08:34 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:49856: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 06:08:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<rV+rz9pDjM6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-18 06:08:48 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:35772: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-11-18 06:09:33 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:44298: 535 Incorrect authentication data (set_id=michael@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-11-18 06:09:55 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:42922: 535 Incorrect authentication data (set_id=michael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 06:10:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<aBQK1NpDgJh3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 06:09:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<DNMl0tpDtuQtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 06:09:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57279: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XvVt0tpDNs2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-11-18 06:10:59 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:55628: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iwfJ19pDkIGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-18 06:11:07 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:44050: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 06:10:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<eROC1dpDGNeB4kCN>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KHAI1tpDnOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-11-18 06:10:48 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:41732: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 06:11:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<xp9b2tpD1Jtw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-18 06:11:56 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:53112: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.115.201.37
country_id: 2017370
description:
2025-11-18 06:11:25 dovecot_login authenticator failed for ([176.115.201.37]) [176.115.201.37]:38886: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NS+a2dpDSJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-18 06:11:32 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:43106: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-18 06:11:33 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:59522: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Bcgr3dpDiqSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-11-18 06:12:43 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:57367: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.246.87.86
country_id: 2921044
description:
2025-11-18 06:13:06 H=([92.246.87.86]) [92.246.87.86]:63159 F=<info@roc-tech.com> rejected RCPT <projetos@inovasite.com>: "JunkMail rejected - ([92.246.87.86]) [92.246.87.86]:63159 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/92.246.87.86"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
country_id: 1814991
description:
2025-11-18 06:13:07 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:53988: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.119.87
country_id: 1814991
description:
2025-11-18 06:12:15 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:25369: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-11-18 06:12:20 dovecot_login authenticator failed for ([175.125.68.208]) [175.125.68.208]:57786: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 06:13:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<UH2P4dpDQoSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-18 06:13:33 dovecot_login authenticator failed for (nsg-corporate-150.219.186.122.airtel.in) [122.186.219.150]:55318: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-18 06:13:26 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:39234: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4hG84NpDUL2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 06:13:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<unH84NpDQKmnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-18 06:13:42 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:64365: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-11-18 06:13:52 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:57683: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.91.53
country_id: 1814991
description:
2025-11-18 06:14:01 dovecot_login authenticator failed for ([60.175.91.53]) [60.175.91.53]:55740: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 06:13:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<oGxF39pDfoivfiX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BkqK4tpD6sexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.91.215.98
country_id: 1814991
description:
2025-11-18 06:15:01 dovecot_login authenticator failed for ([106.91.215.98]) [106.91.215.98]:59470: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.179
country_id: 1668284
description:
2025-11-18 06:15:02 dovecot_login authenticator failed for 111-70-49-179.emome-ip.hinet.net [111.70.49.179]:56130: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-18 06:15:03 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:49240: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2025-11-18 06:14:15 dovecot_login authenticator failed for (nhavuivn.com) [210.245.33.154]:57862: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2025-11-18 06:14:15 dovecot_login authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:48894: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.117.108
country_id: 1814991
description:
2025-11-18 06:14:19 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:34699: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 06:14:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<RaA75dpDIKdA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-18 06:14:52 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:32940: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JglU5NpDvNaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 06:14:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<+jLv5NpDdpFSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 06:14:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<4HA25dpDrpMkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2025-11-18 06:14:52 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:47756: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
country_id: 1814991
description:
2025-11-18 06:15:07 dovecot_login authenticator failed for ([223.100.248.64]) [223.100.248.64]:57359: 535 Incorrect authentication data (set_id=nfe2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-18 06:14:32 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:37192: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2025-11-18 06:14:33 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:36907: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-18 06:14:35 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43154: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-18 06:15:14 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:55055: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.222.60
country_id: 357994
description:
2025-11-18 06:15:20 dovecot_login authenticator failed for ([41.65.118.172]) [154.177.222.60]:37908: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 06:15:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<cKuW59pDIsQ7GIXF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l5nc59pDToGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 06:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<TtfD59pDPJB9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-18 06:15:41 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:35659: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.152.52.60
country_id: 6252001
description:
2025-11-18 06:16:27 H=(200.150.196.245) [104.152.52.60]:50709 F=<relaycheck_please_ignore@protonmail.com> rejected RCPT <relaycheck_please_ignore@protonmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GdJv69pDzpaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 06:17:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<YkJf7dpDEMEv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.105
country_id: 1814991
description:
2025-11-18 06:16:10 dovecot_login authenticator failed for ([223.166.105.105]) [223.166.105.105]:58276: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 06:16:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<gN7a6tpDSrh2wSaf>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 104.152.52.213
country_id: 6252001
description:
Nov 18 06:16:26 hosting dovecot: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=104.152.52.213, lip=200.150.196.245, session=<pVQY69pDaa5omDTV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-18 06:16:35 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:60306: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 06:16:49 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:60692: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.201.218.146
country_id: 1814991
description:
2025-11-18 06:16:49 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:55192: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-18 06:17:00 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:46994: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iJNA7dpDWqixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-18 06:17:05 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:42092: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-18 06:17:06 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:55732: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.222.126.213
country_id: 6252001
description:
2025-11-18 06:17:09 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:38943: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 06:17:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<5fjz7dpDitvBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2025-11-18 06:17:24 dovecot_login authenticator failed for ([103.130.207.227]) [103.130.207.227]:36518: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SFUP79pDlLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 06:17:38 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:58080: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-18 06:17:25 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:51414: 535 Incorrect authentication data (set_id=secretaria@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 06:17:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<r4g179pDntgrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2025-11-18 06:17:38 dovecot_login authenticator failed for 80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:35530: 535 Incorrect authentication data (set_id=secretaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-18 06:17:39 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:40422: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-18 06:18:06 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:38026: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.101.79.13
country_id: 1814991
description:
2025-11-18 06:19:03 dovecot_login authenticator failed for ([114.101.79.13]) [114.101.79.13]:38252: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bsSZ8tpD5MyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.30
country_id: 2186224
description:
2025-11-18 06:18:38 dovecot_login authenticator failed for ([121.73.168.30]) [121.73.168.30]:39838: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 06:18:48 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:50630: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 06:18:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<adDc89pDJMNCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 06:18:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=</7vx89pDtMpxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2025-11-18 06:19:20 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:60484: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O+ow9tpDJOOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-11-18 06:19:37 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:42114: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 06:19:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<tN9699pDqqsvT1jH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<n8X299pD0IKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mqLC+dpDrIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 06:20:33 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61099: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 06:20:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<AIUB+tpDRIJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 06:20:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<ZHA7+tpDY8V3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 06:20:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<mgN2+tpDWNh9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 06:20:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<rCaa+tpDjIqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 06:21:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<xGHV/dpDVN5xoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 06:22:06 dovecot_login authenticator failed for ([24.144.4.218]) [38.87.177.252]:34138: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 06:21:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<qoK6/NpDnseB4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UsBR/dpDzqexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 06:21:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<dbND/dpDCqbBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-11-18 06:21:33 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:36508: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-18 06:21:37 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:43542: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 06:22:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<diUSANtDgpSUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 06:22:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<N+1bANtDvLhns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2025-11-18 06:22:24 dovecot_login authenticator failed for ([61.51.81.78]) [222.128.15.127]:50610: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-18 06:22:56 dovecot_login authenticator failed for ([200.5.113.133]) [200.5.113.133]:15140: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<A+etAttD5smxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1RXnANtDZsGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-18 06:22:36 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:38892: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-11-18 06:22:46 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:59861: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 06:22:56 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55939: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 06:23:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<w8eWAttDWKZvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-18 06:22:34 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52570: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 06:22:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<0Z9kAdtD4OdSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.160.53
country_id: 290557
description:
2025-11-18 06:22:45 dovecot_login authenticator failed for ([87.201.160.53]) [87.201.160.53]:42566: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J+x9BNtD1tKxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.107
country_id: 6252001
description:
[2025-11-18 06:23:36 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-18 06:23:55 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:57426: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-11-18 06:23:18 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:55045: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-18 06:23:28 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1032: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
country_id: 1814991
description:
2025-11-18 06:23:30 dovecot_login authenticator failed for ([222.175.187.214]) [218.59.235.170]:46608: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-18 06:23:19 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:54162: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 06:23:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<RfmQBNtDvoAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 06:23:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<TofeBNtDfOKkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.58.27.153
country_id: 6252001
description:
2025-11-18 06:24:59 dovecot_login authenticator failed for 153-27-58-67.gci.net [67.58.27.153]:59436: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-11-18 06:24:10 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:43291: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.178.169
country_id: 2017370
description:
2025-11-18 06:24:40 dovecot_login authenticator failed for ([95.66.178.169]) [95.66.178.169]:48855: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-11-18 06:24:50 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:38548: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-18 06:24:55 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:64656: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2025-11-18 06:25:05 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:39718: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-18 06:24:11 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:37814: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.77.179.159
country_id: 3617476
description:
2025-11-18 06:24:28 dovecot_login authenticator failed for (159-179-77-186.enitel.net.ni) [186.77.179.159]:35744: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hcYLCNtDIOyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 06:24:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<BNOVCNtD/IKElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-18 06:25:01 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:48157: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-18 06:24:25 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:52291: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.100.212.177
country_id: 1814991
description:
2025-11-18 06:24:39 dovecot_login authenticator failed for ([180.100.212.177]) [180.100.212.177]:35338: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 06:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<zZ9rCNtDasQnaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gRKrC9tD6JaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 06:25:36 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63676: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.143.88
country_id: 1819730
description:
2025-11-18 06:25:47 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:48078: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p3BqDdtDEp+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 06:25:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<H/peCttDHtaYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-11-18 06:25:29 dovecot_login authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:55216: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2025-11-18 06:26:38 dovecot_login authenticator failed for ([220.172.203.43]) [220.172.203.43]:34102: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 06:26:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<lolCENtDgOEnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 06:27:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<B+P7ENtDksNSczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U0w4D9tDFq+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 06:26:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<LLhIDttDOOaGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 06:26:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<JOlUENtD6KWkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 06:27:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<2kT7ENtDdo4v+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-11-18 06:26:13 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:36950: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.73.190.98
country_id: 1835841
description:
Nov 18 06:28:06 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=61.73.190.98, lip=200.150.196.245, TLS, session=<OoeBE9tDGeQ9Sb5i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 06:27:26 dovecot_login authenticator failed for (User) [177.74.174.120]:61057: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aerGEttDZMCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.2.44.54
country_id: 1269750
description:
Nov 18 06:27:41 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@89fmjoinville.com.br>, method=PLAIN, rip=61.2.44.54, lip=200.150.196.245, TLS, session=</boUEttDXJs9Aiw2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 06:28:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<jHafFNtD7NBrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 06:28:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<G0/5FNtDNoKd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 06:28:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<+HUxFdtDKMVvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 06:28:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<PPQiFdtDdsKvfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VzllFttDRtqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rEMsGNtDaOSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 06:28:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<3Z68FdtDwuhCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 06:28:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<DaHFFdtDIs9n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-18 06:28:43 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:52000: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 06:28:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<USUoF9tD9tekXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.197.178.198
country_id: 1835841
description:
2025-11-18 06:29:14 dovecot_login authenticator failed for ([119.197.178.198]) [119.197.178.198]:53021: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Kun5GdtDuoSxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.115.81.146
country_id: 1831722
description:
[2025-11-18 06:29:43 -0300] info [cpaneld] 45.115.81.146 - deproico "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 06:29:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<0QHBGttDFt8tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 06:29:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<Jc81G9tDZu0kMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-11-18 06:30:09 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:38950: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-18 06:30:28 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:47926: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2mKLHdtD8JuxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.78.42
country_id: 2635167
description:
[2025-11-18 06:30:50 -0300] info [cpaneld] 77.68.78.42 - lixadora "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadora (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 06:31:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<YFktINtDduCP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
country_id: 1814991
description:
2025-11-18 06:31:29 dovecot_login authenticator failed for ([60.167.19.189]) [60.167.19.189]:33203: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zM4bIdtD3K+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-18 06:31:52 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:59861: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.54.224
country_id: 798544
description:
2025-11-18 06:31:56 dovecot_login authenticator failed for 89-67-54-224.dynamic.play.pl [89.67.54.224]:34055: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.56.242
country_id: 1814991
description:
2025-11-18 06:31:12 dovecot_login authenticator failed for ([120.224.56.242]) [120.224.56.242]:33474: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 06:31:29 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:51612: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.169
country_id: 6252001
description:
2025-11-18 06:31:39 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:59510: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.183.100.27
country_id: 2017370
description:
2025-11-18 06:31:45 dovecot_login authenticator failed for (argument.net.tomline.ru) [213.183.100.27]:60772: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-11-18 06:31:53 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:50514: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H67nIttDzL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.128.190
country_id: 1814991
description:
2025-11-18 06:32:22 dovecot_login authenticator failed for ([58.56.128.190]) [58.56.128.190]:46742: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BgisJNtDlsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 06:32:37 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:32876: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2025-11-18 06:32:45 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:35702: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-18 06:32:54 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:44402: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-18 06:32:56 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:55770: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-18 06:33:04 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:40406: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-18 06:32:07 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:52328: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2025-11-18 06:32:39 dovecot_login authenticator failed for ([103.130.207.227]) [103.130.207.227]:40820: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-18 06:32:45 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:56551: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 06:33:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<G5k8JttDrsNA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:33:02 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52115: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-18 06:33:18 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:63063: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
country_id: 1835841
description:
2025-11-18 06:33:25 dovecot_login authenticator failed for ([121.164.135.251]) [121.164.135.251]:34301: 535 Incorrect authentication data (set_id=marcos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-18 06:33:47 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:60622: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 06:33:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<laIpJ9tDEqYv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.232.167
country_id: 2017370
description:
2025-11-18 06:33:22 dovecot_login authenticator failed for ([95.221.232.167]) [95.221.232.167]:52612: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 06:33:40 dovecot_login authenticator failed for (User) [177.74.174.120]:63608: 535 Incorrect authentication data (set_id=gomes@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 06:33:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<+blfKdtDaK4rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2025-11-18 06:33:54 dovecot_login authenticator failed for ([121.148.184.47]) [121.148.184.47]:36327: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-18 06:33:12 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:40639: 535 Incorrect authentication data (set_id=marcos@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<giVCKNtDwOGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 06:33:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<KE66KNtDnqMI1et7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 06:33:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<nW3vJ9tDtMBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.211.111.149
country_id: 1562822
description:
2025-11-18 06:33:51 dovecot_login authenticator failed for ([210.211.111.147]) [210.211.111.149]:37342: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 06:33:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<21WaJttDMMJ3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2025-11-18 06:33:12 dovecot_login authenticator failed for ([110.185.173.167]) [110.185.173.167]:40328: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-11-18 06:33:16 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:59102: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 06:34:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<gtHEK9tDtuRCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0AmgLdtD7pqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.168.190
country_id: 1814991
description:
2025-11-18 06:34:24 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:61956: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 06:34:13 dovecot_login authenticator failed for (User) [177.74.174.120]:63608: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 06:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<wt80K9tDzJckMrBu>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BdvOK9tDDoixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.229.146
country_id: 1814991
description:
2025-11-18 06:34:42 dovecot_login authenticator failed for ([218.93.229.146]) [218.93.229.146]:40289: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 06:34:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<eHz2LNtDwtml0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.144
country_id: 1835841
description:
2025-11-18 06:34:10 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:49465: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 06:34:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<Q60LLNtD7O5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 06:34:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<Ve6/K9tDYMlAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-18 06:34:16 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:42262: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 06:34:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<w+gOLdtDiKhbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 06:34:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63559: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 06:35:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<PSqnMNtDDLh3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 06:36:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<Q88CMdtD0Mprhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 06:35:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<dBjsLttD1uIv+wDY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EABvL9tDNqSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.75.186
country_id: 1835841
description:
2025-11-18 06:36:31 dovecot_login authenticator failed for ([59.6.75.186]) [59.6.75.186]:46608: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.39.216.210
country_id: 3017382
description:
2025-11-18 06:36:34 dovecot_plain authenticator failed for ([10.181.195.229]) [170.39.216.210]:62051: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
country_id: 1814991
description:
2025-11-18 06:36:39 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:44964: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.170.146.177
country_id: 1814991
description:
2025-11-18 06:36:46 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:60656: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2025-11-18 06:37:00 dovecot_login authenticator failed for ([120.194.50.39]) [120.194.50.39]:16486: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.152
country_id: 6252001
description:
2025-11-18 06:36:13 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:58371: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<j5z9MttD6ryxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 06:37:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<m+UFNdtDgNWd5hjP>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YdOJNttDANexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 06:37:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<b3j/NttD1NwtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 06:37:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<6JntN9tDbG1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 06:37:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<aW8VNdtDgIqiAOAm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0VdYONtDROGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.109.208
country_id: 1819730
description:
2025-11-18 06:38:04 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:47839: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-18 06:38:29 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:47780: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 06:38:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<BNRoO9tD1JmYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 06:38:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<1k5vO9tDLKsO4dKR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 06:39:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<xZzhO9tDxrpSnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<h/8mOttDZOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 06:38:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<SQnROttDEMN57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-18 06:38:52 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:52318: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.19.166
country_id: 290557
description:
2025-11-18 06:38:53 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:57653: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 06:39:59 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:40950: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 06:40:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<O9VmP9tDLN4+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-11-18 06:39:18 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:41424: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-18 06:39:19 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:46392: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B9mxPdtD3paxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.163.5
country_id: 2017370
description:
2025-11-18 06:39:43 dovecot_login authenticator failed for ([176.226.163.5]) [176.226.163.5]:54506: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.196.141
country_id: 1819730
description:
2025-11-18 06:39:58 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:54028: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2025-11-18 06:40:16 dovecot_login authenticator failed for ([59.16.192.32]) [59.16.192.32]:52308: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.96.36.174
country_id: 1814991
description:
2025-11-18 06:40:19 dovecot_login authenticator failed for ([36.96.36.174]) [36.96.36.174]:54699: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 06:40:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<xsaHQNtDzoyKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2025-11-18 06:40:46 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:54408: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-11-18 06:40:51 dovecot_login authenticator failed for (static.92.254.104.190.cps.com.ar) [190.104.254.91]:56774: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 06:40:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<YdFfQttD5JwIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-18 06:40:44 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:47572: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.199.171.246
country_id: 1269750
description:
2025-11-18 06:40:47 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:51889: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 06:41:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<sUcaQ9tDNK/SchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-18 06:40:18 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:40608: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0nlNQdtDuLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.215.154
country_id: 2017370
description:
2025-11-18 06:40:35 dovecot_login authenticator failed for ([109.233.215.154]) [109.233.215.154]:38376: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:40:59 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52063: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q0UWQ9tDoruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-18 06:40:21 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:60542: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 06:41:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<c5LIQ9tDvoqYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 06:41:21 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:60481: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kPjaRNtDksuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-18 06:41:38 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:35324: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.241.68
country_id: 2264397
description:
2025-11-18 06:41:08 dovecot_login authenticator failed for ([93.102.241.68]) [93.102.241.68]:59812: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-11-18 06:41:38 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:37422: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2025-11-18 06:41:46 dovecot_login authenticator failed for ([218.75.123.109]) [183.247.171.186]:39622: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 06:42:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<h2KNRttD4MJ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.163
country_id: 1668284
description:
2025-11-18 06:42:04 dovecot_login authenticator failed for 111-70-33-163.emome-ip.hinet.net [111.70.33.163]:39808: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.156.122
country_id: 1814991
description:
2025-11-18 06:41:10 dovecot_login authenticator failed for (122.156.170.222.broad.sh.hl.dynamic.163data.com.cn) [222.170.156.122]:41551: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:42:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8mh4SNtDnt6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-18 06:42:35 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:39833: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-18 06:42:41 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:48157: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-11-18 06:43:00 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:57016: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-11-18 06:42:15 dovecot_login authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:37783: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 06:42:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<ECpYR9tD1MyUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:42:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52180: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 06:43:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<3LuJTNtDtIykXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:43:56 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51988: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 06:43:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<6Nl/TdtD3IGB4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U7bKTdtDvJKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 06:43:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<QoCvS9tDlsanYwhf>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AXoJTNtDgomxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 06:43:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<UaFTTNtDVt2kXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 06:43:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<E6E4S9tD9qk+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 06:44:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<rONfTttDXq9AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2025-11-18 06:44:29 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:51306: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QTKbT9tDRKKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 06:44:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<Vmb1T9tD7tiElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-18 06:44:51 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:38352: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 06:45:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<7b3xUttDQI/SchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cYozU9tDkrmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 06:45:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Fu5FU9tDhKel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 06:45:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<ni8CVNtDWFWKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 06:46:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<eRGzVdtD2LJw2eny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:47:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FB2QWNtDmtyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 06:46:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<I9x6V9tDLrq317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 06:47:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<V++aWNtD1LuUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 06:46:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<ACuAVttDOs5ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-11-18 06:46:31 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:56777: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2025-11-18 06:46:45 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:43944: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-18 06:46:58 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:55466: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 06:46:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<s/1fVNtDFsNzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 06:46:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<ctuoVdtDvuuB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 06:46:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<9JppVttDUNRA44h6>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<e9zCVttDEM2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 06:46:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<MC+yVttDDs4zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 06:47:29 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:57528: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:47:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9TlaWttD6uSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-11-18 06:48:02 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:44798: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 06:47:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Q4v4WNtDEI4tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 06:47:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:54346: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 06:47:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<PfdoWdtDjsoI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 06:47:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<P6g6W9tDYsUXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 06:48:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<n7DfXdtDuN+Gx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-18 06:48:37 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:56202: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-18 06:48:47 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:38596: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 06:48:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<yWpHX9tDysinR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 06:48:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<xkx4XNtDQIstPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 06:48:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<WAUWXdtDAuWdQi/y>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<spbhXdtD7o2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 06:49:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<RfQ5YttDdrCkXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Y2VAY9tD4qyxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uJN/YdtD7J+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 06:50:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=</x+AY9tDHoal0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AgoTZdtDDLaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 06:50:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<1TkNZttDN6J3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-18 06:50:57 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:33396: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 06:51:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<cvgBZ9tD6KZ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-11-18 06:51:13 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:47935: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<prinaNtDus6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.154.166
country_id: 1814991
description:
2025-11-18 06:51:55 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:38174: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 06:52:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<B3QMa9tDBiSnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2025-11-18 06:52:20 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:37856: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.122.210
country_id: 2017370
description:
2025-11-18 06:52:22 dovecot_login authenticator failed for ([5.141.122.210]) [5.141.122.210]:35226: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1y0zbNtDjOaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.50
country_id: 1668284
description:
2025-11-18 06:52:37 dovecot_login authenticator failed for 221-120-4-50.emome-ip.hinet.net [221.120.4.50]:36276: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-11-18 06:53:00 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:49318: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<b8sEbttDFICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-18 06:53:44 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:47888: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 06:53:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<668qcdtDcI2B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.19
country_id: 2186224
description:
2025-11-18 06:54:05 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:45138: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
country_id: 1814991
description:
2025-11-18 06:53:22 dovecot_login authenticator failed for ([124.67.121.58]) [124.67.121.58]:48965: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E17Eb9tDnoixV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 06:53:36 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<fhoLcNtDqdSxm8ew>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KOxec9tD5qSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.181
country_id: 2186224
description:
2025-11-18 06:54:57 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:49454: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.104
country_id: 3469034
description:
2025-11-18 06:55:03 H=(localhost) [179.0.178.104]:54336 F=<postmaster@mail.com> rejected RCPT <louvoreterno@louvoreterno.com.br>: Nenhuma pessoa no endereço."


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2025-11-18 06:55:07 dovecot_login authenticator failed for ([182.139.39.150]) [182.139.39.150]:48360: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 06:54:12 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52056: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 06:54:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<2Pd6cttDBplSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-18 06:55:11 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:56346: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2025-11-18 06:55:11 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:57082: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.30.43.42
country_id: 1835841
description:
2025-11-18 06:55:24 dovecot_login authenticator failed for ([210.117.217.236]) [202.30.43.42]:34675: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
country_id: 1814991
description:
2025-11-18 06:55:09 dovecot_login authenticator failed for ([123.52.202.92]) [123.52.202.92]:36642: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<A2fvdttDZsGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 06:55:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<8KE4eNtDcIeWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.226.196
country_id: 1814991
description:
2025-11-18 06:55:56 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:33524: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2025-11-18 06:55:11 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:52177: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.168.190
country_id: 1814991
description:
2025-11-18 06:55:21 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:51682: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 06:55:54 dovecot_login authenticator failed for (mail.highqualityautoparts.com.br) [111.122.211.212]:8652: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 06:55:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<AD11ddtDTlWvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-11-18 06:55:21 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:50920: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-18 06:55:23 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:52833: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 06:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<hA5beNtD0OJA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<S3azeNtDCsuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.61
country_id: 6252001
description:
2025-11-18 06:56:47 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:58944: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.248.115.172
country_id: 1562822
description:
2025-11-18 06:56:59 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.248.115.172]:54055: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 06:56:18 dovecot_login authenticator failed for (mail.highqualityautoparts.com.br) [111.122.211.212]:13410: 535 Incorrect authentication data (set_id=admin@highqualityautoparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-11-18 06:56:21 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:46876: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JEWJettDxNuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 06:57:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<fGscfNtDyK19gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2025-11-18 06:56:24 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:59808: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-18 06:56:27 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:35308: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 06:56:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<4xS9edtDzLkv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-11-18 06:56:41 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:35795: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-18 06:56:53 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1197: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.126.90.69
country_id: 1814991
description:
2025-11-18 06:57:02 dovecot_login authenticator failed for ([119.126.90.69]) [119.126.90.69]:42982: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 06:57:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<J/UjfNtD6ufBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
country_id: 1835841
description:
2025-11-18 06:57:04 dovecot_login authenticator failed for ([222.99.237.249]) [222.99.237.249]:54825: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-18 06:56:08 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40428: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
country_id: 1814991
description:
2025-11-18 06:56:12 dovecot_login authenticator failed for ([221.2.153.49]) [221.2.153.49]:56442: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.184.193.67
country_id: 6252001
description:
2025-11-18 06:58:01 dovecot_login authenticator failed for ([157.230.66.74]) [137.184.193.67]:53204: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-11-18 06:57:15 dovecot_login authenticator failed for (31-154-85-196.orange.net.il) [2.55.85.196]:47919: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6iMVfttDLICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.184.202
country_id: 1814991
description:
2025-11-18 06:57:49 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:49665: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 58.49.113.138
country_id: 1814991
description:
Nov 18 06:57:40 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<eliezer@1075fm.com.br>, method=PLAIN, rip=58.49.113.138, lip=200.150.196.245, session=<Zw03fdtDSUs6MXGK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 06:57:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<5ADOfttD8K87GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.194.58
country_id: 1814991
description:
2025-11-18 06:57:54 dovecot_login authenticator failed for ([60.15.194.58]) [60.15.194.58]:52722: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-18 06:57:17 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:56320: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-18 06:57:43 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:46354: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.200.20.66
country_id: 290557
description:
Nov 18 06:57:45 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<eliezer@1075fm.com.br>, method=PLAIN, rip=94.200.20.66, lip=200.150.196.245, TLS, session=<n7CKfttDG9xeyBRC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-11-18 06:57:30 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:18550: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 06:57:41 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:58295: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 06:57:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<vNv3fttD2oR2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-18 06:57:57 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:2366: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 06:58:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<Qwnwf9tDwuormxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.212.194
country_id: 1269750
description:
2025-11-18 06:57:12 dovecot_login authenticator failed for ([61.2.212.194]) [61.2.212.194]:36806: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 06:57:26 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63512: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-18 06:57:29 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:38673: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2025-11-18 06:58:20 dovecot_login authenticator failed for ([121.185.89.74]) [121.185.89.74]:46638: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yy2kgdtDNKKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-11-18 06:58:34 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:32870: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 06:58:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<PHTDgttDTutCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<isB0g9tDWK2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 124.167.20.116
country_id: 1814991
description:
Nov 18 06:58:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<eliezer>, method=PLAIN, rip=124.167.20.116, lip=200.150.196.245, TLS, session=<XIQBf9tDGtN8pxR0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-11-18 06:58:50 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:57016: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 06:58:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58172: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-11-18 06:59:08 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:41158: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 06:59:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<ZDUUhNtDMJ0kMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-11-18 06:59:20 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:38536: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 06:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eAdChdtDwryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-11-18 06:59:40 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:34422: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 06:59:55 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:48277: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 06:59:56 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:53063: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 07:00:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<UbodittDUphzR+4E>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dzjQiNtDGNexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 07:02:03 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62520: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.100.212.177
country_id: 1814991
description:
2025-11-18 07:01:28 dovecot_login authenticator failed for ([180.100.212.177]) [180.100.212.177]:51908: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:01:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<K1RRjNtDzc53xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 07:01:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<28dNjdtDxsOB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 07:01:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<GWLGjdtDXN1xoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 07:01:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<JtJYi9tDjNRn9M4G>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</NBgjNtDBuyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-11-18 07:01:43 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:44332: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hYoxjttDAJGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-18 07:03:02 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12113: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 07:02:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<P0aTjttDnoZ9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 07:02:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<T5gDj9tDxtAvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.176
country_id: 690791
description:
2025-11-18 07:02:29 dovecot_login authenticator failed for (host176-90-16-178.reedlan.com) [178.16.90.176]:57237: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-11-18 07:02:36 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:54340: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-18 07:02:42 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:38198: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 07:03:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<g7uikdtDDu6P9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VO70j9tDtp2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.250.78.191
country_id: 3686110
description:
2025-11-18 07:02:31 dovecot_login authenticator failed for (static-adsl190-250-78-191.une.net.co) [190.250.78.191]:65252: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.223
country_id: 1668284
description:
2025-11-18 07:02:32 dovecot_login authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:45522: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2025-11-18 07:02:49 dovecot_login authenticator failed for 80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:35536: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-18 07:02:52 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:41200: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.120.26
country_id: 1814991
description:
2025-11-18 07:03:12 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:38402: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:03:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<WX5FkttDHINns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J3+Gk9tDKNixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-18 07:03:45 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:44356: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-11-18 07:03:56 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:45332: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 07:03:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<gz2UkttDpL6ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 07:03:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<paQCk9tDAo+UcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2025-11-18 07:03:37 dovecot_login authenticator failed for (3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:38541: 535 Incorrect authentication data (set_id=regiane@singseguros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.131.125
country_id: 2017370
description:
2025-11-18 07:03:48 dovecot_login authenticator failed for broadband-95-84-131-125.ip.moscow.rt.ru [95.84.131.125]:34054: 535 Incorrect authentication data (set_id=regiane)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 07:04:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<hBU6ldtDXOdvAEul>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JJAil9tDzJmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-11-18 07:04:42 dovecot_login authenticator failed for ([1.31.80.222]) [1.31.80.222]:44340: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-18 07:04:26 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:41088: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-18 07:04:31 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:39172: 535 Incorrect authentication data (set_id=financeiro@kglsolucoes.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 07:04:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<PT65l9tD4qFxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kjPjmNtDPLixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 07:04:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Mw4bl9tDTseYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.28.244
country_id: 2017370
description:
2025-11-18 07:04:35 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:44297: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-18 07:05:00 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:40188: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 07:05:01 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:42333: 535 Incorrect authentication data (set_id=adm@fundamentalbrinquedos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-18 07:04:44 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:58437: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.85
country_id: 1668284
description:
2025-11-18 07:04:46 dovecot_login authenticator failed for 116-59-11-85.emome-ip.hinet.net [116.59.11.85]:60352: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2025-11-18 07:04:53 dovecot_login authenticator failed for ([213.234.9.218]) [213.234.9.218]:57716: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2025-11-18 07:05:47 dovecot_login authenticator failed for ([121.18.148.10]) [121.18.148.10]:36400: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
country_id: 1814991
description:
2025-11-18 07:05:51 dovecot_login authenticator failed for ([36.154.134.146]) [36.154.134.146]:58376: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 07:05:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<hmlbmdtDOrhSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 07:05:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<7gqVmdtDoMk+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.201.218.146
country_id: 1814991
description:
2025-11-18 07:05:24 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:53818: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1JasmttDWMWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
country_id: 1814991
description:
2025-11-18 07:05:46 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:40467: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.206.226.8
country_id: 2017370
description:
2025-11-18 07:05:47 dovecot_login authenticator failed for (8.226.206.178.in-addr.arpa) [178.206.226.8]:58794: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-18 07:05:54 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:40134: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-18 07:05:16 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:57114: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-11-18 07:05:21 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:41774: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.194.58
country_id: 1814991
description:
2025-11-18 07:05:32 dovecot_login authenticator failed for ([60.15.194.58]) [60.15.194.58]:55749: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 07:06:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<zzrknttD7OMnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-11-18 07:06:49 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:49827: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-11-18 07:07:04 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:59500: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2025-11-18 07:06:15 dovecot_login authenticator failed for (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:56860: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-11-18 07:06:31 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:60840: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WGM/nttDXpqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 07:06:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<pUFKnttDJrNSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 07:06:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<iuFsnttDVpIv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 07:06:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1oCvnNtDYrnBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 07:06:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<bov9nNtDMrmd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-11-18 07:07:50 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:47058: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 07:07:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<ne+xodtDQrSGx8nN>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9b7codtDxrmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-18 07:07:36 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:55858: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.188
country_id: 1814991
description:
2025-11-18 07:07:43 dovecot_login authenticator failed for ([163.179.123.188]) [163.179.123.188]:38573: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<maGco9tDgs2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-18 07:08:06 dovecot_login authenticator failed for ([180.129.66.134]) [180.129.66.134]:54191: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:07:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51927: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 07:08:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<+AtQpNtDGpwtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2025-11-18 07:08:19 dovecot_login authenticator failed for 93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:48351: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.58.156.82
country_id: 1668284
description:
2025-11-18 07:08:25 dovecot_login authenticator failed for (82-156-58-61.tinp.net.tw) [61.58.156.82]:35324: 535 Incorrect authentication data (set_id=financeiro@quintalbrincante.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.240
country_id: 1814991
description:
2025-11-18 07:08:35 dovecot_login authenticator failed for ([111.26.167.239]) [111.26.167.240]:58052: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 07:08:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<R56/pNtDSNtrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 18 07:08:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<wLsBo9tDepB6kIMZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-18 07:08:56 dovecot_login authenticator failed for (adlondrina.com.br) [61.50.119.110]:24828: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:09:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<lNv8pttDKKlns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2025-11-18 07:08:26 dovecot_login authenticator failed for ([36.135.92.35]) [36.135.92.36]:59308: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 07:08:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<NWf/pNtDmLZCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0kxvpdtDEN2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2025-11-18 07:08:34 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:46290: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:08:35 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51638: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-11-18 07:08:48 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:39336: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 07:08:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<uYqcpttDBJQnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 07:09:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<+a0sp9tDAt1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 07:10:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<VV2DqttDLI+vfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2025-11-18 07:09:26 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:53891: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 07:10:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<ufd+qttDhsRzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2025-11-18 07:09:13 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:45176: 535 Incorrect authentication data (set_id=info@mag.adv.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-18 07:09:22 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:39010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nx79qNtDQoixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-18 07:09:41 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:59058: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-18 07:09:56 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:26011: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.147.196.170
country_id: 1814991
description:
2025-11-18 07:10:03 dovecot_login authenticator failed for ([219.147.196.170]) [219.147.196.170]:49315: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 07:09:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<tazSp9tD3o5vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-18 07:09:21 dovecot_login authenticator failed for (adlondrina.com.br) [61.50.119.110]:29586: 535 Incorrect authentication data (set_id=test@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2025-11-18 07:09:09 dovecot_login authenticator failed for 110-25-109-53.adsl.fetnet.net [110.25.109.53]:33244: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 07:09:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:52210: 535 Incorrect authentication data (set_id=postamster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.206.10
country_id: 1814991
description:
2025-11-18 07:10:15 dovecot_login authenticator failed for ([124.115.206.10]) [124.115.206.10]:44496: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.180.252.183
country_id: 6252001
description:
2025-11-18 07:10:56 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:52879: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.42.206.123
country_id: 357994
description:
2025-11-18 07:11:00 dovecot_login authenticator failed for ([41.65.118.172]) [41.42.206.123]:40370: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 07:11:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64648: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<by+brNtD5qKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 07:10:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<LIRSrdtDnLk+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sYlhrttDfKuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 07:11:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<uVhGrttD4OXBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.47.242
country_id: 2017370
description:
2025-11-18 07:11:15 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:51142: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 07:11:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<cAOxr9tDIrh2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QLsqsNtD8ruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.3.179.215
country_id: 2017370
description:
2025-11-18 07:11:32 dovecot_login authenticator failed for (5x3x179x215.dynamic.spb.ertelecom.ru) [5.3.179.215]:59836: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-11-18 07:11:52 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:41397: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2025-11-18 07:11:26 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:37848: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 07:11:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<dDz5r9tDmlIkMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 07:11:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<oRUvsNtDRpel0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:12:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51542: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-18 07:12:30 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:38788: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<80y5s9tDLNmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.158
country_id: 1269750
description:
2025-11-18 07:12:46 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:51166: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
country_id: 1814991
description:
2025-11-18 07:13:03 dovecot_login authenticator failed for ([61.189.61.162]) [61.189.61.162]:51464: 535 Incorrect authentication data (set_id=atendimento@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.135.168.148
country_id: 1814991
description:
2025-11-18 07:12:08 dovecot_login authenticator failed for ([219.135.168.148]) [219.135.168.148]:34341: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:12:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<J5qpsttD6OBns7yS>


